TY - GEN
T1 - System-Auditing, Data Analysis and Characteristics of Cyber Attacks for Big Data Systems
AU - Huang, Liangyi
AU - Hall, Sophia
AU - Shao, Fei
AU - Nihar, Arafath
AU - Chaudhary, Vipin
AU - Wu, Yinghui
AU - French, Roger
AU - Xiao, Xusheng
N1 - Publisher Copyright:
© 2022 ACM.
PY - 2022/10/17
Y1 - 2022/10/17
N2 - Using big data, distributed computing systems such as Apache Hadoop requires processing massive amount of data to support business and research applications. Thus, it is critical to ensure the cyber security of such systems. To better defend from advanced cyber attacks that pose threats to even well-protected enterprises, system-auditing based techniques have been adopted for monitoring system activities and assisting attack investigation. In this demo, we are building a system that collects system auditing logs from a big data system and performs data analysis to understand how system auditing can be used more effectively to assist attack investigation on big systems. We also built a demo application that detects unexpected file deletion and presents root causes for the deletion.
AB - Using big data, distributed computing systems such as Apache Hadoop requires processing massive amount of data to support business and research applications. Thus, it is critical to ensure the cyber security of such systems. To better defend from advanced cyber attacks that pose threats to even well-protected enterprises, system-auditing based techniques have been adopted for monitoring system activities and assisting attack investigation. In this demo, we are building a system that collects system auditing logs from a big data system and performs data analysis to understand how system auditing can be used more effectively to assist attack investigation on big systems. We also built a demo application that detects unexpected file deletion and presents root causes for the deletion.
KW - big data systems
KW - cyber attack investigation
KW - system auditing
UR - http://www.scopus.com/inward/record.url?scp=85140844243&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85140844243&partnerID=8YFLogxK
U2 - 10.1145/3511808.3557185
DO - 10.1145/3511808.3557185
M3 - Conference contribution
AN - SCOPUS:85140844243
T3 - International Conference on Information and Knowledge Management, Proceedings
SP - 4872
EP - 4876
BT - CIKM 2022 - Proceedings of the 31st ACM International Conference on Information and Knowledge Management
PB - Association for Computing Machinery
T2 - 31st ACM International Conference on Information and Knowledge Management, CIKM 2022
Y2 - 17 October 2022 through 21 October 2022
ER -