Data Analytics and Decision Support for Cyber security

278 Pages·2017·6.38 MB·English

Data Analytics
Iván Palomares Carrascosa
Harsha Kumara Kalutarage
Yan Huang Editors
Data Analytics
and Decision
Support for
Cybersecurity
Data Analytics
Serieseditors
LongbingCao,AdvancedAnalyticsInstitute,UniversityofTechnology,Sydney,
Broadway,NSW,Australia
PhilipS.Yu,UniversityofIllinoisatChicago,Chicago,IL,USA
AimsandGoals:
Building and promoting the field of data science and analytics in terms of
publishing work on theoretical foundations, algorithms and models, evaluation
and experiments, applications and systems, case studies, and applied analytics in
specificdomainsoronspecificissues.
SpecificTopics:
This series encourages proposals on cutting-edge science, technology and best
practicesinthefollowingtopics(butnotlimitedto):
Data analytics, data science, knowledge discovery, machine learning, big data,
statisticalandmathematicalmethodsfordataandappliedanalytics,
New scientific findings and progress ranging from data capture, creation, storage,
search,sharing,analysis,andvisualization,
Integration methods, best practices and typical examples across heterogeneous,
interdependent complex resources and modals for real-time decision-making,
collaboration,andvaluecreation.
Moreinformationaboutthisseriesathttp://www.springer.com/series/15063
Iván Palomares Carrascosa
Harsha Kumara Kalutarage • Yan Huang
Editors
Data Analytics and Decision
Support for Cybersecurity
Trends, Methodologies and Applications
123
Editors
IvánPalomaresCarrascosa HarshaKumaraKalutarage
UniversityofBristol CentreforSecureInformationTechnologies
Bristol,UK Queen’sUniversityofBelfast
Belfast,UK
YanHuang
Queen’sUniversityBelfast
Belfast,UK
ISSN2520-1859 ISSN2520-1867 (electronic)
DataAnalytics
ISBN978-3-319-59438-5 ISBN978-3-319-59439-2 (eBook)
DOI10.1007/978-3-319-59439-2
LibraryofCongressControlNumber:2017946318
©SpringerInternationalPublishingAG2017
Thisworkissubjecttocopyright.AllrightsarereservedbythePublisher,whetherthewholeorpartof
thematerialisconcerned,specificallytherightsoftranslation,reprinting,reuseofillustrations,recitation,
broadcasting,reproductiononmicrofilmsorinanyotherphysicalway,andtransmissionorinformation
storageandretrieval,electronicadaptation,computersoftware,orbysimilarordissimilarmethodology
nowknownorhereafterdeveloped.
Theuseofgeneraldescriptivenames,registerednames,trademarks,servicemarks,etc.inthispublication
doesnotimply,evenintheabsenceofaspecificstatement,thatsuchnamesareexemptfromtherelevant
protectivelawsandregulationsandthereforefreeforgeneraluse.
Thepublisher,theauthorsandtheeditorsaresafetoassumethattheadviceandinformationinthisbook
arebelievedtobetrueandaccurateatthedateofpublication.Neitherthepublishernortheauthorsor
theeditorsgiveawarranty,expressorimplied,withrespecttothematerialcontainedhereinorforany
errorsoromissionsthatmayhavebeenmade.Thepublisherremainsneutralwithregardtojurisdictional
claimsinpublishedmapsandinstitutionalaffiliations.
Printedonacid-freepaper
ThisSpringerimprintispublishedbySpringerNature
TheregisteredcompanyisSpringerInternationalPublishingAG
Theregisteredcompanyaddressis:Gewerbestrasse11,6330Cham,Switzerland
Preface
Cybersecurity has been classically understood as the protection of any form of
information potentially exposed in the Internet. This notion of cybersecurity has
progressively evolved towards an umbrella term, covering a broad range of areas
concerning the protection of hardware, software, networks and their underlying
information and considering the socio-economic, legal and ethical impact that
failingtoguaranteesuchprotectionmaycauseonsystems,dataandusers.Avital
aspect of cybersecurity is to ensure that confidentiality, integrity and availability
requirementsaremetforassetsandtheirrelatedusers.
Bothunderadevelopmentalandresearchperspective,cybersecurityhasundoubt-
edly attained an enormous importance within the last few years. This is largely a
consequence of the massive growth experienced by available data in cyber space,
in their volume, value, heterogeneity and, importantly, degree of exposure. This
explosion of accessible data with diverse nature accentuates the potential—and
sometimes critical—vulnerability of the information harboured by them. Specifi-
cally,suchvulnerabilitiesbecomecriticalwhenvaluableinformationorknowledge
might be illegitimately accessed by the wrong person/s (e.g. attackers) with
malicious purposes. Unsurprisingly, both researchers and practitioners presently
show an increasing interest in defining, developing and deploying computational
andartificialintelligence(AI)-basedapproachesasthedrivingforcetowardsamore
cyber-resilientsociety.
