# Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

arXiv: https://arxiv.org/abs/1411.5005 · HTML: https://mlsanity.com/paper/1411.5005/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Nov 2014.

## Built on by (most cited first, 13 of 13)

- [LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Model](https://mlsanity.com/paper/2111.09564/) (2021)
- [EXTRACTOR: Extracting Attack Behavior from Threat Reports](https://mlsanity.com/paper/2104.08618/) (2021)
- [An Assessment of ChatGPT on Log Data](https://mlsanity.com/paper/2309.07938/) (2023)
- [Log Anomaly Detection with Large Language Models via Knowledge-Enriched Fusion](https://mlsanity.com/paper/2512.11997/) (2025)
- [A Comprehensive Survey of Logging in Software: From Logging Statements Automation to Log Mining and Analysis](https://mlsanity.com/paper/2110.12489/) (2021)
- [Mapping the Internet: Modelling Entity Interactions in Complex Heterogeneous Networks](https://mlsanity.com/paper/2104.09650/) (2021)
- [CELEST: Federated Learning for Globally Coordinated Threat Detection](https://mlsanity.com/paper/2205.11459/) (2022)
- [MINES: Explainable Anomaly Detection through Web API Invariant Inference](https://mlsanity.com/paper/2512.06906/) (2025)
- [ClusterLog: Clustering Logs for Effective Log-based Anomaly Detection](https://mlsanity.com/paper/2301.07846/) (2023)
- [Malicious Internet Entity Detection Using Local Graph Inference](https://mlsanity.com/paper/2408.03287/) (2024)
- [Web Scale Graph Mining for Cyber Threat Intelligence](https://mlsanity.com/paper/2411.06239/) (2024)
- [Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries](https://mlsanity.com/paper/2502.05367/) (2025)
- [A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers](https://mlsanity.com/paper/2512.23380/) (2025)

## Abstract (arXiv)

Recent years have seen the rise of more sophisticated attacks including advanced persistent threats (APTs) which pose severe risks to organizations and governments by targeting confidential proprietary information. Additionally, new malware strains are appearing at a higher rate than ever before. Since many of these malware are designed to evade existing security products, traditional defenses deployed by most enterprises today, e.g., anti-virus, firewalls, intrusion detection systems, often fail at detecting infections at an early stage. We address the problem of detecting early-stage infection in an enterprise setting by proposing a new framework based on belief propagation inspired from graph theory. Belief propagation can be used either with "seeds" of compromised hosts or malicious domains (provided by the enterprise security operation center -- SOC) or without any seeds. In the latter case we develop a detector of C&C communication particularly tailored to enterprises which can detect a stealthy compromise of only a single host communicating with the C&C server. We demonstrate that our techniques perform well on detecting enterprise infections. We achieve high accuracy with low false detection and false negative rates on two months of anonymized DNS logs released by Los Alamos National Lab (LANL), which include APT infection attacks simulated by LANL domain experts. We also apply our algorithms to 38TB of real-world web proxy logs collected at the border of a large enterprise. Through careful manual investigation in collaboration with the enterprise SOC, we show that our techniques identified hundreds of malicious domains overlooked by state-of-the-art security products.