Interactive computer network activity analysis using graph techniquesReturn to TOC
No ratings
Presented at First 2015 by
In cyber security analysis, everything is growing at prodigious rates: data feeds, numbers of computers and phones on the network, number of users, and the number of threats that security and information technology professionals must evaluate, prioritize, and mitigate. The one thing that isn’t growing in enterprises is the number of security professionals available to perform this security. Without enough expert staff, every enterprise only gets further and further behind the curve in analyzing odd, suspicious activities on their networks. Enterprises need a different analytic approach and strategy to make every one of their personnel more effective. Graph analytics is that approach. Graph analytics uses cyber security data and threat data to identify potential network threats, prioritizes them, and highlights them for analyst consideration. Graph analytics can be used to focus the available analyst time in the enterprise to the most important threats and anomalies present within the enterprise by combining the multitudinous computer security information using graph algorithms. Graph algorithms have been applied to computer network data in multiple contexts, including botnet identification , unknown tradecraft-unknown threat identification , and high-speed network analysis . Graph algorithms, such as subgraph-isomorphism / pattern-matching, Jaccard similarity coefficient, community detection, shortest path, Betweenness centrality, badness propagation, and anomaly identification, can be applied to Cyber-threat analytic problems, including subgraph identification and extraction, botnet infrastructure identification, server community identification and content distribution network analysis, information flow across the network, key node identification, threat clustering, and unknown tradecraft-unknown threat identification. Cray, through engagements with its customers and partners, has utilized graph analytics in performing computer network analysis and identify threats and risks to enterprise-scale networks. One of these networks is SCinet. SCinet is the high-bandwidth network that supports the SC technical conference and exhibit hall. SC14 had the largest network to date, with 1.2 terabits per second reaching the show floor and 11,000 devices using SCinet. SCinet has a /17 (32K IP addresses) of publicly routable IPv4 space (and some IPv6 space). SCinet is a volunteer organization of 300+ individuals working together over the entire year to design, construct, operate, and dismantle the network every year. SCinet’s scale of data (18 billion triples from 5 days of data), time-to-first solution (analytics need to be developed in minutes to an hour or two), and time-to-solution (answers need to be generated in seconds to minutes to be useful) requirements make it a great analogue for enterprise networks and analytic challenges. This presentation describes SCinet’s computer network data, applicable graph algorithms, and a use case where these have been applied together to perform interactive analysis on an enterprise-scale network.