Page 151 - First special issue on The impact of Artificial Intelligence on communication networks and services

,78 -2851$/ ,&7 'LVFRYHULHV 9RO 0DUFK

CORRELATION AND DEPENDENCE ANALYSIS ON CYBERTHREAT ALERTS

-RKQ 0 $ %RWKRV .RQVWDQWLQRV *HRUJLRV 7KDQRV 'LPLWULV 0 .\ULD]DQRV *HRUJH 9DUGRXOLDV
$QGUHDV =DORQLV (LULQL 3DSDGRSRXORX <DQQLV &RURYHVLV 6WHOLRV & $ 7KRPRSRXORV
1DWLRQDO &HQWUH IRU 6FLHQWLILF 5HVHDUFK ³'HPRNULWRV´ 1&65' *UHHFH

Abstract – In this paper a methodology for the enhancement of computer networks’ cyber-defense is presented.
Using a time-series dataset, drawn for a 60-day period and for 12 hours per day and depicting the occurrences of
cyberthreat alerts at hourly intervals, the correlation and dependency coefficients that occur in an organization’s
network between different types of cyberthreat alerts are determined. Certain mathematical methods like the
Spearman correlation coefficient and the Poisson regression stochastic model are used. For certain types of
cyberthreat alerts, results show a significant positive correlation and dependence between them. The analysis
methodology presented could help the administrative and IT managers of an organization to implement
organizational policies forcybersecurity.

