IDEA #5IYCBL Structural Anomaly Detection using a Generative Process. 24A0015

Key Words: Structural Anomaly, Anomaly Detection, Generative Artificial Intelligence Some key unmet needs that this structural anomaly detection methodology fulfills in the field of intrusion/anomaly detection: • Detecting advanced persistent threats (APTs): Existing signature and behavior-based methods struggle to detect stealthy multi-stage attacks like APTs that evolve dynamically. Structural anomaly detection can potentially identify APT activities that deviate from intended system functionality. • Understanding system purpose: Most detection methods rely on profiling specific entities or events. This methodology models the overall functional structure and purpose of the system. This higher-level understanding is lacking in current techniques. • Generic detection: Many techniques rely heavily on domain knowledge. The proposed techniques are generic and do not require specialized system knowledge. This makes the methodology more widely applicable. • Behavioral context: Assigning roles provides context about the functionality and purpose behind entity behaviors. This enables better interpreting alerts and prioritizing responses. • Evolution of attacks: As attacks become more sophisticated and human adversaries get involved, methods focusing solely on properties of events are insufficient. Analyzing structure and purpose as this approach does is better suited to deal with the evolution of attacks. In summary, by detecting anomalies in functionality and purpose rather than just events, this methodology addresses key limitations like high false alarms, lack of behavioral context, and the inability to detect advanced and evolving attacks with current intrusion detection systems.