Overview
Developing deep-learning anomaly-detection systems to triage malicious user behavior and PE files. The work is currently in training and validation, using normal-data-centered approaches because representative operational attack data is limited.
Approach
- CERT user-behavior data: measure behavioral anomaly with an LSTM likelihood-based score (NLL)
- BODMAS PE-file data: combine VAE reconstruction error with uncertainty quantification
- Evaluation setup: train and validate on benign-only data, then inspect AUC and candidate operating points on a benign-plus-malicious test set
Operational Framing
The model is intended for first-stage quarantine rather than final adjudication. False positives can sharply increase human review load, so threshold selection considers the trade-off between FPR and operating cost. The threshold can then be calibrated to a downstream precision model and each organization's risk tolerance.
Tech Stack
- Models: LSTM, VAE
- Methods: Likelihood, Reconstruction Error, Uncertainty Quantification, ROC-AUC
- Data: CERT insider-threat behavior data, BODMAS PE-file data