Utilizing Vector Database Management Systems in Cyber Security

This is a sel -a chi ed e sion o an o iginal a icle. This e sion may di e om he o iginal in pagina ion and ypog aphic de ails. Au ho (s): Ti le: Yea : Ve sion: Copy igh : Righ s: Righ s u l: Please ci e he o iginal e sion: CC BY-NC-ND 4.0 h ps://c ea i ecommons.o g/licenses/by-nc-nd/4.0/ U ilizing Vec o Da abase Managemen Sys ems in Cybe Secu i y © 2024 Eu opean Con e ence on Cybe Wa a e and Secu i y Published e sion Taipalus Toni; G ahn Hilkka; Tu iainen Hannu; Cos in And ei Taipalus Toni, G ahn Hilkka, Tu iainen Hannu, Cos in And ei. (2024). U ilizing Vec o Da abase Managemen Sys ems in Cybe Secu i y. In M. Leh o, & M. Ka jalainen (Eds.), P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y (23, pp. 560-565). Academic Con e ences In e na ional L d. P oceedings o he Eu opean Con e ence on Cybe Wa a e and Secu i y. h ps://doi.o g/10.34190/eccws.23.1.2220 2024 U ilizing Vec o Da abase Managemen Sys ems in Cybe Secu i y Toni Taipalus, Hilkka G ahn, Hannu Tu iainen and And ei Cos in Uni e si y o Jy äskylä, Jy äskylä, Finland oni. aipal[email p o ec ed]i hilkka.g a[email p o ec ed]i hannu.h . u iainen@jyu. i and ei.cos in@jyu. i Abs ac : The ising popula i y o phenomena such as ubiqui ous compu ing and IoT poses inc easingly high demands o da a managemen , and i is no uncommon ha da abase managemen sys ems (DBMS) mus be capable o eading and w i ing hund eds o ope a ions pe second. Vec o DBMSs (VDBMS) a e no el p oduc s ha ocus on he managemen o ec o da a and can alle ia e da a managemen p essu es by s o ing da a objec s such as logs, sys em calls, emails, ne wo k low da a, and memo y dumps in ea u e ec o s ha a e compu a ionally e icien in bo h s o age and in o ma ion e ie al. VDMBSs allow e icien nea es neighbou simila i y sea ch on complex da a objec s, which can be used in a ious cybe secu i y applica ions such as anomaly, in usion, malwa e de ec ion, use beha iou analysis, and ne wo k low analysis. This s udy desc ibes VDBMSs and some o hei use cases in cybe secu i y. Keywo ds: Vec o Da abase, Anomaly De ec ion, T a ic Analysis, Cybe Secu i y, Phishing De ec ion 1. In oduc ion Vec o s as a da a ep esen a ion me hod ha e gained popula i y wi h la ge language models, e e se image sea ches, and ecommenda ion sys ems (Li, 2023). E ec i ely, almos all ypes o da a objec s, such as ex , images, and ideo, can be ep esen ed as ec o s. This popula i y s ems om he inhe en e sa ili y o ec o s, which allow complex da a s uc u es o be exp essed in a ma hema ical o m, enabling e icien p ocessing and analysis (Taipalus, 2024). Fo example, in he ealm o la ge language models, ec o s se e as a undamen al ep esen a ion o wo ds, sen ences, o en i e documen s, cap u ing seman ic ela ionships and con ex ual in o ma ion. Al hough ec o s ha e been widely u ilized in cybe secu i y in con ex s such as machine lea ning classi ica ion, ec o da abase managemen sys ems (VDBMS) ha e eme ged in he ea ly 2020s as dedica ed sys ems o managing ec o da a. Simila ly o ela ional DBMSs, VDBMSs p o ide ea u es ha au oma e much o he wo k in managing da a. Because bo h ec o iza ion and DBMS ea u es a e ela i ely ma u e and well-unde s ood, he ela i ely no el VDBMSs ha e quickly es ablished hemsel es as us wo hy pieces o so wa e used in a ious domains. The landscape o cybe secu i y da a has expanded