Malicious Cyber Activity Detection using Zigzag Persistence

Conference · Fri Dec 15 04:00:00 EST 2023

DOI:https://doi.org/10.1109/DSC61021.2023.10354204· OSTI ID:2340827

Myers, Audun D. ^[1]; Bittner, Alyson S. ^[1]; Aksoy, Sinan G. ^[1]; Best, Daniel M. ^[1]; Roek, Gregory Henselman-Petrusek ^[1]; Jenne, Helen Kathleen ^[1]; Joslyn, Cliff A. ^[1]; Kay, William W. ^[1]; Seppala, Garret E. ^[1]; Young, Stephen J. ^[1]; Purvine, Emilie AH ^[1]

---

1. BATTELLE (PACIFIC NW LAB)

In this study we synthesize zigzag persistence from topological data analysis with autoencoder-based approaches to detect malicious cyber activity, and derive analytic insights. Cybersecurity aims to safeguard computers, networks, and servers from various forms of malicious attacks, including network damage, data theft, and activity monitoring. We focus on the cybersecurity domain and investigate the detection of malicious activity using log data. We consider the dynamics of the log data and explore the changing topology of a hypergraph representation of this data to gain insights into the underlying activity. These hypergraphs capture complex interactions between processes, together with their temporal information. To study the changing topology we use zigzag persistence, which captures how topological features persist at multiple dimensions over time. We observe that this detects malicious activity in a cyber data set. To automate this detection we implement an autoencoder trained on a vectorization of the resulting zigzag persistence barcodes. Our experimental results demonstrate the effectiveness of the autoencoder in detecting malicious activity. Overall, this study highlights the potential of zigzag persistence and its combination with temporal hypergraphs for analyzing cybersecurity log data and detecting malicious behavior.

• Research Organization: Pacific Northwest National Laboratory (PNNL), Richland, WA (United States)
• Sponsoring Organization: USDOE
• DOE Contract Number: AC05-76RL01830
• OSTI ID: 2340827
• Report Number(s): PNNL-SA-185724
• Country of Publication: United States
• Language: English

Related Subjects

hypergraphs
temporal hypergraph
topological data analysis
zigzag persistence
Cyber secruity