PALM: A framework to identify novel attacks in an e-commerce system

The widespread adoption of e-commerce and its lucrative, decentralized, multi-agent nature have made these systems vulnerable to cyber-attacks. Traditional signature-based approaches have been successful in detecting instances of fraud, however, they continue to struggle against unknown attacks. To this end, we present PALM, a framework that bridges the data-oriented process mining community with model-based security engineering with an aim to detect novel cyber-exploit automatically from a given event-log. It relies on the insight that security attacks on digital infrastructures seek to modify the system behaviour inducing unsafe states. Consequently, we propose an approach to represent the behaviour of the system and establish a signature-based attack database that can be used to predict unseen exploits. Building on the success of process-mining community, our framework first discovers a Petri Net model automatically from an event-log using the "Inductive Miner (IM)" algorithm. Next we, explicitly map the system features onto the discovered Petri-Net. Subsequently, the Petri-Net model is trained over contextual attack signatures. This step is crucial for capturing the nuances of system dynamics and identifying potential vulnerabilities or attack surfaces that may be exploited by malicious actors. Graph Convolution Network is then employed to look for malicious feature correlations and information flows, indicating a likelihood of a link between unconnected neighbouring nodes. Using a sample event-log, we test the efficacy of our framework, achieving 83.33% accuracy and an AUC-ROC of 0.9186, signifying its potential in identifying novel attack paths.