conside ably, mi o ing he g ow h obse ed in o he domains like la ge language models. Con en ional amewo ks and algo i hms o ec o managemen p o e inadequa e when con on ed wi h he shee magni ude o hese da ase s (Wang e al., 2021). In esponse o hese challenges, ec o da abases ha e eme ged as a supe io al e na i e, demons a ing as e compu a ional speed and iche ea u es. These ad ancemen s in ec o da abase echnology add ess he limi a ions inhe en in p e ious sys ems, pa icula ly hei abili y o e ec i ely handle he olume o in o ma ion inhe en in cybe secu i y da ase s. In his s udy, we desc ibe ec o s as means o ep esen ing di e en da a objec s such as emails, ne wo k a ic, and biome ic image da a, how VDBMSs acili a e ec o da a managemen , and mos impo an ly, how VDBMSs can be u ilized in a ious cybe secu i y ela ed use-cases such as biome ic au hen ica ion and email phishing de ec ion. We also p o ide examples o es ablished Py hon lib a ies o da a p ep ocessing, no maliza ion, ea u e ex ac ion, and ec o iza ion. No ably, Py hon is no he only p og amming language wi h such lib a ies. The es o he s udy is s uc u ed as ollows. In he nex sec ion, we desc ibe VDBMS undamen als, ea u es, and p oduc s, and in Sec ion 3, we de ail ou VDBMS use cases in cybe secu i y. Sec ion 4 concludes he s udy. 2. Vec o Da abase Managemen Sys ems Fo ec o da abases, ec o s a e e ec i ely ep esen ed as o de ed lis s o numbe s, e.g., [0.1, 7.0, -2.9]. This simple ec o could ep esen a poin in space wi h co esponding coo dina es in a h ee-dimensional Ca esian coo dina e sys em, o he ec o could ep esen he o e all hue o a pho og aph, depending on wha ype o 560 P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024 Toni Taipalus e al da a objec has been ec o ized, i.e., con e ed in o a ea u e ec o (Wang e al., 2021). Al hough his example ec o consis s o h ee dimensions o elemen s, ec o s can hold housands o dimensions. Fo e e se image sea ch applica ions, images a e ans o med in o ec o s, allowing simila i y compa isons based on ec o dis ances. Recommenda ion sys ems le e age ec o s o encapsula e use p e e ences and i em cha ac e is ics, enabling pe sonalized and compu a ionally e icien con en sugges ions. The abili y o con e di e se da a ypes, such as ex , images, and ideo, in o ec o ep esen a ions acili a es in e ope abili y be ween di e en da a objec s. Fo example, he same ypes o que ies may be used o e ie e ex ual and image da a. As ad ancemen s in ec o ep esen a ion me hodologies con inue, ec o ep esen a ions a e inc easingly used in di e en con ex s. VDBMSs a e a ype o DBMS designed o manage ec o da a. Like o he ypes o DBMSs, such as ela ional DBMSs, VDBMS p o ides means o e icien ly s o e and e ie e ec o da a and p o ide access and concu ency con ol, que y op imiza ion, and da abase scalabili y. Addi ionally, VDBMSs o e se e al ad an ages in handling ec o da a o e adi ional ela ional DBMSs. One key s eng h lies in hei abili y o pe o m ec o ope a ions, enabling simul aneous p ocessing o mul iple elemen s wi hin a ec o . Figu e 1: A simpli ied example o ans o ming and s o ing an e en o da a-o -in e es in o VDBMS o e icien da a managemen , such as indexing, que ying, scalabili y, and access con ol. VDBMSs a e designed o suppo complex ec o ope a ions, making hem well-sui ed o applica ions whe e ma hema ical compu a ions on ec o da a a e p e alen . Que y op