Data analysis for network cyber-security

de Niall M. Adams, Nicholas Heard

There is increasing pressure to protect computer networks against unauthorized intrusion, and some work in this area is concerned with engineering systems that are robust to attack. However, no system can be made invulnerable. Data Analysis for Network Cyber-Security focuses on monitoring and analyzing network traffic data, with the intention of preventing, or quickly identifying, malicious activity. Such work involves the intersection of statistics, data mining and computer science. Fundamentally, network traffic is relational, embodying a link between devices. As such, graph analysis approaches are a natural candidate. However, such methods do not scale well to the demands of real problems, and the critical aspect of the timing of communications events is not accounted for in these approaches. The contributors are from diverse institutions and attended a workshop held at the University of Bristol in March 2013 to address the issues of network cyber-security. The workshop was supported by the Heilbronn Institute for Mathematical research (HIMR, University of Bristol).