User:Finkga/Cyber Analytics

Cyber Analytics

Cyber Analytics is a branch of analytics that applies to the domain of computers, networks, and their related data. Cyber analytics is the science of analysis as it relates to computers and computer networks. Analysis is the process of arriving at a decision based on observable facts (data). A scientific approach compares observations to hypothetical models. Thus, cyber analytics helps computer administrators to understand the behavior of computers, networks, and user activities from the data computer systems use and generate. Cyber analytics tells the story behind cyber data. There are potentially many stories depending on the purposes and perspective of the analyst. Cyber analytics can be used to support computer security or simply network administration.

Derivation

Cyber analytics assumes there is a unifying story behind the fractured set of available data...

Relation to Other Branches of Analytics

All analytic sciences support analysts who must make sense of massive, streaming data. Cyber analytics differs from other analytics in the volume and quality of its data and the characteristics of the analysts who use it. Visual Analytics is human-centric

Cyber data

Cyber data is characterized by an extreme volume and velocity of highly-structured data that is mostly not suitable for humans to read. For example, Fink cites the daily volume of security-related log events that DOE passes up the chain for central analysis to be 500 million events. Cyber data is not normally human-readable, although many log formats (such as syslog ) contain human-readable content. The data is typically structured according to some machine-oriented protocol, but the protocols used may be non-standard or proprietary implementations of standard protocols that may not fully interoperate.

The high velocity of cyber log data makes it impractical to store.

The Need for Cyber Analytics

DOE cyber analysts must maintain near real-time situational awareness of a widely dispersed enterprise with over 100 sites, 500 thousand machines, and nearly 500 million events daily. The number of daily events is expected to soar into the billions in the near future. To maintain the safety of the DOE infrastructure, analysts must be able to gain a nation-wide perspective within seconds to minutes of a major event.

Analysis centers ask trending questions such as, “Are attacks becoming more effective?”, “Are attackers becoming more sophisticated?”, and “Are defenders improving their defensive posture?”. They must also answer key agency questions such as, “What resources is this external IP address accessing?”, and “Can you characterize the sites nation X is interested in?”.

Cyber analysts need tools for automated pattern extraction and recognition to track and monitor interesting events and show how bit patterns form indicators of behavioral patterns. They need predictive tools to support timely adaptation. For instance, they need to ability to detect the probes that form precursors of full-blown attacks. DOE cyber analysts need to be able to extend lessons learned at one site across the enterprise and to mitigate the effects of attacks before they happen.

Challenges

Cyber analytics is a new science that needs the rigor of standard procedures for measurement, repeatability, and prediction. Reference data sets and test suites can provide fair comparison of competing methods. Unfortunately, realistic cyber data is typically highly sensitive. We need Anonymization#Anonymity_on_the_Internet anonymization methods that preserve the security properties of collected data without compromising privacy of the providers.

Cyber analytics spans multiple scales from processors and processes to computers, routers, and other devices to networks and internetworks.

Cyber analytics will enable predictive and adaptive approaches that improve defenders’ situational awareness and help analysts react in a timely manner. Human-guided automated response is needed for Internet-speed attacks. Large-scale collaboration in cyber defense requires very broad, nontraditional command and control strategies. Finally, defenders need to learn to use deception and to detect deception by attackers.

Tools

Cyber analysis tools and methods must be sensitive to the needs of the analyst so that they enable sense-making without forcing the analyst toward particular conclusions or uses of the data.

References

--Finkga (talk) 20:08, 17 July 2009 (UTC)