@inproceedings{489b047e14984eb9bd4e1b72557d3736,
title = "Anomalous File System Activity Detection Through Temporal Association Rule Mining",
abstract = "NTFS USN Journal tracks all the changes in the files, directories, and streams of a volume for various reasons including backup. Although this data source has been considered a significant artifact for digital forensic investigations, the utilization of this source for automatic malicious behavior detection is less explored. This paper applies temporal association rule mining to data obtained from the NTFS USN Journal for malicious behavior detection. The proposed method extracts association rules from two data sources, the first one with normal behavior and the second one with a malicious one. The obtained rules, which have embedded the sequence of information, are compared with respect to their support and confidence values to identify the ones indicating malicious behavior. The method is applied to a ransomware case to demonstrate its feasibility in finding relevant rules based on USN journal activities.",
keywords = "Anomaly Detection, Association Rule Mining, Forensics, NTFS, Pattern Recognition, USN Journal",
author = "Iman, {M. Reza H.} and Pavel Chikul and Gert Jervan and Hayretdin Bahsi and Tara Ghasempouri",
note = "Publisher Copyright: {\textcopyright} 2023 by SCITEPRESS – Science and Technology Publications, Lda.; 9th International Conference on Information Systems Security and Privacy, ICISSP 2023 ; Conference date: 22-02-2023 Through 24-02-2023",
year = "2023",
doi = "10.5220/0011805100003405",
language = "English (US)",
isbn = "9789897586248",
series = "International Conference on Information Systems Security and Privacy",
publisher = "Science and Technology Publications, Lda",
pages = "733--740",
editor = "Paolo Mori and Gabriele Lenzini and Steven Furnell",
booktitle = "ICISSP 2023 - Proceedings of the 9th International Conference on Information Systems Security and Privacy",
address = "Portugal",
}