用于网络态势感知的方向拉普拉斯中心性
Directional Laplacian Centrality for Cyber Situational Awareness
摘要：
网络操作淹没在多样化、高容量、多源数据中。为了全面了解当前的操作并识别恶意事件和行为者，分析师必须通过人类活动和良性自动化流程的混合生成的数据。虽然存在许多监控和警报系统，但它们通常使用基于签名的检测方法。我们引入了一个通用的方法植根于谱图理论发现模式和异常，而无需先验知识的签名。我们推导并提出了一个新的图论中心性测度的基础上的衍生物的图形拉普拉斯矩阵的顶点方向。为了建立对我们的度量的直觉，我们展示了它如何识别标准网络数据集中的最中心顶点，并与其他图中心性度量进行比较。最后，我们专注于研究它在识别网络流数据中的重要IP地址的有效性。使用真实的和合成的网络流数据，我们进行了几个实验，以测试我们的措施的敏感性，两种类型的注入攻击配置文件，并显示顶点参与注入攻击配置文件表现出显着的变化，在我们的中心性措施，即使当注入的异常相对较小，并在存在模拟的网络动态。
英文摘要：
Cyber operations is drowning in diverse, high-volume, multi-source data. In order to get a full picture of current operations and identify malicious events and actors analysts must see through data generated by a mix of human activity and benign automated processes. Although many monitoring and alert systems exist, they typically use signature-based detection methods. We introduce a general method rooted in spectral graph theory to discover patterns and anomalies without a priori knowledge of signatures. We derive and propose a new graph-theoretic centrality measure based on the derivative of the graph Laplacian matrix in the direction of a vertex. To build intuition about our measure we show how it identifies the most central vertices in standard network data sets and compare to other graph centrality measures. Finally, we focus our attention on studying its effectiveness in identifying important IP addresses in network flow data. Using both real and synthetic network flow data, we conduct several experiments to test our measure's sensitivity to two types of injected attack profiles, and show that vertices participating in injected attack profiles exhibit noticeable changes in our centrality measures, even when the injected anomalies are relatively small, and in the presence of simulated network dynamics.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
