Unsupervised Anomaly Detection Using a New Knowledge Graph Model for Network Activity and Events

The activity and event network (AEN) is a new knowledge graph used to develop and maintain a model for a whole network under monitoring and the relationships between the different network entities as they change through time. In this paper, we show how the AEN graph model can be used for threat identification by introducing an unsupervised anomaly detection model that leverages the probabilistic characteristics of the graph and the bits of meta rarity metric. A series of statistical features and underlying distributions are computed based on the graphical model of network activity and events. The anomaly scores of events are calculated by applying the bits of meta rarity to the aforementioned feature model and underlying distributions. Experimental evaluation is conducted a public cloud-based IDS yielding encouraging performance results.