安全与密码学2018acmccs.github.io编辑精选
DeepLog：从系统日志进行异常检测与诊断
DeepLog: Anomaly Detection and Diagnosis from System Logs (2017)
进阶 · 约 60 分钟读完前置知识：LSTM 基础、系统日志结构、异常检测基础
导读
DeepLog 是一篇 2017 年的论文，提出用 LSTM 对系统日志建模，进行异常检测与诊断：将日志条目视为序列，学习正常执行模式，从而发现偏离该模式的异常行为。评论者指出其离线训练精度较低（约 16%），实际效果主要依赖在线学习阶段（精度 82% 以上）。
HN 关注点：HN 读者长期关注日志异常检测能否真正落地，讨论焦点集中在误报率、标注成本以及论文实验设置与真实场景的差距。
后来怎么样
DeepLog 成为基于深度学习的日志异常检测的代表性工作，后续大量日志异常检测研究以它为基线或改进对象。
HN 评论精选
这几条评论里：质疑 2 补充 2
质疑质疑异常检测实用性：精度低、标注成本不明、数据分布与真实场景不符
我对异常检测持怀疑态度：实际中异常既常见又多样，而且大多无关紧要，这类系统最终只会用误报淹没用户。论文离线训练精度只有 16%，真正起作用的是在线训练部分（82%+ 精度）。但他们没说要标注多少条告警才能达到这个水平——是 10 条还是 1 万条？另外数据分布也不真实：数据集中 7% 被标注为真异常，现实中没人希望 5% 的日志被标记为异常，所以在更真实的分布上精度会差得多。
Eridrus查看英文原文
I am skeptical of anomaly detection since in my experience anomalies are common and diverse and don't actually matter, so I expect these systems to basically inundate people with false positives. Their offline training accuracy is garbage: 16% precision, so all of the real work is basically being done in the online training portion, which gets it to a respectable 82%+ precision. But they don't tell you how many alerts they had to label to get those numbers. Maybe over the long run you get those numbers, but you really want to know if it takes 10 or 10,000 examples to get there. Also, their dataset distribution is very different to reality: they have 7% of their dataset annotated as real anomalies; I don't think anyone in the real world wants 5% of their log entries to get flagged as anomalies. So I expect their precision numbers to be far worse on more realistically distributed logs.
补充从业者补充：异常分数与威胁严重性不相关，实际需人工标注加监督模型重排序
我和其他人长期在网络安全领域做 ML 异常检测。DeepLog 的想法很有意思，尤其是用 LSTM 对日志编码，该工作曾在 NIPS 2017 的 workshop 上报告。我们多年实证测得的一个有趣事实是：基于重构误差的统计异常分数与异常在安全/威胁上的严重程度并不相关。这意味着实践中 SOC 运营人员需要在异常检测之上再做标注，一段时间后可以用监督模型对结果重排序。
pilooch查看英文原文
I do, with others, a lot of ML anomaly detection in the cyber security context. Deeply has interesting ideas, especially the encoded logs via lstm. The work was presented at a workshop at NIPS 2017. One of the interesting facts we ve been able to measure empirically over the past few years is that the statistical anomalies' scores magnitude as reconstruction error are uncorrelated with the criticality of the anomaly in terms of security / threat. This means that in practice SOC operators need to label on top of the anomaly detection and a supervised model can do the reranking after a while.
质疑指出论文回避了非结构化日志（如访问日志）的特征表示难题
论文很有意思，但回避了通用日志机器学习的一个难题：它依赖从源码 print 语句提取的“日志键”（消息类型）来表示每条日志。如果你想把它用于变化很大的日志数据（比如网站访问日志），仍然面临如何把 URI 转成数值向量而不丢失关键信息的困难问题。
thaumaturgy查看英文原文
This is an interesting paper, but it sort of sidesteps one of the harder problems in generalized machine learning for log analysis: > As shown by several prior work [9, 22, 39, 42, 45], an effective methodology is to extract a “log key” (also known as “message type”) from each log entry. The log key of a log entry e refers to the string constant k from the print statement in the source code which printed e during the execution of that code. So if you're looking for a way to apply this to log data that varies wildly, like site access logs, you still have the difficult problem of converting the URIs to the numeric vectors needed by ML algorithms without losing the significant parts of the input.
补充补充资料：推荐另一种可插拔算法、支持自定义特征的 IoT 事件异常检测方法
这里另有一种针对事件数据的通用异常检测方法，曾用于分析自动割草机的日志：https://www.researchgate.net/publication/323971244_Detecting_Anomalies_in_Device_Event_Data_in_the_IoT 。它支持 one-class SVM、MDS 等不同算法（包括自定义算法），也允许在分析引擎中定义领域特定的特征，例如为日志分析生成各类事件类型的频率。
asavinov查看英文原文
Here is another generic approach to anomaly detection from event data which has been used for analyzing logs received from automatic lawn mowers: https://www.researchgate.net/publication/323971244_Detecting_Anomalies_in_Device_Event_Data_in_the_IoT It allows for using different algorithms like one class SVM or MDS (including custom algorithms). It also allows for defining custom domain specific features as integral part of its analysis engine. In particular, for log analysis, frequencies of various event types have been generated.
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
历次讨论
- 2018Hacker News 讨论帖164 分 · 30 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选