Publications
114 results found
Schon C, Adams NM, Evangelou M, 2017, Clustering and monitoring edge behaviour in enterprise network traffic, IEEE International Conference on Intelligence and Security Informatics, Publisher: IEEE, Pages: 31-36
This paper takes an unsupervised learning approach for monitoring edge activity within an enterprise computer network. Using NetFlow records, features are gathered across the active connections (edges) in 15-minute time windows. Then, edges are grouped into clusters using the k-means algorithm. This process is repeated over contiguous windows. A series of informative indicators are derived by examining the relationship of edges with the observed cluster structure. This leads to an intuitive method for monitoring network behaviour and a temporal description of edge behaviour at global and local levels.
Rubin-Delanchy P, HEARD NA, 2016, Disassortativity of computer networks, IEEE International Conference on Intelligence and Security Informatics, Publisher: IEEE
Network data is ubiquitous in cyber-security applications. Accurately modelling such data allows discovery of anomalous edges, subgraphs or paths, and is key to many signature-free cyber-security analytics. We present a recurring property of graphs originating from cyber-security applications, often considered a ‘corner case’ in the main literature on network data analysis, that greatly affects the performance of standard ‘off-the-shelf’ techniques. This is the property that similarity, in terms of network behaviour, does not imply connectivity, and in fact the reverse is often true. We call this disassortivity. The phenomenon is illustrated using network flow data collected on an enterprise network, and we show how Big Data analytics designed to detect unusual connectivity patterns can be improved.
Evangelou M, Adams N, 2016, Predictability of NetFlow data, IEEE International Conference on Intelligence and Security Informatics, Publisher: IEEE
The behaviour of individual devices connected to anenterprise network can vary dramatically, as a device’s activitydepends on the user operating the device as well as on all behindthe scenes operations between the device and the network. Beingable to understand and predict a device’s behaviour in a networkcan work as the foundation of an anomaly detection framework,as devices may show abnormal activity as part of a cyber attack.The aim of this work is the construction of a predictive regressionmodel for a device’s behaviour at normal state. The behaviourof a device is presented by a quantitative response and modelledto depend on historic data recorded by NetFlow.
Whitehouse M, Evangelou M, Adams N, 2016, Activity-based temporal anomaly detection in enterprise-cyber security, IEEE International Big Data Analytics for Cybersecurity computing (BDAC'16) Workshop, IEEE International Conference on Intelligence and Security Informatics, Publisher: IEEE
Statistical anomaly detection is emerging as animportant complement to signature-based methods for enterprisenetwork defence. In this paper, we isolate a persistent structurein two different enterprise network data sources. This structureprovides the basis of a regression-based anomaly detectionmethod. The procedure is demonstrated on a large public domaindata set.
Adams N, Heard N, 2016, Dynamic networks and cyber-security, ISBN: 9781786340740
As an under-studied area of academic research, the analysis of computer network traffic data is still in its infancy. However, the challenge of detecting and mitigating malicious or unauthorised behaviour through the lens of such data is becoming an increasingly prominent issue. This collection of papers by leading researchers and practitioners synthesises cutting-edge work in the analysis of dynamic networks and statistical aspects of cyber security. The book is structured in such a way as to keep security application at the forefront of discussions. It offers readers easy access into the area of data analysis for complex cyber-security applications, with a particular focus on temporal and network aspects. Chapters can be read as standalone sections and provide rich reviews of the latest research within the field of cyber-security. Academic readers will benefit from state-of-the-art descriptions of new methodologies and their extension to real practical problems while industry professionals will appreciate access to more advanced methodology than ever before.
Bakoben M, Bellotti AG, Adams NM, 2016, Improving clustering performance by incorporating uncertainty, Pattern Recognition Letters, Vol: 77, Pages: 28-34, ISSN: 1872-7344
In more challenging problems the input to a clustering problem is not raw data objects, but rather parametric statistical summaries of the data objects. For example, time series of different lengths may be clustered on the basis of estimated parameters from autoregression models. Such summary procedures usually provide estimates of uncertainty for parameters, and ignoring this source of uncertainty affects the recovery of the true clusters. This paper is concerned with the incorporation of this source of uncertainty in the clustering procedure. A new dissimilarity measure is developed based on geometric overlap of confidence ellipsoids implied by the uncertainty estimates. In extensive simulation studies and a synthetic time series benchmark dataset, this new measure is shown to yield improved performance over standard approaches.
