Graph-based malicious login events investigation

A large body of research has been accomplished on detecting malicious events, attacks, threats, or botnets. Different techniques and approaches have been proposed to detect them such as machine-learning-based, or rule-based. However, there is a lack of sophisticated techniques for investigating malicious events and understanding the root cause of attacks. In this paper, we propose a knowledge discovery approach for investigating and visualizing malicious authentication events. The approach is based on data mining techniques on attacks in order to extract the behavior of malicious authentication. We also propose a novel graph-based representation method that helps highlight attack scenarios. The evaluation is performed on a publicly available large dataset, where we analyze behavior of malicious authentication events. The results are useful for security experts in order to improve the existing solutions by making them robust.