Filippo Furfaro

Combining Model- and Example-Driven Classification to Detect Security Breaches in Activity-Unaware Logs

Current approaches to the security-oriented classification of process log traces can be split into two categories: (i) example-driven methods, that induce a classifier from annotated example traces; (ii) model-driven methods, based on checking the conformance of each test trace to security-breach models defined by experts. These categories are orthogonal and use separate information sources (i.e. annotated traces and a-priori breach models). However, as these sources often coexist in real applications, both kinds of methods could be exploited synergistically. Unfortunately, when the log traces consist of (low-level) events with no reference to the activities of the breach models, combining (i) and (ii) is not straightforward. In this setting, to complement the partial views of insecure process-execution patterns that an example-driven and a model-driven methods capture separately, we devise an abstract classification framework where the predictions provided by these methods separately are combined, according to a meta-classification scheme, into an overall one that benefits from all the background information available. The reasonability of this solution is backed by experiments performed on a case study, showing that the accuracy of the example-driven (resp., model-driven) classifier decreases appreciably when the given example data (resp., breach models) do not describe exhaustively insecure process behaviors.

Possible Extensions and Open Problems

We here discuss limits and possible extensions of the framework presented in the previous chapters for extracting reliable information from numerical data which are inconsistent w.r.t. a given set of aggregate constraints. Specifically, we discuss possible refinements of different aspects, involving the form of constraints, the class of queries, and the minimality semantics.

Computing Card-minimal Repairs

In this chapter, we present a technique for computing card-minimal repairs in the presence of steady aggregate constraints. Thus, differently from the (decision) problems introduced in Chapter 3, we here address a search problem, which is relevant in practice as, in several applications, the availability of a consistent version of the data is mandatory for accomplishing a number of analysis tasks.We also show how this technique can be extended to deal with weak aggregate constraints, i.e., constraints defining conditions that are expected (but not due) to be satisfied, which usually encode common belief or gossip about the world represented by the data. Specifically, the search of the repair is refined by trying to satisfy all the given (strong) aggregate constraints and to maximize the number of weak constraints satisfied. This way, the search is driven towards preferred repairs, i.e., repairs which can be assumed to be “more reasonable”, compared with repairs satisfying the (strong) aggregate constraints only.

Repairing and Querying: the Fundamental Decision Problems

In this chapter, we introduce some fundamental decision problems related to repairing and querying inconsistent data. Specifically, we formalize the repair existence problem, the minimal repair checking problem, and the consistent query answer problem, and analyze their computational complexity in the presence of databases inconsistent w.r.t. a given set of aggregate constraints. In this regard, we provide a thorough characterization, as we investigate the sensitivity of the computational complexity of these problems to several aspects: the domain of numerical attributes (integers or rationals), the form of the aggregate constraints considered (steady or not), and the minimality semantics (card- or set-minimal).

Consistent Answers to Aggregate Queries

In this chapter, we focus our attention on the evaluation of queries of a form different from that considered in the previous chapters. Specifically, we address the problem of evaluating aggregate queries over data inconsistent w.r.t. aggregate constraints, and introduce a technique for providing range-consistent answers of these queries. The range-consistent answer of an aggregate query is the narrowest interval containing all the answers of the query evaluated on every possible repaired database. Three types of aggregate queries are investigated, namely SUM, MIN, and MAX queries. Similarly to the approach described in the previous chapter for computing card-minimal repairs, the technique presented here is based on a translation to the Mixed Integer Linear Programming (MILP) problem, thus enabling wellestablished techniques for MILP resolution to be exploited for computing rangeconsistent answers.