imiza ion in VDBMSs in ol es explo ing specialized op imiza ion echniques o ec o ope a ions. This includes op imizing ec o agg ega ions, joins, and il e ing o s eamline que y execu ion. By ailo ing op imiza ion s a egies o he unique cha ac e is ics o ec o da a, VDBMSs can achie e be e que y pe o mance compa ed o gene al-pu pose DBMSs when dealing wi h ec o -cen ic wo kloads. Popula VDBMSs include p oduc s such as Pinecone, Mil us (Wang e al., 2021) and Ch oma. The e a e also se e al lib a ies o ec o ope a ions, such as FAISS and Annoy, bu hey do no p o ide many o he DBMS ea u es lis ed abo e. Se e al o he DBMSs, such as Pos g eSQL, Redis, and SingleS o e, ha e also adop ed ea u es o managing ec o da a (Taipalus, 2024). Con a y o que ies ypical o ela ional and NoSQL da abases, ec o que ies sea ch o ec o s ha a e app oxima e nea es neighbou s o he que y ec o (Ge e al., 2013). I he que y ec o ep esen s a poin in h ee-dimensional space (e.g., [0.1, 7.0, -2.9]), he VDBMS can sea ch o ec o s in he da abase ha a e closes ma ches o he que y ec o . Depending on he use case, he VDBMS can e u n one o se e al nea -neighbou ec o s wi h di e en nea ness c i e ia. Fo example, suppose he que y ec o is he end use 's cu en posi ion on a map, and he end use is sea ching o he nea es es au an s. In ha case, he VDBMS may e u n he en closes es au an s, bu only wi hin a one-mile adius. I he que y ec o is he end-use s eshly scanned e ina, he VDBMS may e u n ze o o one ec o ha ma ches he que y ec o ; ze o e u ned ec o s esul ing in denied access. 3. Use-Cases in Cybe Secu i y The e a e se e al po en ial use-cases o VDBMSs in cybe secu i y. In his sec ion, we desc ibe some o such use-case, and p o ide u he in o ma ion on how o implemen hese use-cases. This is no an exhaus i e lis . 3.1 Au hen ica ion Rega ding ec o da a, biome ic au hen ica ion is closely ela ed o e e se image sea ch: we use an inpu image o sea ch o simila (o he same) images. The inpu can be, e.g., a ec o ized inge p in , i is, o e ina. Tex -based au hen ica ion, such as passwo ds o passph ases, is seldom a easible use case o ec o da a due o he simplici y o simply compa ing ela i ely sho ex s ings wi h each o he . 561 P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024 Toni Taipalus e al Es ablishing a da abase o biome ic au hen ica ion in ol es se e al s eps. All inpu images should ha e consis en dimensions and educed noise o he a o emen ioned biome ics. Fea u e ex ac ion, i.e., inding meaning ul pa e ns in he images, di e s depending on he ype o biome ics. In inge p in s, me hods such as idge de ec ion and o ien a ion (Zu e al., 2006) may o m he ea u es o he ec o , o use na i ely- ec o ized app oaches such as hose p esen ed in Abe & Shinzaki (2015). In i ises, i is c ucial o ex ac and segmen he i is and analyse i s ex u e wi h, e.g., ci cula Hough ans o m (e.g., Che abi , Chelali & D ejadi, 2012). In e inas, he blood essels also need o be conside ed. A e ex ac ing he ea u es, hey a e combined in o a ec o and o en no malized o consis en scaling. Fo all hese s eps, Py hon lib a ies such as OpenCV (B adski, 2000), sciki -image (Van de Wal e al., 2014), sciki -lea n (K ame & K ame , 2016), and NumPy (c . e.g., Oliphan , 2006), when used in andem, p o ide unc ions o all he a o emen ioned s eps. Figu e 2: A simpli ied example o ans o ming and s o ing an au hen ica ed biome ic inge