Data mining for security breach analysis

点击翻译按钮获取中文摘要

A data security breach occurs when there is a loss or theft of, or other unauthorized access to, sensitive information that could result in the potential compromise of the confidentiality or integrity of data. It is important to protect affected parties and to learn useful lessons from such incidents. The objective of this research is to apply grounded theory approach and text mining technology to extract meaningful evidence from security breach reports in order to identify the causes of security breach and to analyze the organizations' incident discovery and response behaviors.*******General (long-term) objectives:****1. To develop innovative data mining approach for security breach analysis.****2. To explore and identify various situations and factors that lead to security breaches and the ways to overcome security vulnerabilities.****3. To analyze organizations' security breach investigation and response processes and identify the problems of security incident response management.******Specific (short term) objectives:****1. Build security breach analysis ontology. Using grounded theory approach (Birks, 2013) to identify what are the key aspects and dimensions related to security breach should be studied, such as the time, the type, the cause, the consequence, the detection, and the response of security breaches, and organize them as the ontology for information extraction.****2. Apply and enhance ontology-based information extraction (OBIE) method (Wimalasuriya, 2010) to automatically extract information from security breach reports such as the nature of the breach, threat agents responsible for the breach, types of vulnerabilities exposed, means of investigation, and actions for post-breach remediations. The OBIE performance will be evaluated for further improvement.****3. Explore and identify situations and known/unknown factors that lead to security breaches using data mining approach such as clustering, association, and classification. A causal security breach model to explain such as the chance and choice of security threat (Ransbotham ndel et al. 2014) and identify the factors that affect the efficiencies and effectiveness of incident response management.******This study is expected to enhance our ability to use text mining technology to dynamically discover important, especially previously unknown, situations and causes of security breaches in a rapidly changing cyber security environment. It addresses the research gap in security incident response and develops new threat intelligence and response theories based on knowledge discovery from real data. The project will provide research training opportunities for high-quality personnel in the fields of data analytics and cyber security.*********