Towards a network-of-networks framework for cyber security

Abstract

Networks-of-networks (NoN) is a graph-theoretic model of interdependent networks that have distinct dynamics at each network (layer). By adding special edges to represent relationships between nodes in different layers, NoN provides a unified mechanism to study interdependent systems intertwined in a complex relationship. While NoN based models have been proposed for cyber-physical systems, in this position paper we build towards a three-layered NoN model for an enterprise cyber system. Each layer captures a different facet of a cyber system. We present in-depth discussion for four major graphtheoretic applications to demonstrate how the three-layered NoN model can be leveraged for continuous system monitoring and mission assurance.

Research and Construction Model of Cyberspace Based on Hypergraph

“…Including different critical infrastructure networks, cyberspace is a multi-layer network of network [8] . Through decomposition, cyberspace model can uniformly describe homogeneous and heterogeneous entities interacting with their complex relationships in multi-layer cyberspace.…”

“…However, a graph can only capture binary relations between homogeneous entities [8] , it is not able to distinguish between heterogeneous entities and different types of entity relationships in cyberspace. Cyberspace covers from network equipment, physical environment, to people and organization.…”

GraphPrints: Towards a Graph Analytic Method for Network Anomaly Detection

“…Furthermore, we color an edge blue if at least one of the ports is well known (i.e., less than 1024) and red if both ports are not well known (1024 or greater). 2 Since multiple flows can occur between the same pair of IPs in the time interval, H is a multi-digraph, meaning it admits multiple edges between any pair of vertices, and we aggregate the multi-edges to create the desired graph, G. Specifically, for each source vertex i and destination vertex j of H, let Bi,j (Ri,j) be the sum of edge weights, total bytes, over the blue (red) edges from i to j. If Bi,j > Ri,j (Ri,j ≥ Bi,j), create a blue (red) edge from i to j in G. Thus our final graph, G, has colored,…”

“…We note that the idea for multi-level anomaly detection on time-varying graph data follows contributions of Bridges et al [1], which create a generative model for detection on synthetic graph data at node, community, and whole graph levels. Additionally, a position paper of Halappanavar et al [2] outlines a network-of-network design for cyber security applications and calls for graphlet analysis of flow data, but to our knowledge no implementation of these ideas has yet been pursued.…”

An Event-Based Method of Construction of Cyberspace Models

“…We adopt the later solution as the former solution is perfect but no feasible. In real cyber environment, cyberspace is a network of network [7] . Form the horizontal view, cyberspace consists many network such as telecommunications networks, computer systems, and embedded processors and controllers [1] .…”