p in in o VDBMS. Once he ec o s ha e been c ea ed, hey can be inse ed in o a ec o da abase managed by a VDBMS. Many a ailable VDBMSs (and o he DBMSs wi h ec o ea u es) o e au oma ic scalabili y, access con ol, da a enc yp ion, and que y op imiza ion. I is wo h no ing ha he sys em in as uc u e o en mus p o ide he means o ec o ize inpu images o eal- ime au hen ica ion. Tha is, VDBMSs o en do no p o ide he means o ec o ize da a. Some ideo ames a e ypically ec o ized and o ganized sequen ially in o one high- dimensional ec o o ideo-based au hen ica ion, such as gai ecogni ion o keys oke dynamics (Schcla e al., 2012). Wi h oice-based au hen ica ion, audio samples need o be cleaned be o e ec o iza ion. Possible backg ound noise needs o be emo ed, he ampli udes need o be no malized, and he audio should be cap u ed wi h a consis en sampling a e. Fea u es in audio include Mel-F equency Ceps al Coe icien s (Hasan, Jamil & Rahman, 2004) and o man s. Once desi ed ea u es ha e been ex ac ed, hey a e con e ed in o nume ical ec o s. Once a use needs o be au hen ica ed based on a oice sample, he sample is ec o ized and compa ed o he (p e iously eco ded) ec o ized samples in he da abase o ind enough simila i y among he que y ec o and one ec o in he da abase o au hen ica e he use . Py hon packages such as lib osa (McFee e al., 2015) and sciki -lea n o e equi ed unc ions. 3.2 Email Phishing De ec ion To iden i y phishing emails, we need a da ase con aining emails labelled based on whe he hey a e conside ed phishing. Following labelling, he nex s ep in ol es con e ing hese labelled emails in o ea u e ec o s using ec o iza ion echniques such as Bag-o -Wo ds (e.g., Qade , Ameen & Ahmed, 2019), Te m F equency-In e se Documen F equency (e.g., Ch is ian, Agus & Suha ono, 2016), o Wo d Embeddings (e.g., Liu e al., 2015). When a new email a i es, he sys em should ec o ize i simila ly o he ini ial email da ase and pe o m a simila i y sea ch in he VDBMS o ind simila emails. I simila emails ha e been labelled as phishing emails, he new email should be handled acco dingly. Mos common VDBMSs allow me ada a – in his case, labels – o be s o ed along wi h he ea u e ec o s. 562 P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024 Toni Taipalus e al Figu e 3: A simpli ied example o ans o ming and s o ing a (po en ially phishing) email in o VDBMS. I is wo h no ing ha adjus ing he simila i y h eshold based on he ade-o be ween alse posi i es and alse nega i es is c ucial. We need o ine- une his h eshold acco ding o domain-speci ic needs. Addi ionally, we need o e alua e he pe o mance o his app oach using a di e se se o phishing and legi ima e emails and i e a e and adjus he wo k low based on he esul s. Py hon lib a ies such as sciki -lea n, Gensim (Řehůřek & Sojka, 2011), and NLTK (Bi d, 2006) can p ep ocess and ec o ize e en la ge ex da a objec s. One al e na i e app oach a e ec o iza ion is o apply a machine-lea ning model o email classi ica ion. While he desc ibed VDBMS app oach does no in ol e adi ional machine lea ning models, i elies on he idea ha simila emails in ec o space will likely sha e simila cha ac e is ics. I is a di e en pa adigm compa ed o machine-lea ning classi ica ion and migh be sui able depending on he speci ic equi emen s and cons ain s o he use case. I he sys em a chi ec u e al eady includes a VDBMS, his app oach po en ially makes he a