D 2023

On the Provision of Network-Wide Cyber Situational Awareness via Graph-Based Analytics

HUSÁK, Martin; Joseph KHOURY; Ðorđe KLISURA and Elias BOU-HARB

Basic information

Original name

On the Provision of Network-Wide Cyber Situational Awareness via Graph-Based Analytics

Authors

HUSÁK, Martin; Joseph KHOURY; Ðorđe KLISURA and Elias BOU-HARB

Edition

Cham, Switzerland, Complex Computational Ecosystems, p. 167-179, 13 pp. Lecture Notes in Computer Science 13927, 2023

Publisher

Springer Nature

Other information

Language

English

Type of outcome

Proceedings paper

Country of publisher

Switzerland

Confidentiality degree

is not subject to a state or trade secret

Publication form

electronic version available online

References:

URL

Marked to be transferred to RIV

No

Organization

Ústav výpočetní techniky – Repository – Repository

ISBN

978-3-031-44354-1

ISSN

DOI

https://doi.org/10.1007/978-3-031-44355-8_12

EID Scopus

2-s2.0-85177168401

Keywords in English

Cyber security;Cyber situational awareness;Graph-based analytics;Large and complex network;Network security management

Links

EH22_010/0003229, research and development project.
Changed: 6/4/2024 04:07, RNDr. Daniel Jakubík

Abstract

In the original language

In this paper, we posit how semi-static (i.e., not changing very often) complex computer network-based intelligence using graphbased analytics can become enablers of Cyber Situational Awareness (CSA) (i.e., perception, comprehension, and projection of situations in a cyber environment). A plethora of newly surfaced cyber security researchers have used graph-based analytics to facilitate particular down tasks in dynamic complex cyber environments. This includes graph-, node- and edge-level detection, classification, and others (e.g., credit card fraudulent transactions as an edge classification problem). To the best of our knowledge, very limited efforts have consolidated the outputs of heterogeneous computer network monitoring and reconnaissance tools (e.g., Nmap) in enabling actionable CSA. As such, in this work, we address this literature gap while describing several use cases of graph traversal, graph measures, and subgraph mining in vulnerability and security state assessment, attack projection and mitigation, and device criticality estimation. We highlight the benefits of the graph-based approaches compared to traditional methods. Finally, we postulate open research and application challenges in graph-based analytics for CSA to prompt promising research directions and operational capabilities.
Displayed: 4/5/2026 20:12