A semantic‐based method for analysing unknown malicious behaviours via hyper‐spherical variational auto‐encoders

Abstract

Abstract In the User and Entity Behaviour Analytics (UEBA), unknown malicious behaviours are often difficult to be automatically detected due to the lack of labelled data. Most of the existing methods also fail to take full advantage of the threat intelligence and incorporate the impact of the behaviour patterns of the benign users. To address this issue, this paper proposes a Generalised Zero‐Shot Learning (GZSL) method based on hyper‐spherical Variational Auto‐Encoders (VAEs). Compared to the VAEs, the authors’ proposed method is more robust and suitable for capturing data with richer and more nuanced structures. The authors’ method analyses the unknown malicious behaviours by projecting them and their semantic attributes to shared space. These are then matched by the cosine similarity. The authors further use a Graph Convolutional Network (GCN) to reduce the impact of different user behaviour patterns before projection. The experimental results indicate that the proposed method is efficient in the analysis of unknown malicious behaviours.

Keywords

• generalised zero‐shot learning
• hyper‐spherical variational auto‐encoders
• unknown malicious behaviours
• user and entity behaviour analytics