Analysis of an organization’s computer network activity is a key component of early detection and mitigation of insider threat, a growing concern for many organizations. Raw system logs are a prototypical example of streaming data that can quickly scale beyond the cognitive power of a human analyst. As a prospective filter for the human analyst, we present an online unsupervised deep learning a...

Differentiating anomalous network activity from normal network traffic is difficult and tedious. A human analyst must search through vast amounts of data to find anomalous sequences of network connections. To support the analyst’s job, we built an application which enhances domain knowledge with machine learning techniques to create rules for an intrusion detection expert system. We employ gene...

In this paper, we present a novel indexing scheme for semantic graphs, which is based on the notion of the i-degree of a node. We apply this scheme to identify in a large semantic graph, the database, a fragment network, which may represent incomplete information that an analyst collected on an adversary network of interest.

OBJECTIVES Upon successful completion of this chapter, you should: 1. Understand how the network development life cycle (NDLC) relates to other systems development architectures and life cycles and, consequently, how the network analyst/designer must interact with analyst/designers involved in these related processes. 2. Understand the network development life cycle including: overall issues, p...

In this paper the user-oriented BISANTE workload generator for network traffic simulation is presented. It enables the analyst to model both the behavior of network users interacting with applications or services and the network traffic at the packet level itself. This way, workload at different levels of abstraction can be constructed. Currently the workload generator is available for the simu...

This paper describes a framework that utilizes an adaptive network based fuzzy inference system (ANFIS) to perform user constrained pattern recognition on time series data. Using a customizable fuzzy logic grammar, the architecture allows an analyst to capture domain expertise in a context relevant manner. Fuzzy logic rules constructed by the analyst are used to perform feature extraction and i...

In this paper the user-oriented BISANTE workload generator for network traffic simulation is presented. It enables the analyst to model both the behavior of network users interacting with applications or services and the network traffic at the packet level itself. This way, workload at different levels of abstraction can be constructed. Currently the workload generator is available for the simu...