System and method for detecting adversarial activities using a compact graph representation
Described is a system for detecting adversarial activities. During operation, the system generates a multi-layer temporal graph tensor (MTGT) representation based on an input tag stream of activities. The MTGT representation is decomposed to identify normal activities and abnormal activities, with the abnormal activities being designated as adversarial activities. A device can then be controlled based on the designation of the adversarial activities.
1. A system for detecting adversarial activities, the system comprising:
one or more processors and a memory, the memory being a non-transitory computer-readable medium having executable instructions encoded thereon, such that upon execution of the instructions, the one or more processors perform operations of:
generating a multi-layer temporal graph tensor (MTGT) representation based on an input tag stream of activities, wherein the MTGT representation is generated by using an adaptive staggered temporal window module that uses a set of staggered windows with tag streams that are shifted in time and processed in parallel, such that each window processes a subset of tags from the tag stream and produces a graph tensor from the subset of tags within that window
decomposing the MTGT representation using sparse and low rank tensor (SLR-T) decomposition to identify a low-rank MTGT component and a sparse MTGT component, the low-rank MTGT component being normal activities and the sparse MTGT component being abnormal activities, such that the abnormal activities are designated as adversarial activities: and
controlling a device based on the designation of the adversarial activities.
2. The system as set forth in claim 1 , wherein the input tag stream is partially ordered using a series of vector clocks.
3. The system as set forth in claim 2 , wherein the input tag stream of activities includes a plurality of provenance chains, the provenance chains being partially ordered by the series of vector docks such that a vector clock timestamp is assigned to each activity within the provenance chains.
4. The system as set forth in claim 3 , wherein the vector clock timestamp assigned to each activity contains a logical dock for each of the provenance chains currently being tracked, the logical clock incrementing for each activity within a chain and updating when there is an interaction between chains.
5. The system as set forth in claim 1 , wherein the input tag stream of activities includes a plurality of provenance chains, the provenance chains being partially ordered by a series of vector clocks such that a vector clock timestamp is assigned to each activity within the provenance chains.
6. The system as set forth in claim 5 , wherein the vector clock timestamp assigned to each activity contains a logical clock for each of the provenance chains currently being tracked, the logical clock incrementing for each activity within a chain and updating when there is an interaction between chains.
7. A computer program product for detecting adversarial activities, the computer program product comprising:
a non-transitory computer-readable medium having executable instructions encoded thereon, such that upon execution of the instructions by one or more processors, the one or more processors perform operations of:
generating a multi-layer temporal graph tensor (MTGT) representation based on an input tag stream of activities, wherein the MTGT representation is generated by using an adaptive staggered temporal window module that uses a set of staggered windows with tag streams that are shifted in time and processed in parallel, such, that each window processes a subset of tags from the tag stream and produces a graph tensor from the subset of tags within that window;
decomposing the MTGT representation using sparse and low rank tensor (SLR-T) decomposition to identify a low-rank MTGT component and a sparse MTGT component, the low-rank MTGT component being normal activities and the sparse MTGT component being abnormal activities, such that the abnormal activities are designated as adversarial activities; and
controlling a device based on the designation of the adversarial activities.
8. The computer program product as set forth in claim 7 , wherein the input tag stream is partially ordered us ng a series of vector clocks.
9. The computer program product as set forth in claim 8 , wherein the input tag stream of activities includes a plurality of provenance chains, the provenance chains being partially ordered by the series of vector clocks such that a vector clock timestanip is assigned to each activity within the provenance chains.
10. The computer program product as set forth in claim 9 , wherein the vector clock timestamp assigned to each activity contains a logical clock for each of the provenance chains currently being tracked, the logical clock incrementing for each activity within a chain and updating when there is an interaction between chains.
11. The computer program product as set forth in claim 7 , wherein the input tag stream of activities includes a plurality of provenance chains, the provenance chains being partially ordered by a series of vector clocks such that a vector clock timestamp is assigned to each activity within the provenance chains.
12. The computer program product as set forth in claim 11 , wherein the vector clock timestamp assigned to each activity contains a logical clock for each of the provenance chains currently being tracked, the logical clock incrementing, for each activity within a chain and updating when there is an interaction between chains.
13. A method for detecting adversarial activities, the method comprising an act of:
causing one or more processers to execute instructions encoded on a non-transitory computer-readable medium, such that upon execution, the one or more processors perform operations of:
generating a multi-layer temporal graph tensor (MTGT) representation based on an input tag stream of activities, wherein the MTGT representation is generated by using an adaptive staggered temporal window module that uses a set of staggered windows with tag streams that are shifted in time and processed in parallel, such that each window processes a subset of tags from the tag stream and produces a graph tensor from the subset of tags within that window;
decomposing the MTGT representation using sparse and low rank tensor (SLR-T) decomposition to identify a low-rank MTGT component and a sparse MTGT component, the low-rank MTGT component being normal activities and the sparse MTGT component being abnormal activities, such that the abnormal activities are designated as adversarial activities; and
controlling a device based on the designation of the adversarial activities.
14. The method as set forth in claim 13 , wherein the input tag stream is partially ordered using a series of vector clocks.
15. The method as set forth in claim 13 , wherein the input tag stream of activities includes a plurality of provenance chains, the provenance chains being partially ordered by a series of vector clocks such that a vector clock timestamp is assigned to each activity within the provenance chains.
16. The method as set forth in claim 15 , wherein the vector clock timestamp assigned to each activity contains a logical clock for each of the provenance chains currently being tracked, the logical clock incrementing for each activity within a chain and updating when there is an interaction between chains.