Statistical language analysis for automatic exfiltration event detection.

Robinson, David Gerald

Sandia National Laboratories

关键词: Decision Making;    Hazards;    99 General And Miscellaneous//Mathematics, Computing, And Information Science;    Processing;    Security Personnel;   

DOI  :  10.2172/983675
RP-ID  :  SAND2010-2179
RP-ID  :  AC04-94AL85000
RP-ID  :  983675

美国|英语

来源: UNT Digital Library

【 摘 要 】

This paper discusses the recent development a statistical approach for the automatic identification of anomalous network activity that is characteristic of exfiltration events. This approach is based on the language processing method eferred to as latent dirichlet allocation (LDA). Cyber security experts currently depend heavily on a rule-based framework for initial detection of suspect network events. The application of the rule set typically results in an extensive list of uspect network events that are then further explored manually for suspicious activity. The ability to identify anomalous network events is heavily dependent on the experience of the security personnel wading through the network log. Limitations f this approach are clear: rule-based systems only apply to exfiltration behavior that has previously been observed, and experienced cyber security personnel are rare commodities. Since the new methodology is not a discrete rule-based pproach, it is more difficult for an insider to disguise the exfiltration events. A further benefit is that the methodology provides a risk-based approach that can be implemented in a continuous, dynamic or evolutionary fashion. This permits uspect network activity to be identified early with a quantifiable risk associated with decision making when responding to suspicious activity.