Project, 2024.08–now, in progress

UEBA Research: Cloud Behavior Anomaly Detection from AWS CloudTrail (NHI Behavior Analysis)

Traditional UEBA (user and entity behavior analytics) assumes clear identities, sessions, and a small action space, and those assumptions break in the cloud: AssumeRole chains hide the real actor, AWS exposes thousands of API actions, and there are no login/logout boundaries. Working from AWS CloudTrail logs, the research started with entropy-based risk scoring and a multi-modal profile built from HMM, KDE, and TF-IDF/SVD, then moved to an Identity Chain Graph that traces the original actor, learned session segmentation, and now an ARN Knowledge Graph with CompGCN embeddings that produces interpretable Intent/Temporal/Resource anomaly scores. Joonho Seo carries out the research and has presented it in personal research talks and weekly lab reports. The work is ongoing; the current step is validating the ARN Knowledge Graph approach on the lab's own CloudTrail data.

Where

S3Lab, Pusan National University

My role

Research and presentations

Status

ongoing