Imperial College London

Professor Nick Heard

Faculty of Natural SciencesDepartment of Mathematics

Chair in Statistics
 
 
 
//

Contact

 

+44 (0)20 7594 1490n.heard Website

 
 
//

Location

 

543Huxley BuildingSouth Kensington Campus

//

Summary

 

Publications

Citation

BibTex format

@inproceedings{Price-Williams:2017:10.1109/EISIC.2017.40,
author = {Price-Williams, M and Heard, N and Turcotte, M},
doi = {10.1109/EISIC.2017.40},
pages = {84--90},
title = {Detecting periodic subsequences in cyber security data},
url = {http://dx.doi.org/10.1109/EISIC.2017.40},
year = {2017}
}

RIS format (EndNote, RefMan)

TY  - CPAPER
AB - © 2017 IEEE. Anomaly detection for cyber-security defence hasgarnered much attention in recent years providing an orthogonalapproach to traditional signature-based detection systems.Anomaly detection relies on building probability models ofnormal computer network behaviour and detecting deviationsfrom the model. Most data sets used for cyber-security havea mix of user-driven events and automated network events,which most often appears as polling behaviour. Separating theseautomated events from those caused by human activity is essentialto building good statistical models for anomaly detection. This articlepresents a changepoint detection framework for identifyingautomated network events appearing as periodic subsequences ofevent times. The opening event of each subsequence is interpretedas a human action which then generates an automated, periodicprocess. Difficulties arising from the presence of duplicate andmissing data are addressed. The methodology is demonstrated usingauthentication data from Los Alamos National Laboratory'senterprise computer network.
AU - Price-Williams,M
AU - Heard,N
AU - Turcotte,M
DO - 10.1109/EISIC.2017.40
EP - 90
PY - 2017///
SP - 84
TI - Detecting periodic subsequences in cyber security data
UR - http://dx.doi.org/10.1109/EISIC.2017.40
ER -