Latent Factor Representations of Dynamic Networks in Cyber-Security

统计和数据科学技术在下一代网络安全防御中发挥着重要作用。在一个典型的企业计算机网络中，有许多大容量的数据源，可以发现和预防网络攻击和其他恶意网络活动。为了提高英国和世界各地政府、工业和学术界计算机网络的安全性，需要开发基于统计、概率模型的技术，以识别使用这些数据源的最微妙的入侵企图。统计方法的优点是能够从历史数据中学习正常计算机和网络行为的复杂模式，从而可以检测到异常，否则这些异常不会突出。本项目的目的是建立强大的统计模型，用于理解和预测边缘的存在，这些边缘表示相互连接的互联网协议地址对，从而可以识别和校准不寻常的新连接。这首先需要使用任何开放的信息源，这些信息源可用于互联网域名范围、国与国之间的连接以及不同地址通常喜欢的协议、端口和服务。第二，我们想使用统计推断，根据已经观察到的历史联系，了解互联网的一些潜在的基本结构;相反，这些是无法测量的方面，但将决定特定边缘形成的倾向。复杂的，灵活的潜在因素模型可以通过贝叶斯非参数化最有效地构建，并且有越来越多的文献将这些技术应用于动态网络问题以建立。然而，贝叶斯非参数方法在计算上是繁重的，并且将需要适应以适当地应用于在企业计算机网络内收集的真实的网络安全数据的高维度和频率。这个过程的一部分将是有效地筛选和分流这些高数据量，识别有趣的或信息丰富的部分或网络流量数据的分区。作为一个研究课题，统计网络安全位于统计和应用概率的EPSRC增长领域，并与全球不确定性和数字经济的主题有关。研究的潜在影响，以提高网络安全跨越加强国家安全和英国作为一个数字经济的地位，通过维护公民自由的社会影响，因为访问互联网越来越被认为是一个新兴的人权。

Statistical and data science techniques have an important role to play in the next generation of cyber-security defences. Inside a typical enterprise computer network, a number of high-volume data sources are available which could enable the discovery and prevention of cyber-attacks and other nefarious network activity. To improve the security of computer networks in government, industry and academia, both in the UK and worldwide, there is a requirement for developing statistical, probability model-based techniques for identifying the most subtle intrusion attempts using these data sources. The advantage of statistical approaches is their ability to learn, from historical data, complex patterns of normal computer and network behaviour, so that anomalies can be detected which would not stand out otherwise.The aim of this project is to build strong statistical models for understanding and predicting the existence of edges indicating pairs of internet protocol addresses which connect with one another, so that unusual new connections can be identified and calibrated. This first requires the use of any open sources of information available for internet domain ranges, country-to-country connections, and protocols, ports and services typically favoured by different addresses. Second, we would like to use statistical inference, based on historical connections which have been observed, to understand some of the latent underlying structure of the internet; in contrast, these are aspects which cannot be measured but will determine the propensity for particular edges to be formed.Complex, flexible latent factor models can be most effectively constructed through Bayesian nonparametrics, and there is a growing literature of the application of these techniques to dynamic network problems to build upon. However, Bayesian nonparametric methods are computationally burdensome, and will need adaptation to be appropriately applied to the high dimension and frequency of real cyber-security data collected within an enterprise computer network. Part of this process will be effective screening and triage of these high data volumes, identify interesting or informative sections or partitions of network traffic data.As a research topic, statistical cyber-security lies within the EPSRC growth area of Statistics and Applied Probability, and relates to the themes of Global Uncertainties and Digital Economy. The potential impact of research to improve cyber-security spans across strengthening both national security and the position of the UK as a digital economy, through to the societal impact of safeguarding civil liberties, as having access to the internet is increasingly considered to be an emerging human right.