chi ec u e mo e e icien and s aigh o wa d, au oma ing much o he da a managemen wo k. 3.3 Anomaly De ec ion Anomaly de ec ion can be a duous as many domains equi e eal- ime and accu a e de ec ions. VDBMSs can be used o de ec cybe secu i y- ela ed anomalies. Depending on he use case, di e en cybe secu i y e en s can be ep esen ed as ea u e ec o s, including in o ma ion such as IP add esses, p o ocols, imes amps, ile sys em ope a ions, and execu ed commands. This app oach allows o au oma ed, nea ly eal- ime de ec ion o anomalous beha iou bu also equi es an ini ial da ase o be ec o ized and used as a e e ence o bo h egula and anomalous beha iou . The quali y o he ini ial da ase is pa amoun , as alse posi i e de ec ions can cause sys em o da a a ailabili y issues due o alse lagging and possible coun e measu es. The baseline accu acy o ue posi i e de ec ions should be e y high; meanwhile, he da ase should be la ge, wi h se e al en ies o no mal and anomalous beha iou . Fo example, app oaches simila o hose p esen ed in Subba & Gup a (2021) o Mazza i e al. (2017) could be used o na i ely ec o ize anomaly de ec ion o hos in usion de ec ion sys ems. Figu e 4: A simpli ied example o ans o ming and s o ing an anomaly ale in o VDBMS. Once he e en s ha e been ec o ized, hey can be inse ed in o a VDBMS. As new cybe secu i y e en s occu , hei ea u es a e ec o ized, and he ec o s a e used as que y ec o s o sea ch o e en s wi h simila cha ac e is ics. As wi h email phishing de ec ion, p epa e o weak he h eshold, i.e., how much he que y ec o s should esemble ec o s o anomalous e en s o ca ego ize hem as anomalous e en s. In all cases, all e en s should be s o ed as ec o s and labelled anomalous o non-anomalous o be u ilized in u u e sea ches. The da a ga he ed can be u he used o enhance he da ase o be e de ec ion h ough con inuous adap a ions and eedback mechanisms. 563 P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024 Toni Taipalus e al 3.4 Ne wo k T a ic Analysis Ne wo k a ic analysis plays a pi o al ole in cybe secu i y by p o iding an unde s anding o he da a lowing h ough a ne wo k. The pu pose is o de ec malicious ac i i ies and po en ial secu i y h ea s be o e asse damage can occu . By sc u inizing pa e ns, p o ocols, and communica ion lows, i is possible o de ec a acks such as dis ibu ed denial-o -se ice (e.g., Lopez e al., 2019) and in usions (e.g., Gao e al., 2020). Ne wo k a ic analysis se es as a p oac i e de ence mechanism, allowing o ganiza ions o bols e hei cybe secu i y de ences, espond swi ly o eme ging h ea s, and sa egua d he in eg i y and con iden iali y o hei digi al asse s. Pe o ming eal- ime ne wo k a ic analysis wi h ec o iza ion in ol es ep esen ing ne wo k a ic da a as ea u e ec o s. By using ools such as Wi esha k, cpdump, o Scapy (Rohi h, Moha i & Shobha, 2018), ex ac ele an da a om aw ne wo k packages such as IP add esses, po s, p o ocols, and packe sizes and con e hem in o ea u e ec o s. Techniques such as Bag-o -Wo ds may be used o ca ego ical da a such as p o ocols, da a ypes, and imes amps can be con e ed in o nume ical ep esen a ions, and nume ical ea u es such as packe sizes may be no malized wi h s a is ical summa ies. Fo example, app oaches such as hose o Liu e al. (2017) could na i ely ec o ize ne wo k a ic, e en in enc yp ed a ic. Figu e 5: A simpli ied example o ans o ming and s o ing a (po en ially