TY - GEN
T1 - Black-box Attacks to Log-based Anomaly Detection
AU - Huang, Shaohan
AU - Liu, Yi
AU - Fung, Carol
AU - Yang, Hailong
AU - Luan, Zhongzhi
N1 - Publisher Copyright:
© 2022 IFIP.
PY - 2022
Y1 - 2022
N2 - Anomaly detection is the key to Quality of Service (QoS) in many modern systems. Logs, which record the runtime information of system, are widely used for anomaly detection. The security of the log-based anomaly detection has not been well investigated. In this paper, we conduct an empirical study on black-box attacks on log-based anomaly detection. We investigate eight different methods on log attacking and compare their performance on various log parsing methods and log anomaly detection models. We propose a method to evaluate the imperceptibility of log attacking methods. In our experiments, we evaluate the performance on the attack methods on two real log datasets. The results of our experiments show that LogBug outperforms the others in almost all situations. We also compare the imperceptibility of various attack methods and find a trade-off between performance and imperceptibility, where better attack performance means worse imperceptibility. To the best of our knowledge, this is the first work to investigate and compare the attack models on log-based anomaly detection.
AB - Anomaly detection is the key to Quality of Service (QoS) in many modern systems. Logs, which record the runtime information of system, are widely used for anomaly detection. The security of the log-based anomaly detection has not been well investigated. In this paper, we conduct an empirical study on black-box attacks on log-based anomaly detection. We investigate eight different methods on log attacking and compare their performance on various log parsing methods and log anomaly detection models. We propose a method to evaluate the imperceptibility of log attacking methods. In our experiments, we evaluate the performance on the attack methods on two real log datasets. The results of our experiments show that LogBug outperforms the others in almost all situations. We also compare the imperceptibility of various attack methods and find a trade-off between performance and imperceptibility, where better attack performance means worse imperceptibility. To the best of our knowledge, this is the first work to investigate and compare the attack models on log-based anomaly detection.
UR - https://www.scopus.com/pages/publications/85143893097
U2 - 10.23919/CNSM55787.2022.9964935
DO - 10.23919/CNSM55787.2022.9964935
M3 - 会议稿件
AN - SCOPUS:85143893097
T3 - Proceedings of the 2022 18th International Conference of Network and Service Management: Intelligent Management of Disruptive Network Technologies and Services, CNSM 2022
SP - 310
EP - 316
BT - Proceedings of the 2022 18th International Conference of Network and Service Management
A2 - Charalambides, Marinos
A2 - Papadimitriou, Panagiotis
A2 - Cerroni, Walter
A2 - Kanhere, Salil
A2 - Mamatas, Lefteris
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 18th International Conference of Network and Service Management, CNSM 2022
Y2 - 31 October 2022 through 4 November 2022
ER -