[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-124163-en":3,"doc-seo-124163-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},124163,13056703019404,"Miles","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","Exploring the Role of Unsupervised Machine Learning for Anomaly Detection in Active Directory Logins - thesis defence","Active Directory (AD) stores network objects and credentials metadata that administrators rely on, but its broad deployment makes it an attractive target for identity-focused attacks. Such attacks aim to gain the highest privileges in minimal time, often through privilege escalation after intrusion. To improve anomaly detection, machine learning mechanisms are applied to AD access data to reduce false positives and increase detection coverage. A dataset combining generated scenarios and corresponding experimental logs is built, then unsupervised learning identifies abnormal events indicative of AD attacks.","ESTG  \nEXPLOR ING THE ROLE OF UNSUPERVISED MACHINE LEARNING FOR ANOMALY DETECT ION IN ACTIVE DIRECTORY LOGINS  \nBruno Sousa  \n2024  \nEXPLORING THE ROLE OF UNSUPERVISED MACHINE LEARNING FOR ANOMALY  \nDETECTION IN ACTIVE DIRECTORY LOGINS  \nBruno Miguel de Sousa  \nEscola Superior de Tecnologia e Gestão  \nC  \n􀀃􀀈􀀏􀀐􀀎􀀄􀀇􀀍 􀀈􀀋􀀂􀀊􀀅􀀈􀀎􀀏􀀈􀀉􀀑􀀎􀀄􀀌􀀓􀀄􀀃􀀄􀀏􀀐􀀈􀀎 􀀊􀀌􀀂􀀒􀀅􀀈􀀎􀀏􀀈􀀆􀀑􀀎􀀊􀀐􀀒  \nExploring the Role of Unsupervised Machine Learning for Anomaly Detection in Active Directory Logins  \na project authored by  \nBruno Miguel de Sousa  \nthesis defence  \n03/12/2024  \nsupervised by  \nProf. Jo˜ao Paulo Magalh˜aes and Prof. Silvestre Malta  \n11 December, 2024  \nAbstract  \nActive Directory (AD) stores information about objects on the network and makes this information easy for administrators and users to find and use. Due to its widespread use in recent times, it has become a target for various types of attacks. The objective of AD attacks, or attacks on any identity administration infrastructure, is pretty simple: to gain the highest access in the shortest time possible. Regardless of the source of the attack orthe point of intrusion, attackers are always looking to escalate privileges.  \nTo increase the anomaly detection in AD, it is intended to apply Machine Learning (ML) mechanisms on the same, reducing false positives and detecting more attacks. Todo so, a dataset has been created that contains relevant information on AD access. This dataset has been created and combined with logs generated in an experimental setup environment according to the differentiated cases generated. Then, Unsupervised Machine Learning (UML) was used to identify abnormal events that could signify AD attacks.  \nKeywords: Active Directory, Anomaly Detection, Machine Learning.  \nContents  \nAcronyms 5  \n1 Introduction 10  \n1.1 Context ...................................... 10  \n1.2 Motivation .................................... 10  \n1.3 Objectives ..................................... 11  \n1.4 Organization of the dissertation ......................... 11  \n2 State of the art 13  \n2.1 Machine Learning ................................. 13  \n2.1.1 Data Classification ............................ 13  \n2.1.2 Unsupervised Machine Learning .................... 14  \n2.1.3 Anomaly Detection ............................ 15  \n2.1.4 Anomaly Detection Algorithms ..................... 18  \n2.1.5 Literature Review ............................ 24  \n2.2 Typical Active Directory attacks ........................ 25  \n2.2.1 Kerberoasting ............................... 26  \n2.2.2 Mimikatz ................................. 26  \n2.3 Frameworks, ISO and regulations ........................ 26  \n2.3.1 NIST ................................... 27  \n2.3.2 ISO 27001 ................................. 29  \n3 Proposal and Methodology 31  \n3.1 Forms of data collection in Active Directory .................. 31  \n3.1.1 Event Viewer ............................... 32  \n3.1.2 Splunk ................................... 33  \n3.1.3 ArcSight .................................. 35  \n3.2 Preparing data for Machine Learning ...................... 36  \n3.2.1 Data collection .............................. 37  \n3.2.2 Data cleaning ............................... 37  \n3.2.3 Data transformation ........................... 38  \n3.2.4 Data splitting ............................... 39  \n4 Dataset 40  \n4.1 Preparatory study ................................ 40  \n4.1.1 Kali Linux ................................ 40  \n4.1.2 Parrot security .............................. 42  \n4.1.3 IPv6 Attack from Kali Linux ...................... 43  \n4.1.4 RDC Login Attempts: Brute Force ................... 45  \n4.2 Dataset structure ................................. 48  \n4.2.1 Dataset requirement ........................... 48  \n4.2.2 Dataset generator ............................ 49  \n4.3 Injection of anomalies .............................. 52  \n5 Experimentation 56  \n5.1 Test environment ................................. 56  \n5.2 Test description ........","cbCaifc6N7sVP94q","https://ap.wps.com/l/cbCaifc6N7sVP94q","pdf",3536763,1,87,"English","en",105,"# Abstract\n# Contents\n## 1 Introduction\n## 2 State of the art\n## 3 Proposal and Methodology\n## 4 Dataset\n## 5 Experimentation\n## 6 Conclusion\n## References\n## Acronyms","[{\"question\":\"What is the goal of applying unsupervised machine learning to Active Directory logins?\",\"answer\":\"The goal is to identify abnormal events in AD access logs that could indicate attacks, while reducing false positives and improving anomaly detection effectiveness.\"},{\"question\":\"How was the dataset for this work built?\",\"answer\":\"A dataset containing relevant AD access information was created and combined with experimental logs generated in a setup environment based on differentiated attack cases and scenarios.\"},{\"question\":\"Which unsupervised anomaly detection methods are evaluated in the experimentation section?\",\"answer\":\"The experimentation includes K-Nearest Neighbors, One-Class SVM, and Isolation Forest, followed by scenario-based testing and discussion of the results.\"}]","Exploring the Role of Unsupervised Machine Learning for Anomaly Detection in Active Directory Logins - thesis defence | PDF",1785820808,219,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"exploring-the-role-of-unsupervised-machine-learning-for-anomaly-detection-in-active-directory-logins-thesis-defence","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/exploring-the-role-of-unsupervised-machine-learning-for-anomaly-detection-in-active-directory-logins-thesis-defence/124163/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What is the goal of applying unsupervised machine learning to Active Directory logins?","Question",{"text":75,"@type":76},"The goal is to identify abnormal events in AD access logs that could indicate attacks, while reducing false positives and improving anomaly detection effectiveness.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How was the dataset for this work built?",{"text":80,"@type":76},"A dataset containing relevant AD access information was created and combined with experimental logs generated in a setup environment based on differentiated attack cases and scenarios.",{"name":82,"@type":73,"acceptedAnswer":83},"Which unsupervised anomaly detection methods are evaluated in the experimentation section?",{"text":84,"@type":76},"The experimentation includes K-Nearest Neighbors, One-Class SVM, and Isolation Forest, followed by scenario-based testing and discussion of the results.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]