Multi-Type relational clustering for enterprise cyber-security networks
File(s)PRLetters_vanilla[1].pdf (116.02 KB)
Accepted version
Author(s)
Adams, Niall
Riddle-Workman, elizabeth
Evangelou, marina
Type
Journal Article
Abstract
Several cyber-security data sources are collected in enterprise networks providing relational information between different types of nodes in the network, namely computers, users and ports. This relational data can be expressed as adjacency matrices detailing inter-type relationships corresponding to relations between nodes of different types and intra-type relationships showing relationships between nodes of the same type. In this paper, we propose an extension of Non-Negative Matrix Tri-Factorisation (NMTF) to simultaneously cluster nodes based on their intra and inter-type relationships. Existing NMTF based clustering methods suffer from long computational times due to large matrix multiplications. In our approach, we enforce stricter cluster indicator constraints on the factor matrices to circumvent these issues. Additionally, to make our proposed approach less susceptible to variation in results due to random initialisation, we propose a novel initialisation procedure based on Non-Negative Double Singular Value Decomposition for multi-type relational clustering. Finally, a new performance measure suitable for assessing clustering performance on unlabelled multi-type relational data sets is presented. Our algorithm is assessed on both a simulated and real computer network against standard approaches showing its strong performance.
Date Issued
2021-09
Date Acceptance
2021-05-31
Citation
Pattern Recognition Letters, 2021, 149, pp.172-178
ISSN
0167-8655
Publisher
Elsevier
Start Page
172
End Page
178
Journal / Book Title
Pattern Recognition Letters
Volume
149
Copyright Statement
© 2021 Elsevier Ltd. All rights reserved. This manuscript is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International Licence http://creativecommons.org/licenses/by-nc-nd/4.0/
Identifier
https://www.sciencedirect.com/science/article/pii/S0167865521002051
Subjects
Artificial Intelligence & Image Processing
0801 Artificial Intelligence and Image Processing
0906 Electrical and Electronic Engineering
1702 Cognitive Sciences
Publication Status
Published
Date Publish Online
2021-06-15