Statistics and Data Science for Cybersecurity

Abstract

Cybersecurity is an ever-important aspect of our interconnected world, but security defenses lag behind the adversaries who with increasing sophistication seek to disrupt cybersystems. The emergence of massively distributed systems such as the Internet of Things (IoT) has opened up new vulnerabilities that go beyond traditional protective measures such as firewalls, password protection, and single point-of-attack responses. To address these emerging vulnerabilities, data science has much to contribute, including methods of distributed statistical inference, data fusion, anomaly detection, and adversarial machine learning.

Statistical Cybersecurity: A Brief Discussion of Challenges, Data Structures, and Future Directions

“…In the previous section, we noted three common data types in cybersecurity and some of the related statistical challenges. As discussed in Hero et al (2023), one of the main difficulties is the adversarial nature of the problem. Therefore, all the statistical methodologies developed for cybersecurity applications must be resilient to new threats, and adapted when necessary.…”

“…Within this context, Bayesian nonparametric methods could be used as a principled way to model infinite dimensional discrete distributions, providing statistical tools to score events involving previously unseen entities (see, for example, Sanna Zheng et al, 2021). Hero et al (2023), and in other parts of this commentary, data collected in cybersecurity applications tend to be highly complex. Therefore, it is often beneficial to break down the full model for a given data structure into simpler components, at a finer level of granularity.…”

“…We congratulate the authors of Hero et al (2023) for a very interesting and comprehensive review of the current challenges in the field of statistics and data science for cybersecurity applications. In this commentary, we would like to contribute by expanding upon some of the points raised by the authors in their Section 3, "Data-Driven Cybersecurity for Enterprise Systems," describing some of the challenges faced by statisticians working in cybersecurity, in particular regarding data structures, and emphasising directions for future work and research in statistical modeling for cybersecurity.…”

“…As Hero et al (2023) point out, statistical modeling currently represents the main tool for anomaly-based detection, which looks for deviations from a model of the normal behavior of the network (see, for example, Chandola et al, 2009). As discussed in the article, statistical models have the main advantage of being able to assign anomaly scores to previously unseen events, by borrowing strength between different users, hosts, and processes.…”

Challenges for Anomaly Detection in Large-Scale Cyber-Physical Systems

“…The authors of the Hero et al (2023) article should be congratulated for their nice overview of problems and challenges arising from cybersecurity threats in large enterprise systems, and the role of statistical and data science methods to address them. The broad methodological thrusts discussed include distributed statistical inference, data fusion, anomaly detection, and adversarial machine learning.…”