Visible to the public Detecting Periodic Subsequences in Cyber Security Data

TitleDetecting Periodic Subsequences in Cyber Security Data
Publication TypeConference Paper
Year of Publication2017
AuthorsPrice-Williams, M., Heard, N., Turcotte, M.
Conference Name2017 European Intelligence and Security Informatics Conference (EISIC)
Keywordsanomaly detection, authentication, automated network events, changepoint detection framework, Computational modeling, computer network behaviour, computer network security, computer networks, cyber security data, cyber-security defence, Data models, data sets, digital signatures, identifyingautomated network events, invasive software, Los Alamos National Laboratory's enterprise computer network, maximum likelihood estimation, probability, probability models, pubcrawl, resilience, Resiliency, Scalability, signature based defense, statistical analysis, traditional signature-based detection systems
Abstract

Anomaly detection for cyber-security defence hasgarnered much attention in recent years providing an orthogonalapproach to traditional signature-based detection systems.Anomaly detection relies on building probability models ofnormal computer network behaviour and detecting deviationsfrom the model. Most data sets used for cyber-security havea mix of user-driven events and automated network events,which most often appears as polling behaviour. Separating theseautomated events from those caused by human activity is essentialto building good statistical models for anomaly detection. This articlepresents a changepoint detection framework for identifyingautomated network events appearing as periodic subsequences ofevent times. The opening event of each subsequence is interpretedas a human action which then generates an automated, periodicprocess. Difficulties arising from the presence of duplicate andmissing data are addressed. The methodology is demonstrated usingauthentication data from Los Alamos National Laboratory'senterprise computer network.

URLhttps://ieeexplore.ieee.org/document/8240773
DOI10.1109/EISIC.2017.40
Citation Keyprice-williams_detecting_2017