Publications

BibTex format

@inproceedings{Price-Williams:2017:10.1109/EISIC.2017.40,
author = {Price-Williams, M and Heard, N and Turcotte, M},
doi = {10.1109/EISIC.2017.40},
pages = {84--90},
title = {Detecting periodic subsequences in cyber security data},
url = {http://dx.doi.org/10.1109/EISIC.2017.40},
year = {2017}
}

Download

RIS format (EndNote, RefMan)

TY  - CPAPER
AB  - Anomaly detection for cyber-security defence hasgarnered much attention in recent years providing an orthogonalapproach to traditional signature-based detection systems.Anomaly detection relies on building probability models ofnormal computer network behaviour and detecting deviationsfrom the model. Most data sets used for cyber-security havea mix of user-driven events and automated network events,which most often appears as polling behaviour. Separating theseautomated events from those caused by human activity is essentialto building good statistical models for anomaly detection. This articlepresents a changepoint detection framework for identifyingautomated network events appearing as periodic subsequences ofevent times. The opening event of each subsequence is interpretedas a human action which then generates an automated, periodicprocess. Difficulties arising from the presence of duplicate andmissing data are addressed. The methodology is demonstrated usingauthentication data from Los Alamos National Laboratory'senterprise computer network.
AU  - Price-Williams,M
AU  - Heard,N
AU  - Turcotte,M
DO  - 10.1109/EISIC.2017.40
EP  - 90
PY  - 2017///
SP  - 84
TI  - Detecting periodic subsequences in cyber security data
UR  - http://dx.doi.org/10.1109/EISIC.2017.40
ER  -

Download

Professor Nick Heard

Contact

Location

Summary

Citation

BibTex format

RIS format (EndNote, RefMan)