Withtheadventofbigdataparadigmsinthelastfewyears,therehasbeenarise
in data science approaches, raising in parallel a higher demand for effective data-
drivenmodelsthatsupportdecision-makingatastrategiclevel.Thismotivatesthe
needfordefiningnoveldataanalyticsanddecisionsupportapproachesinamyriad
of real-life scenarios and problems, with cybersecurity-related domains being no
exception.Forinstance,Fig.1illustratestheinterrelationshipbetweenseveraldata
management, analytics and decision support techniques and methods commonly
adoptedincybersecurity-orientedframeworksinthelastyears.
This edited volume comprises nine chapters, covering a compilation of recent
advancesincybersecurity-relatedapplicationsofdataanalyticsanddecisionsupport
approaches.Besidestheoreticalstudiesandoverviewsofexistingrelevantliterature,
v
vi Preface
Human MULTI-CRITERIA
VISUALISATION review DECISION MAKING
MONITORING 3. Decision RISK ANALYSIS
Support
Domain-specific extracted knowledge
INCOMPLETE
INFORMATION
MANAGEMENT
UNCERTAINTY 2. Analytics
HANDLING
Aggregated/pre-processed information
FEATURE
DATA SELECTION
FUSION
1. Data Management
Social Network Network Traffic Data User Applications Data
S
E
C
R
U
O (...)
S
A
T
A
D
S
R
O
ECT GOVERNMENT FINANCE ENFOLRACWEMENT INSURANCE
S
Fig.1 Overviewofdataanalyticsanddecisionsupportprocessesandtechniquesincybersecurity
scenarios
this book comprises a number of highly application-oriented research chapters.
Theinvestigationsundertakenacrossthesechaptersfocusondiversecybersecurity
problemsandscenariossituatedatforefrontdirectionsofinterestbyacademicsand
professionals.Theultimatepurposeofthisvolumeistwofold:
1. To bring together and disseminate some important “lessons learnt” within a
youngbutsurprisinglyrapidfield
2. To emphasize the increasing importance that data science and AI techniques
(particularly those related to machine learning, data visualization and decision
support)areattainingtoovercomethemajorlimitationsandchallengescurrently
arisingintheITsecuritylandscape
Therefore, this book joins ideas and discussions from leading experts in these
rapidlygrowingfields,inordertoalignkeydirectionsofworkthatresearchersand
professionalsalikewouldbeencouragedtofollowtofurtherconsolidatesuchfields.
Preface vii
Part I—Regular Chapters The first seven chapters present both theoretical
and practical-industrial contributions related to emergent cybersecurity research.
Particular emphasis is put on data analysis approaches and their relationship with
decision-making and visualization techniques to provide reliable decision support
tools.
In Chap.1 [1], Markus Ring et al. present a novel toolset for anomaly-based
network intrusion detection. Motivated by challenges that frequently hinder the
applicability of anomaly-based intrusion detection systems in real-world settings,
the authors propose a flexible framework comprising of diverse data mining
algorithms.Theirapproachappliesonlineanalysisuponflow-baseddatadescribing
meta-information about network communications, along with domain knowledge
extraction, to augment the value of network information before analysing it under
multipleperspectives.Toovercometheproblemofdataavailability,theframework
is also conceived to emulate realistic user activity—with a particular focus on the
insiderthreatproblem—andgeneratereadilyavailableflow-baseddata.
Legg reflects in Chap.2 [2] on the problem of detecting insider threats in
organizationsandmajorchallengesfacedbyinsiderthreatdetectionsystems,such
as the difficulty to reduce false alarms. The chapter investigates the importance of
combiningvisualanalyticsapproaches withmachinelearningmethodstoenhance
an iterative process of mutual feedback between detection system and human
analyst, so as to rationally capture the dynamic—and continuously evolving—
boundaries between normal and insider behaviours and make informed decisions.
In this work, the author demonstrates how generated visual knowledge can signif-
icantlyhelpanalyststoreasonandmakeoptimaldecisions.Thechapterconcludes
withadiscussionthatalignscurrentchallengesandfuturedirectionsofresearchon
theinsiderthreatproblem.
