NetVigil: Robust and Low-Cost Anomaly Detection for East-West Data Center Security
Talkat 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) · 2024-04-16..04-18·
summary
NetVigil uses flow-level logs aggregated into IP-granularity communication graphs (300 vertices vs ~139k flow-vertex graphs) and a GNN autoencoder trained with contrastive and temporal losses to flag anomalous east–west connections. Evaluation on a 16-VM dataset with 13 attack types and a 400-VM production trace shows average AUC gains of ~0.22, false positives down by 1.8–2.9×, faster detection latency, and 2–16× cost reduction in storage/compute versus packet-processing baselines.
AI-written summary · about
chapters (13)
- 0:00NetVigil introduction
- 1:40East-West traffic security challenges
- 3:26Flow-level logs for intrusion detection
- 4:51NetVigil design goals
- 6:16NetVigil approach overview
- 7:39Feature extraction and graph granularity
- 8:40GNN robust to network dynamism
- 10:45Temporal dynamics and data augmentation
- 12:31Evaluation dataset and attacks
- 13:33Performance metrics and baselines
- 14:57Detection latency improvements
- 15:39Operational cost reductions
- 16:43Conclusion and future work
related talks
17mPrivateEye: Scalable and Privacy Preserving Compromise Detection in the Cloud
48mHunting Stealth Adversaries with Graphs & AI
26mOptimized Invariant Representation of Network Traffic for Detecting Unseen...
40mHow to Map Networked Devices Using Graph-Based AI to Preempt Cyber Threats
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
28mPatterns for scalable security detections on AWS
45mConnecting the dots to go from tabular security incident data to behavioral graph understanding
51mAdvanced approaches to traffic inspection & network diagnosis w/