IRUS Total

Detecting weak dependence in computer network traffic patterns by using higher criticism

File Description SizeFormat 
main.pdfAccepted version438.84 kBAdobe PDFView/Open
Title: Detecting weak dependence in computer network traffic patterns by using higher criticism
Authors: Price-Williams, M
Heard, N
Rubin-Delanchy, P
Item Type: Journal Article
Abstract: To perform robust statistical anomaly detection in cybersecurity, we must build realistic models of the traffic patterns within a computer network. It is therefore important to understand the dependences between the large number of routinely interacting communication pathways within such a network. Pairs of interacting nodes in any directed communication network can be modelled as point processes where events in a process indicate information being sent between two nodes. For two processes A and B denoting the interactions between two distinct pairs of computers, called edges, we wish to assess whether events in A trigger events then to occur in B. A test is introduced to detect such dependence when only a subset of the events in A exhibit a triggering effect on process B; this test will enable us to detect even weakly correlated edges within a computer network graph. Since computer network events occur as a high frequency data stream, we consider the asymptotics of this problem as the number of events goes to ∞, while the proportion exhibiting dependence goes to 0, and examine the performance of tests that are provably consistent in this framework. An example of how this method can be used to detect genuine causal dependences is provided by using real world event data from the enterprise computer network of Los Alamos National Laboratory.
Issue Date: 1-Apr-2019
Date of Acceptance: 16-Oct-2018
URI: http://hdl.handle.net/10044/1/65590
DOI: https://dx.doi.org/10.1111/rssc.12325
ISSN: 0035-9254
Publisher: Wiley
Start Page: 641
End Page: 655
Journal / Book Title: Journal of the Royal Statistical Society: Series C
Volume: 68
Issue: 3
Copyright Statement: © 2018 Royal Statistical Society.
Sponsor/Funder: GCHQ
Funder's Grant Number: Price-Williams PO-4177302
Keywords: Statistics & Probability
0104 Statistics
Publication Status: Published
Online Publication Date: 2018-11-22
Appears in Collections:Mathematics
Faculty of Natural Sciences

Unless otherwise indicated, items in Spiral are protected by copyright and are licensed under a Creative Commons Attribution NonCommercial NoDerivatives License.

Creative Commons