Paper, 2024.11
Zero-SAD: Zero-Shot Learning Using Synthetic Abnormal Data for Abnormal Behavior Detection on Private Cloud
Most work on detecting abnormal behavior in the cloud analyzes system call sequences from public datasets, yet real cloud environments produce far more duplicate system calls, which inflates the analysis and keeps those methods from carrying over. This paper proposes Zero-SAD, a detection system for private clouds made of two parts: a deduplicated embedding that represents repeated system calls as a single embedding vector, and a zero-shot learning model that quickly analyzes the large volume of sequences generated by many users. It was evaluated on public datasets and on data collected directly from a real cloud environment by running MITRE ATT&CK attacks as a proof of concept. Joonho Seo is the second of five authors. The system reached 92.13% accuracy and detected attacks 5.48 times faster than existing research.
- Where
- ACM SoCC 2024
- My role
- Second author
- Status
- published