Discrete Mathematical Approaches to Graph-Based Traffic Analysis
Modern cyber defense and anlaytics requires general, formal models of cyber systems. Multi-scale network models are prime candidates for such formalisms, using discrete mathematical methods based in hierarchically-structured directed multigraphs which also include rich sets of labels. An exemplar of an application of such an approach is traffic analysis, that is, observing and analyzing connections between clients, servers, hosts, and actors within IP networks, over time, to identify characteristic or suspicious patterns. Towards that end, NetFlow (or more generically, IPFLOW) data are available from routers and servers which summarize coherent groups of IP packets flowing through the network. In this paper, we consider traffic analysis of Netflow using both basic graph statistics and two new mathematical measures involving labeled degree distributions and time interval overlap measures. We do all of this over the VAST test data set of 96M synthetic Netflow graph edges, against which we can identify characteristic patterns of simulated ground-truth network attacks.
- Research Organization:
- Pacific Northwest National Lab. (PNNL), Richland, WA (United States)
- Sponsoring Organization:
- USDOE
- DOE Contract Number:
- AC05-76RL01830
- OSTI ID:
- 1222143
- Report Number(s):
- PNNL-SA-101858
- Resource Relation:
- Conference: The 2nd ASE International Conference on Big Data Science & Computing, the 6th ASE International Conference on Social Computing and the 3rd ASE International Conference on Cyber Security, May 27-31, 2014, Stanford, California
- Country of Publication:
- United States
- Language:
- English
Similar Records
A Scalable HPC Insider Threat Monitoring System
MetricForensics: A Multi-Level Approach for Mining Volatile Graphs