New statistical model examines massive amounts of data to automatically spot anomalies

Data arising in cyber-security applications often have a network structure. A tool that monitors networks has access to massive amounts of data of which "normal" behavior can be observed. "Since data on intrusions is lacking," notes Rubin-Delanchy "accurate statistical modeling of connectivity behavior has important implications, particularly for network intrusion detection."

Rubin-Delanchy -- in collaboration with Nick Heard, reader in statistics at Imperial College London, and Carey Priebe, professor of statistics at The Johns Hopkins University -- has developed a "linear algebraic" approach to network anomaly detection, in which nodes are embedded in a finite dimensional latent space, where common statistical, signal-processing and machine-learning methodologies are then available. They illustrate results from their methodology on network flow data collected at Los Alamos National Laboratory.

In contrast with traditional cyber-security approaches like anti-virus software, the new methodology is not based on hand-engineered signatures, but rather machine learning in which programs can access and use the data and learn for themselves. "Our anticipation is that this model will provide a more robust approach to cyber-security in the future."