Software leaves many traces of network packets, system calls, and warning or error statements, called logs. Software analysts study these logs to find programming errors and other issues. Machine learning techniques can be used to automate this analysis. When applied to software logs, they learn models of the software’s known frequent behaviour and discard the infrequent data containing important errors...
A software’s behavior can be modeled from the sequential data it generates. Sequence mining is powerful because the order of events can reveal information about the nature of events. Network traffic is a type of sequential data, where pattern mining is a challenging problem as it operates in an unsupervised setting without a clear distinction between noise and genuine malicious...
We devise new principles, patterns, theories, and techniques that help the developer to unleash the full potential of log-files. To that end we focus on organizing log-files, providing logging guidelines, inventing new log line learning techniques, offering log-line information through abstract models, and evaluating our approach at industry scale. Besides the common happy path of successful execution scenarios, we will...
Companies in maintenance logistics aspire to make better use of the increasing availability of real-time data from the many (inter)connected devices within the internet of things (IoT). Many such companies have in recent years taken a first key step in this direction by investing substantially in a data management infrastructure that ensures central and real-time availability of the raw data...
Security & privacy assurance, verification and process certification techniques designed for large, controlled updates over months or years, must now cope with small, continuous changes in weeks, happening in sub-components and decided by third party developers one did not even know they existed. AssureMOSS proposes to switch from process-based to an artefact-based security evaluation by supporting all phases of the...
Vast amounts of data are being collected and logged in computer networks. These data are often monitored for intrusion detection, e.g. by matching known malicious IP-addresses or by searching for specific packet payloads. Suspicious traffic is then investigated manually by security analysts to find new intrusions or malicious activity. However, a security analyst can only investigate a limited amount of...
A significant shortcoming of the currently applied machine learning methods that detect cyber attacks in cyber physical systems (CPS) is that they provide little insight into the system and no explanation of detection results. We aim to develop and apply novel machine learning methods that do provide such insight, which is valuable to guide human’s countermeasures. For instance, it helps...