Affiliation:
1. Pacific Northwest National Laboratory, Seattle, WA
Abstract
Cyber operations is drowning in diverse, high-volume, multi-source data. To get a full picture of current operations and identify malicious events and actors, analysts must see through data generated by a mix of human activity and benign automated processes. Although many monitoring and alert systems exist, they typically use signature-based detection methods. We introduce a general method rooted in
spectral graph theory
to discover patterns and anomalies without
a priori
knowledge of signatures. We derive and propose a new graph-theoretic centrality measure based on the derivative of the graph Laplacian matrix in the direction of a vertex. To build intuition about our measure, we show how it identifies the most central vertices in standard network datasets and compare to other graph centrality measures. Finally, we focus our attention on studying its effectiveness in identifying important IP addresses in network flow data. Using both real and synthetic network flow data, we conduct several experiments to test our measure’s sensitivity to two types of injected attack profiles and show that vertices participating in injected attack profiles exhibit noticeable changes in our centrality measures, even when the injected anomalies are relatively small, and in the presence of simulated network dynamics.
Publisher
Association for Computing Machinery (ACM)
Reference53 articles.
1. Sinan G. Aksoy Helen Jenne Emilie Purvine and Stephen J. Young. in preparation. Rapid Generation and Parameter Recovery of Correlated Temporal Graphs.
2. David Aldous and James Fill. 1995. Reversible Markov chains and random walks on graphs. https://www.stat.berkeley.edu/aldous/RWG/book.pdf
3. Routing permutations on graphs via matchings;Alon Noga;SIAM J. Discr. Math.,1994
4. Spanning tree formulas and Chebyshev polynomials;Boesch Francis T.;Graphs Combinat.,1986
Cited by
1 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献
1. Malicious Cyber Activity Detection using Zigzag Persistence;2023 IEEE Conference on Dependable and Secure Computing (DSC);2023-11-07