用自编码器分析Okta日志，自动识别异常行为。
Anomaly Detection in OKTA Logs using Autoencoders
- 将复杂日志转化为低维特征，输入自编码器进行学习。
- 通过重建误差检测异常，降低人工规则依赖。
- 适合安全团队提升日志监控效率，减少误报。
当前，Okta日志通过基于规则的模型检测网络安全事件，但存在回溯分析能力有限、规则集固定及误报率高等问题。为此，本文采用无监督方法，利用自编码器对日志数据进行建模。首先对用户输入的日志数据进行转换与降维处理，以简化其复杂性；随后将处理后的数据输入自编码器进行训练，并通过重建误差评估异常。该方法不依赖预设规则，可实现更灵活的异常检测，提升日志分析的自动化与准确性。
原文摘要 · Abstract (English)
Okta logs are used today to detect cybersecurity events using various rule-based models with restricted look back periods. These functions have limitations, such as a limited retrospective analysis, a predefined rule set, and susceptibility to generating false positives. To address this, we adopt unsupervised techniques, specifically employing autoencoders. To properly use an autoencoder, we need to transform and simplify the complexity of the log data we receive from our users. This transformed and filtered data is then fed into the autoencoder, and the output is evaluated.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。