Malware detection is no longer a problem pertaining to desktop computer
systemssolely.Withtheenormousriseofmobiledevicetechnologies,thepresence
andimpactofmalwarehaverapidlyexpandedtothemobilecomputingpanorama.
Ma˘riucaetal.inChap.3[3]reportonAndroidmobilesystemsasapotentiallymajor
targetforcollusionattacks,i.e.attacksthatresultby“combining”permissionsfrom
multipleappstopavethewayforattackerstoundertakeseriousthreats.Theauthors
presenttwoanalysismethodstoassessthepotentialdangerofappsthatmaybecome
partofacollusionattack.Appsassessedassuspiciousaresubsequentlyanalysedin
further detail to confirm whether an actual collusion exists. Previous work by the
authorsisadoptedasaguidelinetoprovideageneraloverviewofthestate-of-the-
artresearchinappcollusionanalysis.
In Chap.4 [4], Carlin et al. focus on a recent strategy to fight against the
devastating effects of malware: the dynamic analysis of run-time opcodes. An
opcode is a low-level and human-readable machine language instruction, and it
can be obtained by disassembling the software program being analyzed. Carlin
et al. demonstrate in their work the benefits of dynamic opcode analysis to
detectmalicioussoftwarewithasignificantaccuracyinrealpracticalapplications.
One of such notable advantages is the ability of dynamic analysis techniques
to observe malware behaviour at runtime. The model presented by the authors,
whichusesn-gramanalysisonextractedopcodes,isvalidatedthroughalargedata
viii Preface
set containing highly representative malware instances. Results show a superior
malwareclassificationaccuracy,whencomparedwithprevioussimilarresearch.
Moustafaetal.inChap.5[5]presentascalableandlightweightintrusiondetec-
tionsystemframework,characterizedbyusingastatisticaldecision-makingengine
to identify suspicious patterns of activity in network systems. This framework
recognizes abnormal network behaviours predicated on the density characteristics
of generated statistical distributions, namely, Dirichlet distributions. The authors
illustratehowstatisticalanalysisbasedonlower-upperinterquartilerangeshelpsin
unveilingthenormalitypatternsinthenetworkdatabeinganalysed.Consequently,
normalitypatternsallowtoflexiblydefineasuitablestatisticalmodeltoclassifythe
dataathand,thusmakingclassificationdecisionsmoreintelligently.Aperformance
evaluationandacomparativestudyareconductedbyusingtwodatasets,showing
thattheproposedframeworkoutperformsothersimilartechniques.
Chapter 6 [6] shows the vital role of cybersecurity in e-learning systems,
particularly when it comes to ensuring robust and reliable student assessment
processes online. Sabbah presents in this chapter two frameworks for overcoming
cheating in e-examination processes. The reliability of both systems is tested and
validated, showing how both of them outperform existing approaches in terms of
riskanalysis.Avarietyofcheating actionsandviolations arecarefullyconsidered
in the multi-stage design of the cheating detection system architectures such as
impersonation during an e-Examination, messaging patterns and webcam actions.
Biometricauthentication(e.g.viafingerprints)isadoptedasareliableauthentication
methodtoensurecheating-freeexaminations.
Classification techniques undeniably play a major role in many cybersecurity-
orienteddataanalyticsapproaches.Noisydatahavelongbeendeemedaninfluential
factorintheaccuracyanderrorratesofclassificationmodels.InChap.7[7],Indika
revisits a number of popular classification approaches—support vector machines,
principalcomponentanalyticsandrandomforestensembles—andpresentsacom-
parative study of them, under the perspective of noisy data and its impact on
classification accuracy. The author introduces in this chapter a noise removal
algorithmandalsoanalyseshowskewness,appropriatesampleratiosandthechosen
classificationtechniquejointlyinfluencetheoverallclassificationperformance.
Part II—Invited Chapters Besides the regular book chapters outlined above,
this book also provides two invited chapters authored by scientists endowed with
promising research trajectories in IT security, data analytics and decision support
approaches, as well as engagement experience with industry and public sectors to
joinforcesagainstcurrentcybersecuritychallenges.
InChap.8[8],AlamaniotisandTsoukalashighlightthecentralrolethatcyberse-
curityapproachesshouldplayinlarge-scalesmartpowersystemssuchasSCADA
systems. Power consumption and forecasting information have been identified
as key indicators for detecting cyber-attacks in these contexts. Based on this,
AlamaniotisandTsoukalaspresentanintelligentsystemmethodbasedonGaussian
process regression and fuzzy logic inference, aimed at analysing, reasoning and
learning from load demand information in smart grids. The underlying statistical
Preface ix
andfuzzyreasoningprocessallowsthesystemtomakehighlyconfidentdecisions
autonomously as to whether current levels of power load demands are legitimated
ormanipulationbyanattackeristakingplace.
