LogKernel: A Threat Hunting Approach Based on Behaviour Provenance Graph and Graph Kernel Clustering

<table class="algorithm-group"><tr><td><table class="algorithm" id="alg1"><tr><td> </td><td>Input: OS-level logs</td></tr><tr><td> </td><td>Output: Behavior Dependency Graphs</td></tr><tr><td>(1)</td><td>Logs ← READLOGS (OS-level logs)</td></tr><tr><td>(2)</td><td>Processes ← LONGRUNNINGPROCESS (OS-level logs)</td></tr><tr><td>(3)</td><td>for all log in Logs do</td></tr><tr><td>(4)</td><td>Type = GETNODETYPE (log)</td></tr><tr><td>(5)</td><td>NodeAttributei = GETTYPENODE (log)</td></tr><tr><td>(6)</td><td>NodeList.append (NodeAttributei)</td></tr><tr><td>(7)</td><td>end for</td></tr><tr><td>(8)</td><td>ProvenanceGraph = GENERATEGRAPH (NodeList)</td></tr><tr><td>(9)</td><td>V, LV ← GETNODE (NodeAttribute)</td></tr><tr><td>(10)</td><td>E, LE ← GETEDGE (NodeAttribute)</td></tr><tr><td>(11)</td><td>BehaviorGraphs = SPLITGRAPH (ProvenanceGraph, Processes)</td></tr><tr><td>(12)</td><td>Density ← CALCULATEDESITY (Processes)</td></tr><tr><td>(13)</td><td>Units ← PARTITION (Density)</td></tr><tr><td>(14)</td><td>return BehaviorGraphs</td></tr></table></td></tr></table>

Security and Communication Networks

alg1

Algorithm 1

Algorithm 1: LogKernel: A Threat Hunting Approach Based on Behaviour Provenance Graph and Graph Kernel Clustering 