Informační systém Repo
HUSÁK, Martin, Václav BARTOŠ, Pavol SOKOL and Andrej GAJDOŠ. Predictive Methods in Cyber Defense: Current Experience and Research Challenges. Future Generation Computer Systems. Amsterdam, The Netherlands: Elsevier Science, vol. 115, February, p. 517-530. ISSN 0167-739X. 2021.
Other formats:   BibTeX LaTeX RIS
Basic information
Original name Predictive Methods in Cyber Defense: Current Experience and Research Challenges
Authors HUSÁK, Martin, Václav BARTOŠ, Pavol SOKOL and Andrej GAJDOŠ.
Edition Future Generation Computer Systems, Amsterdam, The Netherlands, Elsevier Science, 2021, 0167-739X.
Other information
Original language English
Type of outcome Article in a journal
Country of publisher Netherlands
Confidentiality degree is not subject to a state or trade secret
WWW URL
Organization Ústav výpočetní techniky – Repository – Repository
UT WoS 000591438900018
Keywords in English Cybersecurity;Prediction;Forecasting;Data mining;Machine learning;Time series
Links EF16_019/0000822, research and development project.
Changed by Changed by: RNDr. Daniel Jakubík, učo 139797. Changed: 9/1/2021 01:40.
Abstract
Predictive analysis allows next-generation cyber defense that is more proactive than current approaches based on intrusion detection. In this paper, we discuss various aspects of predictive methods in cyber defense and illustrate them on three examples of recent approaches. The first approach uses data mining to extract frequent attack scenarios and uses them to project ongoing cyberattacks. The second approach uses a dynamic network entity reputation score to predict malicious actors. The third approach uses time series analysis to forecast attack rates in the network. This paper presents a unique evaluation of the three distinct methods in a common environment of an intrusion detection alert sharing platform, which allows for a comparison of the approaches and illustrates the capabilities of predictive analysis for current and future research and cybersecurity operations. Our experiments show that all three methods achieved a sufficient technology readiness level for experimental deployment in an operational setting with promising accuracy and usability. Namely prediction and projection methods, despite their differences, are highly usable for predictive blacklisting, the first provides a more detailed output, and the second is more extensible. Network security situation forecasting is lightweight and displays very high accuracy, but does not provide details on predicted events.
Displayed: 29/3/2024 02:10