# End-To-End Anomaly Detection for Identifying Malicious Cyber Behavior through NLP-Based Log Embeddings

arXiv: https://arxiv.org/abs/2108.12276 · HTML: https://mlsanity.com/paper/2108.12276/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 33 references that are in the map.
- First posted on arXiv 27 Aug 2021.

## Builds on (most cited first, 8 of 8)

- [Efficient Estimation of Word Representations in Vector Space](https://mlsanity.com/paper/1301.3781/) (2013)
- [DeepWalk: Online Learning of Social Representations](https://mlsanity.com/paper/1403.6652/) (2014)
- [Enhancing Robustness Against Adversarial Examples in Network Intrusion Detection Systems](https://mlsanity.com/paper/2008.03677/) (2020)
- [Analyzing the Usefulness of the DARPA OpTC Dataset in Cyber Threat Detection Research](https://mlsanity.com/paper/2103.03080/) (2021)
- [Experimental Review of Neural-based approaches for Network Intrusion Management](https://mlsanity.com/paper/2009.09011/) (2020)
- [Automated Ransomware Behavior Analysis: Pattern Extraction and Early Detection](https://mlsanity.com/paper/1910.06469/) (2019)
- [Defining a Metric Space of Host Logs and Operational Use Cases](https://mlsanity.com/paper/1811.00591/) (2018)
- [Robustness of ML-Enhanced IDS to Stealthy Adversaries](https://mlsanity.com/paper/2104.10742/) (2021)

## Built on by (most cited first, 1 of 1)

- [CmdCaliper: A Semantic-Aware Command-Line Embedding Model and Dataset for Security Research](https://mlsanity.com/paper/2411.01176/) (2024)

## Abstract (arXiv)

Rule-based IDS (intrusion detection systems) are being replaced by more robust neural IDS, which demonstrate great potential in the field of Cybersecurity. However, these ML approaches continue to rely on ad-hoc feature engineering techniques, which lack the capacity to vectorize inputs in ways that are fully relevant to the discovery of anomalous cyber activity. We propose a deep end-to-end framework with NLP-inspired components for identifying potentially malicious behaviors on enterprise computer networks. We also demonstrate the efficacy of this technique on the recently released DARPA OpTC data set.