Imperial College London

Professor Nick Heard

Faculty of Natural SciencesDepartment of Mathematics

Chair in Statistics



+44 (0)20 7594 1490n.heard Website




543Huxley BuildingSouth Kensington Campus






BibTex format

author = {Price-Williams, M and Heard, N and Turcotte, M},
doi = {10.1109/EISIC.2017.40},
pages = {84--90},
title = {Detecting periodic subsequences in cyber security data},
url = {},
year = {2017}

RIS format (EndNote, RefMan)

AB - © 2017 IEEE. Anomaly detection for cyber-security defence hasgarnered much attention in recent years providing an orthogonalapproach to traditional signature-based detection systems.Anomaly detection relies on building probability models ofnormal computer network behaviour and detecting deviationsfrom the model. Most data sets used for cyber-security havea mix of user-driven events and automated network events,which most often appears as polling behaviour. Separating theseautomated events from those caused by human activity is essentialto building good statistical models for anomaly detection. This articlepresents a changepoint detection framework for identifyingautomated network events appearing as periodic subsequences ofevent times. The opening event of each subsequence is interpretedas a human action which then generates an automated, periodicprocess. Difficulties arising from the presence of duplicate andmissing data are addressed. The methodology is demonstrated usingauthentication data from Los Alamos National Laboratory'senterprise computer network.
AU - Price-Williams,M
AU - Heard,N
AU - Turcotte,M
DO - 10.1109/EISIC.2017.40
EP - 90
PY - 2017///
SP - 84
TI - Detecting periodic subsequences in cyber security data
UR -
ER -