A Framework for Characterizing the Evolution of Cyber Attacker-Victim Relation Graphs
Richard Garcia-Lebron, Kristin M. Schweitzer, Raymond M. Bateman, Shouhuai Xu · 2018
Understanding and characterizing the reconnaissance behaviors of cyber attackers is an important problem that has yet to be tackled. As a first step towards tackling this problem, in this paper we propose a novel, graph-theoretic abstraction, dubbed the evolution of attacker-victim relation graphs, for characterizing cyber attackers' reconnaissance behaviors. The framework is centered at describing the similarity between two graphs at adjacent time windows of a certain resolution (e.g., per second vs. per minute). We also conduct a case study focusing on the number of time resolutions that need to be considered in order to obtain a comprehensive understanding of the evolution of attack-victim relation graphs.