User Classification by Local to Global Sequence Alignment Techniques for Anomaly-Based Intrusion Detection

摘要

A sequence of events by a single user with at least one computing system are monitored. Each event characterizes user interaction with the at least one computing system and the sequence of events form a plurality of pairwise disjoint log samples. Thereafter, it is determined, using an adjacency graph trained using a plurality of log samples generated by a plurality of users, whether any of the log samples is anomalous. Data can be provided that characterizes the log samples determined to be anomalous. Related apparatus, systems, techniques and articles are also described.