Semantic Flow Augmentation for the Automated Discovery of Organizational Relationships,
No ratings
Presented at Flocon 2014 by
Flow data has proven useful as a light-weight informative data source across a broad spectrum of applications from identifying anomalous behavior to clustering users and systems based on network communication patterns. As the mining of flow data continues however new applications are identified in which network traffic summaries must be augmented with additional information to meet a specific challenge. In this talk we consider the problem of automating the discovery of mission-centric organizational relationships. An accurate picture of an organization's relationship structure can provide insight into the potential impact of an attack or intrusion inform automated response about services which should not be disrupted and can focus an analyst's attention on IDS alerts which impact those relationships. However developing this picture is a daunting task from the perspective of a single individual or even team. In addition relationships change over time as projects begin and end and new collaborations are formed. Our work examines the applicability of flow data in this context. We present several strategies for annotating flow summary data with semantic features to allow the automated identification and categorization of relationships. Specifically we consider features from the following categories: flow-based statistical summaries lexical analysis of public resources time series analysis social network/graph analysis. We find that while flow-based statistical summaries are fast and informative features they are generally insufficient to distinguish between significant data exchanges that are extraneous and those that are mission oriented. This presentation will include comparisons of the relative utility of sets of features derived from flow data alone as well as the annotations derived from features in other categories. Using a labeled dataset collected over a period of one month we assess the information gain achieved by clustering graph analysis lexical analysis (of remote web content) and time-series models. We also discuss practical implementation issues including accurate labeling techniques integration into automated processes at Ames and feature / data scalability.