Cyber Intrusion Detection using Natural Language Processing on Windows Event Logs

This paper applies deep learning and natural language processing to Windows Event Logs for the purpose of detecting cyber attacks. Data is collected from an emulated network that models an enterprise network. The network experiences a cyber attack that uses a spear phishing email and the eternal blue exploit to spread botnet malware. A machine learning anomaly detection algorithm is constructed using the transformer model and self-supervised training. The model is able to detect both the compromised devices as well as attack timing with near perfect precision and recall. These results suggest that this approach could function as the detection portion of an autonomous end point defense system wherein each device is able to react independently to potential intrusions.