Multiple Temporal Cluster Detection

Molinari, Nicolas; Bonaldi, Christophe; Daurès, Jean‐Pierre

doi:10.1111/j.0006-341x.2001.00577.x

Cited by 25 publications

(49 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…While surprisingly few methods directly address the problem of detecting and testing for bursting, a wide variety of methods have been developed for detecting and analyzing spatial clustering, particularly in the geostatistical literature (see, e.g., [19], [20], [21], [22], [23]), where the detection problem often involves rare events such as uncommon diseases hypothesized to be precipitated by some common local cause [24], [25], [26], [27]. Due to the complications involved in precisely localizing the occurrence of a specific medical incident, much of the recent work in that area focuses on mitigating the bias inflicted by the need to aggregate over complex, irregular, and arbitrary spatial domains (e.g., geographic counties) [19], [22], [23], [27], introducing complications that are not germane to our problem, in which we have exact observations of arrival times of events.…”

Section: A Approaches To Analysis Of Clustering and Burstinessmentioning

confidence: 99%

Burstiness of Intrusion Detection Process: Empirical Evidence and a Modeling Approach

Harang

Kott

2017

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Abstract-We analyze sets of intrusion detection records observed on the networks of several large, nonresidential organizations protected by a form of intrusion detection and prevention service. Our analyses reveal that the process of intrusion detection in these networks exhibits a significant degree of burstiness as well as strong memory, with burstiness and memory properties that are comparable to those of natural processes driven by threshold effects, but different from bursty human activities. We explore time-series models of these observable network security incidents based on partially observed data using a hidden Markov model with restricted hidden states, which we fit using Markov Chain Monte Carlo techniques. We examine the output of the fitted model with respect to its statistical properties and demonstrate that the model adequately accounts for intrinsic "bursting" within observed network incidents as a result of alternation between two or more stochastic processes. While our analysis does not lead directly to new detection capabilities, the practical implications of gaining better understanding of the observed burstiness are significant, and include opportunities for quantifying a network's risks and defensive efforts.Index Terms-bursty processes, cyber risk assessment, cyber security, estimating undetected malware, malware detection model, predictive models for cyber intrusions I. INTRODUCTION AND MOTIVATION A. MotivationWe explore approaches to modeling the detection process of cyber infections, i.e., presence of malicious softwaremalware -on a computer network. Often, this process is performed by a specialized organization -Managed Security Service Provider (MSSP) [1] -that monitors computer networks, analyzes the information obtained from the network, detects intrusions and activities of malware on the network, and reports such detections to the operators of the network who then take measures necessary to recover from the intrusion. As this research is based on empirical data provided to authors by a MSSP covering several large, non-residential networks, hereafter we use the term MSSP when referring to a network's cyber defenders.

show abstract

Section: A Approaches To Analysis Of Clustering and Burstinessmentioning

confidence: 99%

Burstiness of Intrusion Detection Process: Empirical Evidence and a Modeling Approach

Harang

Kott

2017

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…17 This method does not impose to divide the period. It detects time windows with excess events and is effective with multiple clusters.…”

Section: Methodsmentioning

confidence: 99%

“…17 Each data set was first transformed to produce values corresponding to the time between successive cases. These values were estimated using a constant under the nonclustering, or random, hypothesis.…”

Section: Methodsmentioning

confidence: 99%