Modelling dynamic network evolution as a Pitman-Yor process

Abstract

Dynamic interaction networks frequently arise in biology, communications technology and the social sciences, representing, for example, neuronal connectivity in the brain, internet connections between computers and human interactions within social networks. The evolution and strengthening of the links in such networks can be observed through sequences of connection events occurring between network nodes over time. In some of these applications, the identity and size of the network may be unknown a priori and may change over time. In this article, a model for the evolution of dynamic networks based on the Pitman-Yor process is proposed. This model explicitly admits power-laws in the number of connections on each edge, often present in real world networks, and, for careful choices of the parameters, power-laws for the degree distribution of the nodes. A novel empirical method for the estimation of the hyperparameters of the Pitman-Yor process is proposed, and some necessary corrections for uniform discrete base distributions are carefully addressed. The methodology is tested on synthetic data and in an anomaly detection study on the enterprise computer network of the Los Alamos National Laboratory, and successfully detects connections from a red-team penetration test.2010 Mathematics Subject Classification. Primary: 90B15; Secondary: 91D30.

Bayesian Models Applied to Cyber Security Anomaly Detection Problems

“…From a Bayesian perspective, some scalable approaches have been designed for modelling and detecting anomalies in cyber security applications. Examples of these include the following: Clausen et al (2018), where a Markov-modulated Poisson process embedded in a fast and scalable Bayesian framework was used in the modelling for network flow data; Chen et al (2018), where a novel class of Bayesian dynamic models was introduced and applied to Internet traffic and, according to the authors, the sequential analysis is fast, scalable and efficient; Muñoz González et al (2017) explored two methods for scalable inference on Bayesian attack graphs; other models like the one described in Rubin-Delanchy (2016) andin Sanna Passino & are fully parallelisable and suitable for platforms designed for Big Data analysis like Hadoop.…”

“…These scores are then used to rank the computers and, in the case of the compromised ones, a high anomaly score should be assigned. In Table 4, we present the results that obtained in Heard & Rubin‐Delanchy (2016) with the DP p values aggregated using Fisher's method (Fisher, 1934) and the best results obtained in Sanna Passino & Heard (2019) with the PY mid p values aggregated using Pearson's method (Pearson, 1933).…”

“…Working along this line, in Sanna Passino & Heard (2019), the authors examined a joint model of a sequence of computer network links , with x i and y i representing the source and destination computer respectively, based on the Pitman–Yor process (PY) (Perman et al ., 1992). The PY process, also known as the two‐parameter Poisson–Dirichlet process, requires two parameters that are usually denoted by σ ∈ [0, 1) (the discount parameter) and θ > − σ (the strength parameter).…”

“…The task is to identify the unusual activity occurring and flag these computers. These connections between source and destination nodes can be modelled as a bipartite graph, and hence, we could use the model proposed in Heard & Rubin‐Delanchy (2016) or Sanna Passino & Heard (2019) in order to identify the compromised computers. As described in Section 4.2.4, these models allow us to quantify the surprise of each new connection through the p values or mid p values, which are then aggregated for each source computer to have a unique score.…”

“…In Sanna Passino & Heard (2019), the joint modelling of p ( x , y ) is achieved through the decomposition p ( x | y ) p ( y ) by assuming the sequence of destination nodes, { y i }, to be exchangeable with a hierarchical PY distribution and conditioned on the destination node the sequence of source nodes connecting to that destination, { x i | y }, are also exchangeable with a hierarchical PY distribution with parameters depending on y . As for the detection procedure, it follows the same reasoning as in Heard & Rubin‐Delanchy (2016), that is, for each source computer, one needs to obtain the predictive p values and combine them into a single score.…”