phishing) email in o VDBMS. Simila ly o some o he use cases p esen ed be o e, his app oach needs ini ial da a o be compa ed. Again, once he ea u e ec o s ha e been s o ed in a VDBMS, ne wo k a ic should be con inuously ec o ized and compa ed wi h he exis ing ec o s in he da abase (Iglesias & Zseby, 2015). Suppose ec o iza ion aims o classi y and de ec malicious e en s in he ne wo k, i is essen ial o implemen a pe iodic ecalib a ion based on new da a o elimina e alse posi i es and alse nega i es. This app oach se es as a eac i e secu i y measu e and a p oac i e ool o ne wo k op imiza ion and esou ce alloca ion. 4. Conclusion S o ing a ious da a objec s as ea u e ec o s has gained popula i y due o hei compu a ional e iciency in s o ing and compa ing ec o s. Addi ionally, VDBMSs ha e eme ged as sys ems dedica ed o au oma ing asks such as s o ing and indexing ec o s, acili a ing ec o que ying and que y op imiza ion, and da abase scalabili y and access con ol. The s eng hs o VDBMS o cybe secu i y a e hei e iciency in handling la ge and di e se da ase s, p o iding apid que y esponse imes, and being adep a ecognizing non-exac ma ches. These sys ems' scalabili y, speed, and adap abili y make hem in aluable o cybe secu i y, pa icula ly in dynamic en i onmen s whe e ex ensi e and a ied da a equi e quick and lexible analysis. In his s udy, we showed h ough se e al examples how ec o da abase managemen sys ems and a ious so wa e lib a ies can be used in he domain o cybe secu i y. In summa y, we highligh ed he use cases in use au hen ica ion, email phishing de ec ion, anomaly de ec ion, and ne wo k a ic analysis. Howe e , as almos all da a objec s can be ec o ized, he possibili ies o u ilizing ec o da a ex end beyond he use cases p esen ed in his s udy. This p omp s u he heo e ical and applied esea ch on VDBMSs, po en ially esul ing in in e es ing immedia e applica ions in highly demanding cybe -secu i y scena ios. 564 P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024 Toni Taipalus e al Acknowledgmen Hannu Tu iainen hanks he Finnish Cul u al Founda ion / Suomen Kul uu i ahas o o suppo ing his Ph.D. disse a ion wo k and esea ch (g an decision no. 00231412). The inge p in image in Figu e 2 is by use b okena s and is a ailable a F eeimages.com. Re e ences Abe, N., & Shinzaki, T. (2015). Vec o ized inge p in ep esen a ion using minu iae ela ion code. In 2015 In e na ional Con e ence on Biome ics (ICB) (pp. 408-415). IEEE. Bi d, S. (2006). NLTK: he na u al language oolki . In P oceedings o he COLING/ACL 2006 In e ac i e P esen a ion Sessions (pp. 69-72). B adski, G. (2000). The openCV lib a y. D . Dobb's Jou nal: So wa e Tools o he P o essional P og amme , 25(11), 120-123. Che abi , N., Chelali, F. Z., & Dje adi, A. (2012). Ci cula Hough ans o m o i is localiza ion. Science and Technology, 2(5), 114-121. Ch is ian, H., Agus, M. P., & Suha ono, D. (2016). Single documen au oma ic ex summa iza ion using e m equency- in e se documen equency (TF-IDF). ComTech: Compu e , Ma hema ics and Enginee ing Applica ions, 7(4), 285-294. Gao, M., Ma, L., Liu, H., Zhang, Z., Ning, Z., & Xu, J. (2020). Malicious ne wo k a ic de ec ion based on deep neu al ne wo ks and associa ion analysis. Senso s, 20(5), 1452. Ge, T., He, K., Ke, Q., & Sun, J. (2013). Op imized p oduc quan iza ion o app oxima e nea es neighbo sea ch. In P oceedings o he IEEE con e ence