Plasse J, Adams N, 2016, Handling Delayed Labels in Temporally Evolving Data Streams, 4th IEEE International Conference on Big Data (Big Data), Publisher: IEEE, Pages: 2416-2424
- Author Web Link
- Cite
- Citations: 13
Bakoben M, Adams N, Bellotti A, 2016, Uncertainty aware clustering for behaviour in enterprise networks, 16th IEEE International Conference on Data Mining (ICDM), Publisher: IEEE, Pages: 269-272, ISSN: 2375-9232
- Author Web Link
- Cite
- Citations: 1
Noble J, Adams NM, 2016, Correlation-based Streaming Anomaly Detection in Cyber-Security, 16th IEEE International Conference on Data Mining (ICDM), Publisher: IEEE, Pages: 311-318, ISSN: 2375-9232
- Author Web Link
- Cite
- Citations: 3
Adams NM, Bodenham DA, 2015, A comparison of efficient approximations for a weighted sum of chi-squared random variables, Statistics and Computing, Vol: 26, Pages: 917-928, ISSN: 0960-3174
In many applications, the cumulative distribution function (cdf) FQNFQN of a positively weighted sum of N i.i.d. chi-squared random variables QNQN is required. Although there is no known closed-form solution for FQNFQN, there are many good approximations. When computational efficiency is not an issue, Imhof’s method provides a good solution. However, when both the accuracy of the approximation and the speed of its computation are a concern, there is no clear preferred choice. Previous comparisons between approximate methods could be considered insufficient. Furthermore, in streaming data applications where the computation needs to be both sequential and efficient, only a few of the available methods may be suitable. Streaming data problems are becoming ubiquitous and provide the motivation for this paper. We develop a framework to enable a much more extensive comparison between approximate methods for computing the cdf of weighted sums of an arbitrary random variable. Utilising this framework, a new and comprehensive analysis of four efficient approximate methods for computing FQNFQN is performed. This analysis procedure is much more thorough and statistically valid than previous approaches described in the literature. A surprising result of this analysis is that the accuracy of these approximate methods increases with N.
Weston DJ, Russell RA, Batty E, et al., 2015, New quantitative approaches reveal the spatial preference of nuclear compartments in mammalian fibroblasts, JOURNAL OF THE ROYAL SOCIETY INTERFACE, Vol: 12, ISSN: 1742-5689
Hand DJ, Adams NM, 2014, Selection bias in credit scorecard evaluation, JOURNAL OF THE OPERATIONAL RESEARCH SOCIETY, Vol: 65, Pages: 408-415, ISSN: 0160-5682
- Author Web Link
- Cite
- Citations: 14
Adams N, Heard N, 2014, Data analysis for network cyber-security, ISBN: 9781783263745
There is increasing pressure to protect computer networks against unauthorized intrusion, and some work in this area is concerned with engineering systems that are robust to attack. However, no system can be made invulnerable. Data Analysis for Network Cyber-Security focuses on monitoring and analyzing network traffic data, with the intention of preventing, or quickly identifying, malicious activity. Such work involves the intersection of statistics, data mining and computer science. Fundamentally, network traffic is relational, embodying a link between devices. As such, graph analysis approaches are a natural candidate. However, such methods do not scale well to the demands of real problems, and the critical aspect of the timing of communications events is not accounted for in these approaches. This book gathers papers from leading researchers to provide both background to the problems and a description of cutting-edge methodology. The contributors are from diverse institutions and areas of expertise and were brought together at a workshop held at the University of Bristol in March 2013 to address the issues of network cyber security. The workshop was supported by the Heilbronn Institute for Mathematical Research.
