Engineering Papers⌕ Search

Engineering topics

Best, Daniel M.

Publications and source records attributed to Best, Daniel M..

Malicious Cyber Activity Detection using Zigzag Persistence

In this study we synthesize zigzag persistence from topological data analysis with autoencoder-based approaches to detect malicious cyber activity, and derive analytic insights. Cybersecurity aims to safeguard computers, networks, and servers from various forms of malicious attacks, including network damage, data theft, and activity monitoring. We focus on the cybersecurity domain and investigate the detection of malicious activity using log data. We consider the dynamics of the log data and explore the changing topology of a hypergraph representation of this data to gain insights into the underlying activity. These hypergraphs capture complex interactions between processes, together with their temporal information. To study the changing topology we use zigzag persistence, which captures how topological features persist at multiple dimensions over time. We observe that this detects malicious activity in a cyber data set. To automate this detection we implement an autoencoder trained on a vectorization of the resulting zigzag persistence barcodes. Our experimental results demonstrate the effectiveness of the autoencoder in detecting malicious activity. Overall, this study highlights the potential of zigzag persistence and its combination with temporal hypergraphs for analyzing cybersecurity log data and detecting malicious behavior.

hypergraphs, temporal hypergraph, topological data↗

CyberPetri at CDX 2016: Real-time Network Situation Awareness

CyberPetri is a novel visualization technique that provides a flexible map of the network based on available characteristics, such as IP address, operating system, or service. Previous work introduced CyberPetri as a visualization feature in Ocelot, a network defense tool that helped security analysts understand and respond to an active defense scenario. In this paper we present a case study in which we use the CyberPetri visualization technique to support real-time situation awareness during the 2016 Cyber Defense Exercise.

Cybersecurity↗

Behavior-dependent Routing: Responding to Anomalies with Automated Low-cost Measures

This is a conference paper submission describing research and software implementation of a cybersecurity concept that uses behavior models to trigger changes in routing of network traffic. As user behavior deviates more and more from baseline models, traffic is routed through more elevated layers of analysis and control.

information flow controls↗

7 Key Challenges for Visualization in Cyber Network Defense

In this paper we present seven challenges, informed by two user studies, to be considered when developing a visualization for cyber security purposes. Cyber security visualizations must go beyond isolated solutions and “pretty picture” visualizations in order to make impact to users. We provide an example prototype that addresses the challenges with a description of how they are met. Our aim is to assist in increasing utility and adoption rates for visualization capabilities in cyber security.

Cyber security, visualization, network defense↗

SIGNATURES OF ILLICIT NUCLEAR PROCUREMENT NETWORKS: AN OVERVIEW OF PRELIMINARY APPROACHES AND RESULTS

The illicit trafficking of strategic nuclear commodities (defined here as the goods needed for a covert nuclear program excluding special nuclear materials) poses a significant challenge to the international nuclear nonproliferation community. Export control regulations, both domestically and internationally, seek to inhibit the spread of strategic nuclear commodities by restricting their sale to parties that may use them for nefarious purposes. However, export controls alone are not sufficient for preventing the illicit transfer of strategic nuclear goods. There are two major pitfalls to relying solely on export control regulations for the deterrence of proliferation of strategic goods. First, export control enforcement today relies heavily on the honesty and willingness of participants to adhere to the legal framework already in place. Secondly, current practices focus on the evaluation of single records which allow for the necessary goods to be purchased separately and hidden within the thousands of legitimate commerce transactions that occur each day, disregarding strategic information regarding several purchases. Our research presents two preliminary data-centric approaches for investigating procurement networks of strategic nuclear commodities. Pacific Northwest National Laboratory (PNNL) has been putting significant effort into nonproliferation activities as an institution, both in terms of the classical nuclear material focused approach and in the examination of other strategic goods necessary to implement a nuclear program. In particular, the PNNL Signature Discovery Initiative (SDI) has codified several scientific methodologies for the detection, characterization, and prediction of signatures that are indicative of a phenomenon of interest. The methodologies and tools developed under SDI have already been applied successfully to problems in bio-forensics, cyber security and power grid balancing efforts and they have now made the nonproliferation of strategic goods into a challenge problem for testing their methodology and tools. As a first step towards the detection and characterization of illicit procurement networks, our research examines procurement networks as defined by a system of entities (people or companies) that enter into transactions of specific items with one another. Once we have defined such networks, we are interested in answering questions about the behavior and characterization of such networks. The questions we wish to answer regarding procurement networks are, first, “Can we detect networks within large, noisy datasets?” and second, “To what extent can we compare multiple networks and identify their similarities?” As procurement networks can be naturally viewed as a graph, we have employed several graph analytic tools to aid in these tasks. In particular, Graphscape, an SDI tool, uses a novel method to approximate edit distance, a graph distance measure based on the number of changes needed to transform one graph into another, in order to measure how similar two given graphs are to each other. Given a set of graphs where vertices represent companies and edges represent a shipment from company A to company B, we can calculate an all-for-all comparison of graphs. In this way, we are able to determine which graphs are most similar, and which require more changes to transform one into the other. The set of graphs to be compared can be further specialized to provide more insight, e.g., using different time periods to explore events in a company life cycle.

graph analysis↗

Gamification for Measuring Cyber Security Situational Awareness

Cyber defense competitions arising from U.S. service academy exercises, offer a platform for collecting data that can inform research that ranges from characterizing the ideal cyber warrior to describing behaviors during certain challenging cyber defense situations. This knowledge could lead to better preparation of cyber defenders in both military and civilian settings. This paper describes how one regional competition, the PRCCDC, a participant in the national CCDC program, conducted proof of concept experimentation to collect data during the annual competition for later analysis. The intent is to create an ongoing research agenda that expands on this current work and incorporates augmented cognition and gamification methods for measuring cybersecurity situational awareness under the stress of cyber attack.

Cyber Defense Competitions, CCDC, cyber defender, ↗

Data-Intensive Visual Analysis for Cyber Security

Protecting communications networks against attacks where the aim is to steal information, disrupt order, or harm critical infrastructure can require the collection and analysis of staggering amounts of data. The ability to detect and respond to threats quickly is a paramount concern across sectors, and especially for critical government, utility and financial networks. Yet detecting emerging or incipient threats in immense volumes of network traffic requires new computational and analytic approaches. Network security increasingly requires cooperation between human analysts able to spot suspicious events through means such as data visualization and automated systems that process streaming network data in near real-time to triage events so that human analysts are best able to focus their work.

Pike, William A.↗

Visual Text Analytics for Impromptu Analysts

The Scalable Reasoning System (SRS) is a lightweight visual analytics framework that makes analytical capabilities widely accessible to a class of users we have deemed “impromptu analysts.” By focusing on a deployment of SRS, the Lessons Learned Explorer (LLEx), we examine how to develop visualizations around analytical-oriented goals and data availability. We discuss how to help impromptu analysts to explore deeper patterns. Through designing consistent interactions, we arrive at an interdependent view capable of showcasing patterns. With the combination of SRS widget visualizations and interactions around the underlying textual data, we aim to transition the casual, infrequent user into a viable–albeit impromptu–analyst.

Analyst↗