Order priors for Bayesian network discovery with an application to malware phylogeny

Journal Article · Fri Sep 15 00:00:00 EDT 2017 · Statistical Analysis and Data Mining

DOI:https://doi.org/10.1002/sam.11364· OSTI ID:1398911

Oyen, Diane  ^[1]; Anderson, Blake ^[2]; Sentz, Kari  ^[1]; Anderson-Cook, Christine Michaela  ^[1]

---

1. Los Alamos National Lab. (LANL), Los Alamos, NM (United States)
2. Cisco Systems Inc., Durham, NC (United States)

Here, Bayesian networks have been used extensively to model and discover dependency relationships among sets of random variables. We learn Bayesian network structure with a combination of human knowledge about the partial ordering of variables and statistical inference of conditional dependencies from observed data. Our approach leverages complementary information from human knowledge and inference from observed data to produce networks that reflect human beliefs about the system as well as to fit the observed data. Applying prior beliefs about partial orderings of variables is an approach distinctly different from existing methods that incorporate prior beliefs about direct dependencies (or edges) in a Bayesian network. We provide an efficient implementation of the partial-order prior in a Bayesian structure discovery learning algorithm, as well as an edge prior, showing that both priors meet the local modularity requirement necessary for an efficient Bayesian discovery algorithm. In benchmark studies, the partial-order prior improves the accuracy of Bayesian network structure learning as well as the edge prior, even though order priors are more general. Our primary motivation is in characterizing the evolution of families of malware to aid cyber security analysts. For the problem of malware phylogeny discovery, we find that our algorithm, compared to existing malware phylogeny algorithms, more accurately discovers true dependencies that are missed by other algorithms.

• Research Organization: Los Alamos National Laboratory (LANL), Los Alamos, NM (United States)
• Sponsoring Organization: USDOE Laboratory Directed Research and Development (LDRD) Program
• Grant/Contract Number: AC52-06NA25396
• OSTI ID: 1398911
• Report Number(s): LA-UR-16-23891
• Journal Information: Statistical Analysis and Data Mining, Vol. 10, Issue 5; ISSN 1932-1864
• Publisher: Wiley
• Country of Publication: United States
• Language: English

Related Subjects

97 MATHEMATICS AND COMPUTING
Bayesian networks
cyber security
malware
probabilistic graphical models