Keywords ± &RUUHODWLRQV F\EHUDWWDFNV GHSHQGHQFLHV QHWZRUN WLPH VHULHV

1. INTRODUCTION 5HVHDUFK RQ F\EHUDWWDFN SDWWHUQ UHFRJQLWLRQ LQ QHWZRUN
WUDIILF KDV EHHQ JRLQJ RQ IRU TXLWH VRPH WLPH 5HOHYDQW
7RGD\ PRVW RUJDQL]DWLRQV LQ WKH ZRUOG KHDYLO\ GHSHQG UHVHDUFK DSSURDFKHV KDYH EHHQ PDGH LQ WKH VFRSH RI
RQ ,7 LQIUDVWUXFWXUH VXFK DV FRPSXWHU QHWZRUNV ILQGLQJ VDWLVIDFWRU\ SUHGLFWLQJ PDWKHPDWLFDO PRGHOV
VHUYHUV GDWDEDVHV DQG LQIRUPDWLRQ V\VWHPV WR FDUU\ RXW IRU VXFK LQFLGHQWV (PSLULFDO PRGHOOLQJ RI F\EHU DOHUWV
WKHLU GDLO\ DFWLYLWLHV 7KLV LQIUDVWUXFWXUH KDV EHHQ WKH UHODWHV PDLQO\ WR WKH VWXG\ RI WLPH VHULHV PRGHOV IRU
WDUJHW RI F\EHUDWWDFNV ZKLFK DLP WR GLVUXSW WKH DELOLW\ HIILFLHQW IRUHFDVWLQJ RI F\EHUDWWDFNV ,Q > @ 0DUNRY
RI DQ RUJDQL]DWLRQ WR SHUIRUP LWV DFWLYLWLHV VWHDO GDWD RU PRGHOV RQ WLPH VHULHV GDWD RI FRPPXQLFDWLRQV ZHUH
HYHQ SXW LW RXW RI EXVLQHVV $FFRUGLQJ WR > @ DQG > @ XVHG WR KLJKOLJKW WKH LPSRUWDQFH RI GHWHFWLQJ W\SHV RI
DIWHU D VHFXULW\ EUHDFK RUJDQL]DWLRQV DUH DIIHFWHG LQ DQRPDOLHV LQ D FRPSXWHU QHWZRUN WUDIILF IORZ LQ
ILHOGV VXFK DV RSHUDWLRQV ILQDQFH V\VWHPV EUDQG LGHQWLI\LQJ W\SHV RI LQWUXVLRQV LQ WKH QHWZRUN ,Q > @
UHSXWDWLRQ DQG FXVWRPHU UHWHQWLRQ &\EHUDWWDFNV FDXVH DQG > @ $5),0$ DQG ),*$5&+ PRGHOV ZHUH XVHG RQ
YDULRXV GLUHFW RU KLGGHQ FRVWV WR DQ RUJDQL]DWLRQ¶V WLPH VHULHV GDWD RI QHWZRUN WUDIILF WR SUHGLFW ZKHWKHU
WDQJLEOH DQG LQWDQJLEOH DVVHWV MHRSDUGL]LQJ HYHQ LWV GHWHFWHG DQRPDOLHV DUH LQGLFDWLRQV RI UHDO F\EHUDWWDFNV
VXVWDLQDELOLW\ LQ VRPH FDVHV 7KLV HPSKDVL]HV WKH QHHG RU MXVW IDOVH DODUPV DQG WR GHWHFW F\EHUDWWDFNV RQ D
IRU RUJDQL]DWLRQV WR SULRULWL]H F\EHUVHFXULW\ VR DV WR ''R6 QHWZRUN ,Q > @ SUHGLFWLYH WLPH VHULHV PRGHOV
PLQLPL]H WKH ULVN RI D F\EHUDWWDFN EHLQJ VXFFHVVIXO $Q ZHUH XVHG WR IRUHFDVW YXOQHUDELOLWLHV RI ZHE EURZVHUV
RUJDQL]DWLRQ WKDW FDQ UHGXFH LWV DGPLQLVWUDWLYH FRVWV E\ ZKLOH LQ > @ D G\QDPLF ULVN DVVHVVPHQW VWRFKDVWLF
RSWLPL]LQJ LWV F\EHUVHFXULW\ GHIHQVH PHFKDQLVPV FDQ PRGHO LV XVHG WR LGHQWLI\ LQYHQWRU\ HQKDQFHPHQW
GLYHUW PRUH PRQHWDU\ UHVRXUFHV WR RWKHU LQYHVWPHQWV RSSRUWXQLWLHV IRU FULWLFDOO\ GLVUXSWHG V\VWHPV
IRU EXVLQHVV JURZWK 'XH WR WKH KLJK FRVWV LQYROYHG LQ
DGRSWLQJ DQG LPSOHPHQWLQJ D SURDFWLYH F\EHUVHFXULW\ 2XU VWXG\ FRQWULEXWHV WR WKH UHOHYDQW UHVHDUFK E\
SROLF\ RUJDQL]DWLRQV XVXDOO\ GHYHORS LQHIIHFWLYH DSSO\LQJ PDWKHPDWLFDO PHWKRGV IRU WKH GHWHFWLRQ RI
F\EHUVHFXULW\ VROXWLRQV DV UHDFWLRQV WR F\EHUDWWDFN VLJQLILFDQW FRUUHODWLRQ DQG GHSHQGHQFH EHWZHHQ
LQFLGHQWV > @ ,PSOHPHQWLQJ DQ HIIHFWLYHO\ SURDFWLYH GLIIHUHQW W\SHV RI F\EHUWKUHDW DOHUWV ,Q RUGHU WR
LQIRUPDWLRQ VHFXULW\ SROLF\ PDNHV WKH ,7 LQIUDVWUXFWXUH GHWHUPLQH WKH GHJUHHV RI WKHVH FRUUHODWLRQV DQG
PRUH SURGXFWLYH LQFUHDVHV LWV DYDLODELOLW\ DQG GHSHQGHQFLHV 6SHDUPDQ¶V FRUUHODWLRQ FRHIILFLHQW DQG
JXDUDQWHHV DQ RUJDQL]DWLRQ¶V DFWLYLWLHV WR FRQWLQXH 3RLVVRQ UHJUHVVLRQ VWRFKDVWLF PRGHOOLQJ DUH XVHG
XQLQWHUUXSWHG 7R LPSOHPHQW VXFK DQ HIIHFWLYH OLQH RI 6LJQLILFDQW FRUUHODWLRQV DQG GHSHQGHQFLHV DPRQJ
F\EHU GHIHQVH DQ RUJDQL]DWLRQ QRW RQO\ KDV WR FHUWDLQ W\SHV RI F\EHUWKUHDW DOHUWV DUH GLVWLQJXLVKHG WKDW
GHWHUPLQH WKH YDOXH RI LWV DVVHWV EXW DOVR WKH FDQ EH XVHG IRU HYHQW FRXQW SUHGLFWLRQV RI VXFK
F\EHUWKUHDW HQYLURQPHQW E\ GHWHUPLQLQJ FRUUHODWLRQV LQFLGHQWV
DQG GHSHQGHQFLHV EHWZHHQ YDULRXV W\SHV RI
F\EHUDWWDFNV DQG PDOZDUH

‹ ,QWHUQDWLRQDO 7HOHFRPPXQLFDWLRQ 8QLRQ