DyCom: A Dynamic Community Partitioning Technique for System Audit Logs

To address the ever-evolving network threats, system audit logs have become a crucial data source for threat analysis. While current log-based threat detection methods have significant potential in identifying malicious activities, they face limitations in capturing dynamic attack behaviors and revealing complete attack activities.To address these issues, we introduces DyCom, a dynamic graph partitioning technique based on audit logs. Our method incrementally partitions the system log streaming into multiple communities with security semantics, allowing the use of graph community summarization techniques to provide a summary of key activities within each community, thereby aiding security experts in understanding system activities. This method retains all attack activities, reduces analysts’ workload, and keeps them continuously informed about system activities. By focusing on process entities and constructing intimate process events, DyCom effectively reduces the storage cost of log data while ensuring the security semantics of the log communities. Additionally, DyCom employs temporal graph networks to dynamically represent system entities, ensuring real-time monitoring of system activities. Evaluations using the open-source DARPA TC dataset and our simulated datasets demonstrate that DyCom can accurately partition large-scale dynamic system entities into distinct communities, with improvements in precision, recall, and F1 score by 0.71, 0.31, and 0.65 respectively, compared to baseline methods, highlighting its practical potential in threat analysis.