Garae and Ko provide in Chap.9 [9] an insightful closure to this book, with
a comprehensive overview of analytics approaches based on data provenance,
effective security visualization techniques, cybersecurity standards and decision
support applications. In their study, Garae and Ko investigate the notion of data
provenance as the ability of tracking data from its conception to its deletion
and reconstructing its provenance as a means to explore cyber-attack patterns.
The authors argue on the potential benefits of integrating data provenance and
visualizationtechniquestoanalysedataandsupportdecision-makinginITsecurity
scenarios. They also present a novel security visualization standard describing its
majorguidelinesandlawenforcementimplicationsindetail.
For ease of reference, the table below summarizes the techniques covered and
cybersecuritydomainstargetedbyeachoneofthechapterscomprisingthebook.
Technique(s)covered Cybersecuritydomain
Chapter1:MarkusRingetal. Streamdataanalytics Intrusiondetection
Classification,clustering Insiderthreats
Datavisualization
Chapter2:PhilipA.Legg Human-machinesystems Insiderthreats
Decisionsupport
Datavisualization
Chapter3:IrinaMa˘riuca Mobilecomputing Androidappcollusiondetection
Asa˘voaeetal. First-orderlogic
Probabilisticmodels
Softwaremodelchecking
Chapter4:DomhnallCarlin Dynamicopcodeanalysis Runtimemalwaredetection
etal. n-Gramanalysis
Chapter5:NourMoustafaetal. Statisticaldecisionmodels Intrusiondetection
Normalityanalysis
Chapter6:YousefW.Sabbah Multi-modaldataanalysis e-Learning
Authenticationmethods Onlineexaminations
Chapter7:R.Indika Classification(SVM,PCA) Cybersecuritynoisydataremoval
P.Wickramasinghe Ensembleclassifiers
Noisydatamanagement
Chapter8:MiltiadisAlamaniotis Gaussianprocessregression Securesmartpowersystems
andLefteriH.Tsoukalas Fuzzylogicinference
Chapter9:JefferyGaraeand Dataprovenance Securityvisualizationand
RyanK.L.Ko Datavisualizationstandardsmonitoring
x Preface
We would like to thank Springer editorial assistants for the confidence put in
this book and their continuous support in materializing it before, during and after
its elaboration. We are also very grateful to the authors of selected chapters for
their efforts during the preparation of the volume. Without their valuable ideas
and contributions, finishing this project would not have been possible. Likewise,
we acknowledge all the scientists and cybersecurity experts who generously vol-
unteered in reviewing the chapters included in the book. Finally, we would like
to express our special thanks to Dr. Robert McCausland, principal engineer and
R&DmanagerintheCentreforSecureInformationTechnologies(CSIT),(Queen’s
UniversityBelfast),forfirmlybelievinginourinitiativeandstronglysupportingit
sinceitsinception.
Bristol,UK IvánPalomaresCarrascosa
Belfast,UK HarshaKumaraKalutarage
Belfast,UK YanHuang
April2017
References
1.MarkusRing,SarahWunderlich,DominikGrüdl,DieterLandes,AndreasHotho.AToolsetfor
IntrusionandInsiderThreatDetection.
2.P.A.Legg.Human-MachineDecisionSupportSystemsforInsiderThreatDetection.
3.I.Ma˘riuca.J.Blasco,T.M.Chen,H.K.Kalutarage,I.Muttik,H.N.Nguyen,M.Roggenbach,
S.A.Shaikh.Detectingmaliciouscollusionbetweenmobilesoftwareapplications-theAndroid
case.
4.D.Carlin,P.O’Kane,S.Sezer.DynamicAnalysisofMalwareusingRun-TimeOpcodes.
5.N.Moustafa,G.Creech,J.Slay.BigDataAnalyticsforIntrusionDetectionSystems:Statistical
Decision-MakingusingFiniteDirichletMixtureModels.
6.Y.Sabbah.SecurityofOnlineExaminations.
7.R. Indika P. Wickramasinghe. Attribute Noise, Classification Technique and Classification
Accuracy:AComparativeStudy.
8.M. Alamaniotis, L.H. Tsoukalas. Learning from Loads: An Intelligent System for Decision
SupportinIdentifyingNodalLoadDisturbancesofCyber-AttacksinSmartPowerSystemsusing
GaussianProcessesandFuzzyInference.
9.J.Garae,R.Ko.VisualizationandDataProvenanceTrendsinDecisionSupportforCybersecu-
rity.