Network Intrusion Detection and Visualization Using Aggregations in a Cyber Security Data Warehouse

• 作者: Bogdan Denny Czejdo Erik M. Ferragut Jason Laska John R. Goodall
• 来源期刊: 通讯、网络与系统学国际期刊(英文)
• 学科: 工学
• 关键词: CYBER Security Network INTRUSION ANOMALY Detection Data Warehouses Aggregation PERSONALIZATION Situational Understanding
• 年，卷（期）: 2012,（9）
• 页码范围: 593-602
• 页数: 10页
• 分类号: TP39

摘要

The challenge of achieving situational understanding is a limiting factor in effective, timely, and adaptive cyber-security analysis. Anomaly detection fills a critical role in network assessment and trend analysis, both of which underlie the establishment of comprehensive situational understanding. To that end, we propose a cyber security data warehouse implemented as a hierarchical graph of aggregations that captures anomalies at multiple scales. Each node of our proposed graph is a summarization table of cyber event aggregations, and the edges are aggregation operators. The cyber security data warehouse enables domain experts to quickly traverse a multi-scale aggregation space systematically. We describe the architecture of a test bed system and a summary of results on the IEEE VAST 2012 Cyber Forensics data.