Auto-Labeling of Anomalies on Access Logs and Pairwise Comparison-based Validation
Jihoon Moon, Hyuk-Yoon Kwon · 2023
It is difficult to detect anomalous accesses only from the access log, lacking annotation and supervised learning-based models. In this paper, we propose auto-labeling methods for unlabeled access logs and present a validation method based on a pairwise comparison between them. We define two baseline methods for pairwise comparison: 1) office hour-based and 2) pattern-based methods. Then, we propose two methods based on unsupervised or semi-supervised learning: 1) iForest-based and 2) k -nearest neighbor(NN) based methods. Finally, we show that the k -NN-based method is effective in most cases.