EAGER: Human-Centric Predictive Analytics of Cyber-Threats: a Temporal Dynamics Approach

网络安全对于保护国家利益至关重要，涉及的领域包括国防和金融，但远远超出这些领域。然而，目前最先进的网络防御系统的预测和归因能力严重有限。仅检测和理解网络攻击是不够的--我们可以将其比作“研究症状而不是疾病”。这项研究在一个共同的框架下开展了一种将网络数据取证与以人为中心的社会网络分析相结合的协同方法。该项目的三个主要活动如下：(A)使用特征提取技术在不同的数据源上建立网络攻击特征的综合模型，(B)根据对手群体的特征相似性对其进行分类，以及(C)利用社会网络科学的分析技术加强群体分类。为了完成这些活动：(1)在多模式图框架内研究用于构建计算机和社会网络的联合表示的不同模型；(2)开发数据约简和特征提取技术以将大数据集与该统一图模型相关联；(3)利用现有系统来发现个体对抗性网络之间不可见和缺失的链接；以及(4)应用社会网络模型和工具以及案例研究来推断对抗性群体类型。这项研究有望通过改进网络攻击的检测方法，使计算机科学、网络安全和社会科学受益。以创造性的方式将时间序列分析应用于多模式网络，应该有助于人工智能领域。这种联合工作也应适用于医疗保健、营销或预测技术采用趋势等领域。

Cybersecurity is paramount to protecting national interests in domains that include but extend well beyond defense and finance. However, current state-of-the-art cyber-defenses have severely limited predictive and attribution capabilities. Detecting and understanding cyber attacks is not sufficient--we can liken that to "studying symptoms instead of a disease." This research carries out a synergistic approach to integrating cyber data forensics with human-centric social network analysis under a common framework. The three major activities of this project are as follows: (a) comprehensive models of cyber-attack characteristics are developed using feature extraction techniques on diverse data sources, (b) adversarial groups are classified according to their feature similarities, and (c) group classification is enhanced using analytic techniques from social network science. To accomplish these activities: (1) different models for constructing joint representations of computer and social networks are investigated within a multi-mode graph framework; (2) data reduction and feature extraction techniques are developed for associating large datasets with this unified graph model; (3) an existing system is leveraged to discover invisible and missing links between adversarial networks of individuals; and (4) social network models and tools, as well as case studies, are applied to infer adversarial group typology. This research is expected to benefit computer science, cyber security, and social sciences by improving detection methods for cyber attacks. Applying time-series analysis in creative ways to multi-mode networks should contribute to the field of artificial intelligence. This joint work should apply also in fields such as health care, marketing, or forecasting technology adoption trends.