Modeling User Network Behavior Based on Network Packet Sketches for Masquerade Detection Nowadays, masquerade attack caused by identity misuse is a kind of severe insider threat and a common security problem for most organizations. Although the anomaly detection based on machine learning has been applied as a common method for this problem, most existing approaches for detecting masquerade attack usually use hostbased data to profile user behavior and detect anomaly. However, hostbased data are too sensitive to collect, which results in poor universality and makes it difficult for enterprises to deploy. In this paper, we propose a cheap and general masquerade detection method with high accuracy to profile user network behavior and detect anomaly, using network packet sketches (IP, port, protocol, etc As network packet headers with standardized format are nonsensitive, our method is suitable for most enterprises and much cheaper to deploy. To validate the method, we collected more than 10 TB normal user data and 5 GB simulated masquerader data in real enterprise environment. The experimental results show that our method achieves good performance with average AUC up to 0.988 and the approach of modeling user network behavior by network packet sketches results in good time efficiency.

RLSketch: Scaling Reinforcement Learning for Adaptive and Automate Anomaly Detection in Network Data Streams When network is undergoing problems, such as DDoS attack, component failures, etc., the detection of heavy flows (e.g. heavy hitters and heavy changers) is much more critical. However, it has been increasing challenging to ensure the accurate detection of heavy flows while dealing with massive network traffic volume, diversified traffic distribution and the stringent memory requirement. Although recent research efforts like LDSketch are scalable for diverse network traffic, they depend on excessive memory to maintain high accuracy, such that they fail to work well when the memory is limited. We propose RLSketch, a adaptive sketch using reinforcement learning in detecting heavy flows. It predicts potential heavy flows based on the statistics of network traffic, to achieve both high accuracy and scalability with minor memory. Tracedriven evaluation shows that RLSketch achieves higher accuracy than stateoftheart sketchbased technologies with up to 17.79xc3x97 accuracy gain, while maintaining high robustness in extreme conditions.