Events
PhD DefenseArtificial Intelligence powered Large-Scale Investigation for Advanced Attacks |
|
||
Monday, March 31, 2025, 12:30pm - 01:30pm |
|||
Speaker: Hailun Ding
Bio
Location : CoRE 301
Committee:
Assistant Professor Dong Deng
Shiqing Ma
Assistant Professor Sudarsun Kannan
Assistant Professor Zhou Li (external)
Event Type: PhD Defense
Abstract: Modern cyberattack investigations face significant challenges due to the exponential growth in both the scale and sophistication of attacks. Logs serve as the primary source for attack investigations, but as attacks become increasingly complex and prolonged, traditional log-based investigation struggles with high storage costs, slow query performance, resource-intensive and low precision analysis. This dissertation examines how artificial intelligence (AI) can improve attack investigation systems for large-scale advanced threat analysis by optimizing log storage, management, and analysis within existing investigation pipelines. First, we introduce an AI-driven log compression method that significantly reduces storage demands while preserving full data accessibility. Second, we propose a neural network-based approach for efficiently representing and querying provenance graphs derived from logs, enabling faster and more scalable analysis of system activity causality. Finally, we develop an unsupervised learning framework that automates attack investigation, eliminating the need for manual data labeling and costly graph preprocessing. This framework not only reduces analysis costs but also enhances investigative accuracy by detecting attack patterns across complex, long-term incidents spanning multiple systems. By significantly reducing storage costs and computational overhead while also improving the effectiveness, our research offers security teams better solutions for advanced threat investigation.
Organization:
Contact Assistant Professor Dong Deng
Zoom: https://rutgers.zoom.us/j/92676668735?pwd=xbrSB0swPubdRVSy6M5lbgWmFbMxE5.1