on compu e ision and pa e n ecogni ion (pp. 2946-2953). Hasan, M. R., Jamil, M., & Rahman, M. G. R. M. S. (2004). Speake iden i ica ion using mel equency ceps al coe icien s. Va ia ions, 1(4), 565-568. Iglesias, F., & Zseby, T. (2015). Analysis o ne wo k a ic ea u es o anomaly de ec ion. Machine Lea ning, 101, 59-84. K ame , O., & K ame , O. (2016). Sciki -lea n. Machine lea ning o e olu ion s a egies, 45-53. Li, F. (2023). Mode niza ion o da abases in he cloud e a: Building da abases ha un like Legos. In P oceedings o he VLDB Endowmen 16 (pp. 4140–4151). Liu, J., Fu, Y., Ming, J., Ren, Y., Sun, L., & Xiong, H. (2017, Augus ). E ec i e and eal- ime in-app ac i i y analysis in enc yp ed in e ne a ic s eams. In P oceedings o he 23 d ACM SIGKDD in e na ional con e ence on knowledge disco e y and da a mining (pp. 335-344). Liu, Y., Liu, Z., Chua, T. S., & Sun, M. (2015). Topical wo d embeddings. In P oceedings o he AAAI Con e ence on A i icial In elligence (Vol. 29, No. 1). Lopez, A. D., Mohan, A. P., & Nai , S. (2019). Ne wo k a ic beha io al analy ics o de ec ion o DDoS a acks. SMU da a science e iew, 2(1), 14. Mazzawi, H., Dalal, G., Rozenbla z, D., Ein-Do x, L., Niniox, M., & La i, O. (2017) Anomaly De ec ion in La ge Da abases Using Beha io al Pa e ning. 2017 IEEE 33 d In e na ional Con e ence on Da a Enginee ing (ICDE), San Diego, CA, USA, 2017, pp. 1140-1149 McFee, B., Ra el, C., Liang, D., Ellis, D. P., McVica , M., Ba enbe g, E., & Nie o, O. (2015). lib osa: Audio and music signal analysis in Py hon. In P oceedings o he 14 h Py hon in Science Con e ence (pp. 18-25). Oliphan , T. E. (2006). Guide o NumPy. T elgol Publishing. USA. Qade , W. A., Ameen, M. M., & Ahmed, B. I. (2019). An o e iew o Bag o Wo ds: Impo ance, implemen a ion, applica ions, and challenges. In 2019 In e na ional Enginee ing Con e ence (IEC) (pp. 200-204). Řehůřek, R., & Sojka, P. (2011). Gensim - s a is ical seman ics in Py hon. Re ie ed om genism.o g. Rohi h, R., Moha i , M., & Shobha, G. (2018). SCAPY - A powe ul in e ac i e packe manipula ion p og am. In 2018 In e na ional Con e ence on Ne wo king, Embedded and Wi eless Sys ems (ICNEWS) (pp. 1-5). Schcla , A., Rokach, L., Ab amson, A., & Elo ici, Y. (2012). Use Au hen ica ion Based on Rep esen a i e Use s. In IEEE T ansac ions on Sys ems, Man, and Cybe ne ics, Pa C (Applica ions and Re iews), ol. 42, no. 6, pp. 1669-1678, Subba, B., & Gup a, P. (2021). A id ec o ize and singula alue decomposi ion based hos in usion de ec ion sys em amewo k o de ec ing anomalous sys em p ocesses. Compu e s & Secu i y, 100, 102084. Taipalus, T. (2024). Vec o da abase managemen sys ems: Fundamen al concep s, use-cases, and cu en challenges. Cogni i e Sys ems Resea ch, 85, A icle 101216. Van de Wal , S., Schönbe ge , J. L., Nunez-Iglesias, J., Boulogne, F., Wa ne , J. D., Yage , N., ... & Yu, T. (2014). sciki -image: image p ocessing in Py hon. Pee J, 2, e453. Wang, J., Yi, X., Guo, R., Jin, H., Xu, P., Li, S., ... & Xie, C. (2021). Mil us: A pu pose-buil ec o da a managemen sys em. In P oceedings o he 2021 In e na ional Con e ence on Managemen o Da a (pp. 2614-2627). Zhu, E., Yin, J., Hu, C., & Zhang, G. (2006). A sys ema ic me hod o inge p in idge o ien a ion es ima ion and image segmen a ion. Pa e n ecogni ion, 39(8), 1452-1472. 565 P oceedings o he 23 d Eu opean Con e ence on Cybe Wa a e and Secu i y, ECCWS 2024