ConLBS: An Attack Investigation Approach Using Contrastive Learning with Behavior Sequence.

Area of Science:

• Cybersecurity
• Computer Forensics
• Machine Learning

Background:

• Effective attack investigation is crucial in forensics analysis.
• Supervised methods require extensive labeled data, which is often scarce.
• Unsupervised methods struggle with disguised attacks due to similarities with normal behaviors.

Purpose of the Study:

• To propose ConLBS, an approach combining contrastive learning and multi-layer transformers for behavior sequence classification.
• To enhance the identification of disguised attacks in digital forensics.
• To enable flexible training (supervised or unsupervised) based on data availability.

Main Methods:

• Constructing behavior sequences from audit logs to describe patterns.
• Employing a novel lemmatization strategy for semantic mapping to an attack pattern layer.
• Utilizing contrastive learning and a multi-layer transformer network.
• Exploring four augmentation strategies to differentiate attack and normal behavior sequences.
• Performing unsupervised representation learning on unlabeled sequences.

Main Results:

• ConLBS demonstrates effectiveness in identifying attack behavior sequences with unlabeled or limited labeled data.
• The approach achieves superior performance compared to existing methods and models in attack investigation.
• Evaluated on two public datasets, ConLBS shows robust attack detection capabilities.

Conclusions:

• ConLBS offers a powerful solution for attack investigation, particularly in scenarios with data scarcity.
• The combination of contrastive learning and transformer networks significantly improves the detection of sophisticated attacks.
• ConLBS provides a versatile and effective tool for digital forensics analysis.