Anomaly Detection Through Graph Autoencoder-Based Learning of Screenshot Image Logs

IT controls in information systems play an important role for companies. One common control is the management and verification of daily logs. Text-based logs (keystrokes, communication history, and application information) are often used to verify that the system is operating properly. However, some systems can only record PC screenshot image logs to prioritize stable operation. In such systems, checking the logs is time consuming, making it difficult to check the logs on a daily basis. In addition, if an auditor wants to detect anomalous operations, the auditor needs to know the correct operation of the system, which becomes very difficult when targeting a large number of systems. In this study, we aimed to convert user operations from screenshot images of PCs into graph structures and use the features of the graph structures for anomaly detection. The proposed method groups image features from screenshot images based on similarity, transforms feature transitions into graph structures, and detects anomalous operations using graph autoencoder-based learning. We demonstrate that the proposed method can detect anomalous operations with a recall rate of over 70%.