Behavior-Based Anomaly Detection in Log Data of Physical Access Control Systems

2Citations
Citations of this article
32Readers
Mendeley users who have this article in their library.

Abstract

Behavior-based anomaly detection (AD) approaches for enterprise-IT security are not easily applicable to other domains, such as embedded devices and IoT nodes in cyber-physical systems. AD approaches are usually highly optimized for specific purposes, tightly bound to domain-specific technologies and rely on a specific syntax of investigated data. Data from cyber-physical systems is however highly diverse, often poorly documented and not easily ingested for automated analysis. AECID provides an anomaly detection approach, that monitors unstructured textual event data (i.e., log data), and implements self-learning for autonomous operation. A parser generator establishes a model of normal system behavior on top of observed events, which then can be leveraged to detect anomalies as deviations from that baseline. The unsupervised anomaly detection approaches of AECID apply machine learning techniques to perform sequence analysis, correlation analysis and statistical tests of events represented in log data. This paper discusses AECID's applicability in a building security system use case. A proof of concept demonstrates the effective detection of anomalies in log data of a building access control system stemming from card misuse, including stolen access cards and cloned cards.

Cite

CITATION STYLE

APA

Skopik, F., Wurzenberger, M., Hold, G., Landauer, M., & Kuhn, W. (2023). Behavior-Based Anomaly Detection in Log Data of Physical Access Control Systems. IEEE Transactions on Dependable and Secure Computing, 20(4), 3158–3175. https://doi.org/10.1109/TDSC.2022.3197265

Register to see more suggestions

Mendeley helps you to discover research relevant for your work.

Already have an account?

Save time finding and organizing research with Mendeley

Sign up for free