Malicious login detection using long short-term memory with an attention mechanism - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2021

Malicious login detection using long short-term memory with an attention mechanism

Résumé

Advanced persistent threats routinely leverage lateral movements in networks to cause harm. In fact, lateral movements account for more than 80% of the time involved in attacks. Attackers typically use stolen credentials to make lateral movements. However, current detection methods are too coarse grained to detect lateral movements effectively because they focus on malicious users and hosts instead of abnormal log entries that indicate malicious logins.This chapter proposes a malicious login detection method that focuses on attacks that steal credentials. The fine-grained method employs a temporal neural network embedding to learn host jumping representations. The learned host vectors and initialized attribute vectors in log entries are input to a long short-term memory with an attention mechanism for login feature extraction, which determines if logins are malicious. Experimental results demonstrate that the proposed method outperforms several baseline detection models.
522103_1_En_8_Reference.pdf (573.78 Ko) Télécharger le fichier

Dates et versions

hal-03764375 , version 1 (31-08-2022)

Licence

Paternité

Identifiants

Citer

Yanna Wu, Fucheng Liu, Yu Wen. Malicious login detection using long short-term memory with an attention mechanism. 17th IFIP International Conference on Digital Forensics (DigitalForensics), Feb 2021, Virtual, China. pp.157-173, ⟨10.1007/978-3-030-88381-2_8⟩. ⟨hal-03764375⟩
48 Consultations
3 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More