Anomaly Detection using Knowledge Graphs: A Survey for Network Management and Cybersecurity Application
Résumé
Incident management on telecom and computer networks, whether it is related to infrastructure or cybersecurity issues, requires the ability to simultaneously and quickly correlate and interpret a large number of heterogeneous technical information sources. Drawing on the understanding that knowledge representation and reasoning are inherently linked, this survey scrutinizes both aspects in tandem by delving into explicit knowledge representations of networks, and exploring their direct utilization or integration with artificial intelligence techniques for anomaly model learning and detection. More formally, we map these two aspects in order to address the question of how to define an anomaly model in a dynamic technical environment with various interdependencies, and what form this model should take to be shareable among practitioners (network designers and administrators, cybersecurity analysts, etc.) and directly usable in anomaly detection tools and decision support systems. Through our work, we demonstrate that while data heterogeneity and interrelatedness between data entities (distinct and persistent units of information) appear to be cornerstones for advancing the capabilities of Network Monitoring System (NMS) and Security Information and Event Management (SIEM) systems, several semantic models and algorithmic methods for anomaly detection share common properties that could help constructing a rich representation of networks and their ecosystem that can be used by one or a combination of several inference techniques.
Origine | Fichiers produits par l'(les) auteur(s) |
---|