Bodenham DA, Adams NM, 2014, Adaptive change detection for relay-like behaviour, IEEE Joint Intelligence and Security Informatics Conference (JISIC 2014), Publisher: IEEE, Pages: 252-255
- Author Web Link
- Cite
- Citations: 1
Adams NM, Lawson D, 2014, An approximate framework for flexible network flow screening, IEEE Joint Intelligence and Security Informatics Conference (JISIC 2014), Publisher: IEEE, Pages: 256-259
Rubin-Delanchy P, Lawson DJ, Turcotte MJ, et al., 2014, Three statistical approaches to sessionizing network flow data, IEEE Joint Intelligence and Security Informatics Conference (JISIC 2014), Publisher: IEEE, Pages: 244-247
- Author Web Link
- Cite
- Citations: 3
Lawson DJ, Rubin-Delanchy P, Heard N, et al., 2014, Statistical frameworks for detecting tunnelling in cyber defence using big data, IEEE Joint Intelligence and Security Informatics Conference (JISIC 2014), Publisher: IEEE, Pages: 248-251
- Author Web Link
- Cite
- Citations: 1
Evans LPG, adams N, anagnostopoulos C, 2013, When Does Active Learning Work?, Advances in Intelligent Data Analysis XII, ISSN: 0302-9743
Ross GJ, Tasoulis DK, Adams NM, 2013, Sequential monitoring of a Bernoulli sequence when the pre-change parameter is unknown, COMPUTATIONAL STATISTICS, Vol: 28, Pages: 463-479, ISSN: 0943-4062
- Author Web Link
- Cite
- Citations: 9
Bodenham DA, Adams NM, 2013, Continuous monitoring of a computer network using multivariate adaptive estimation, IEEE 13th International Conference on Data Mining (ICDM), Publisher: IEEE, Pages: 311-318, ISSN: 2375-9232
- Author Web Link
- Cite
- Citations: 10
Evans LPG, Adams NM, Anagnostopoulos C, 2013, When Does Active Learning Work?, 12th International Symposium on Intelligent Data Analysis (IDA), Publisher: SPRINGER-VERLAG BERLIN, Pages: 174-185, ISSN: 0302-9743
- Author Web Link
- Cite
- Citations: 2
Ross GJ, Adams NM, Tasoulis DK, et al., 2012, Exponentially weighted moving average charts for detecting concept drift (vol 33, pg 191, 2012), PATTERN RECOGNITION LETTERS, Vol: 33, Pages: 2261-2261, ISSN: 0167-8655
Pavlidis NG, Tasoulis DK, Adams NM, et al., 2012, Adaptive consumer credit classification, JOURNAL OF THE OPERATIONAL RESEARCH SOCIETY, Vol: 63, Pages: 1645-1654, ISSN: 0160-5682
- Author Web Link
- Cite
- Citations: 14
Weston DJ, Adams NM, Russell RA, et al., 2012, Analysis of spatial point patterns in nuclear biology, PLoS ONE, Vol: 7, ISSN: 1932-6203
There is considerable interest in cell biology in determining whether, and to what extent, the spatial arrangement of nuclear objects affects nuclear function. A common approach to address this issue involves analyzing a collection of images produced using some form of fluorescence microscopy. We assume that these images have been successfully pre-processed and a spatial point pattern representation of the objects of interest within the nuclear boundary is available. Typically in these scenarios, the number of objects per nucleus is low, which has consequences on the ability of standard analysis procedures to demonstrate the existence of spatial preference in the pattern. There are broadly two common approaches to look for structure in these spatial point patterns. First a spatial point pattern for each image is analyzed individually, or second a simple normalization is performed and the patterns are aggregated. In this paper we demonstrate using synthetic spatial point patterns drawn from predefined point processes how difficult it is to distinguish a pattern from complete spatial randomness using these techniques and hence how easy it is to miss interesting spatial preferences in the arrangement of nuclear objects. The impact of this problem is also illustrated on data related to the configuration of PML nuclear bodies in mammalian fibroblast cells.
Ross GJ, Adams NM, 2012, Two Nonparametric Control Charts for Detecting Arbitrary Distribution Changes, JOURNAL OF QUALITY TECHNOLOGY, Vol: 44, Pages: 102-116, ISSN: 0022-4065
- Author Web Link
- Cite
- Citations: 103
Ross GJ, Adams NM, Tasoulis DK, et al., 2012, Exponentially weighted moving average charts for detecting concept drift, PATTERN RECOGNITION LETTERS, Vol: 33, Pages: 191-198, ISSN: 0167-8655
- Author Web Link
- Cite
- Citations: 217
O'Sullivan A, Adams NM, Rezek I, 2012, Canonical Correlation Analysis for Detecting Changes in Network Structure, 12th IEEE International Conference on Data Mining (ICDM), Publisher: IEEE, Pages: 250-257, ISSN: 2375-9232
- Author Web Link
- Cite
- Citations: 5
Tsagaris T, Jasra A, Adams N, 2012, Robust and adaptive algorithms for online portfolio selection, QUANTITATIVE FINANCE, Vol: 12, Pages: 1651-1662, ISSN: 1469-7688
- Author Web Link
- Cite
- Citations: 4
Ross GJ, Tasoulis DK, Adams NM, 2011, Nonparametric Monitoring of Data Streams for Changes in Location and Scale, TECHNOMETRICS, Vol: 53, Pages: 379-389, ISSN: 0040-1706
- Author Web Link
- Cite
- Citations: 136
Pavlidis NG, Tasoulis DK, Adams NM, et al., 2011, λ-Perceptron: An adaptive classifier for data streams, PATTERN RECOGNITION, Vol: 44, Pages: 78-96, ISSN: 0031-3203
- Author Web Link
- Cite
- Citations: 30
This data is extracted from the Web of Science and reproduced under a licence from Thomson Reuters. You may not copy or re-distribute this data in whole or in part without the written consent of the Science business of Thomson Reuters.