A SEMI SUPERVISED BENCHMARK FRAMEWORK FOR ERP CYBERSECURITY ANOMALY DETECTION IN SPARSE AND LOW LABELED ENVIRONMENTS

Abstract

The increasing advanced nature of cyberattacks targeting Enterprise Resource Planning (ERP) systems creates significant dilemmas concerning enterprise security, particularly in the scenario where annotated data regarding threats are limited or unfinished. To address this drawback, this article proposes a Semi-Supervised Benchmark Framework of ERP-cybersecurity Anomaly Detection in Sparse and Low-Labeled settings, which is designed to test the efficiency of high-end learning models in the real life performance. This framework takes the heterogeneous ERP log sources, e.g. the user authentication log, the transaction log, and process execution log and converts them into a unified collection which is further enriched by simulated attack patterns e.g. data exfiltration, privilege escalation, and insider abuse. Semi-supervised methods like MixMatch, Graph Convolutional Networks (GCN) and Variational Autoencoders (VAE) were used to utilize both the labeled and the unlabeled samples thus providing strong anomaly classifications. The hybrid pseudo-labeling and clustering mechanism enhanced the representation learning mechanism, whereas self-training guaranteed adaptive performance among modular components. The empirical analysis has shown that the proposed framework achieved an accuracy of 94.6%, precision of 92.8%,  recall of 93.1%,  F1 score of 92.9 % and  AUC of 0.96%, thus outperforming traditional supervised baselines by a margin of more than 11. In addition, the benchmark had a good generalization with different proportions of label sparsity, which indicated the benchmark was reliable on semi-supervised model validation. This study provides a repeatable and scalable base of ERP-cybersecurity analytics therefore sealing the gap between limited-label settings and smart detection of anomalies. It is not only that the proposed benchmark framework helps to enhance threat detection accuracy but also leads to the internationalization of the evaluation practices in ERP oriented research (cyberspace).

Keywords ERP Cybersecurity, Semi-Supervised Learning, Anomaly Detection, Graph Convolutional Networks (GCN), Variational Autoencoder (VAE), Pseudo-Labeling,