Manifold Learning and Bayesian Characterization of Computer Network Traffic Supporting Machine Learning-Based Cyber System Protection
Nicholas V. Scott, Jack McCarthy · Proceedings of the World Congress on Electrical Engineering and Computer Systems and Science · 2023
State-of-the-art cyber security rests on dynamic creation of graphical networks which model computer network traffic.This in turn allows for the assessment of optimal pathways relating different nodal components which comprise the cyber system.The estimation of such networks for cyber systems relies on robust statistical methods which provide structural understanding of cyber system components.Considering new technological initiatives directed towards using network theory as a tool to model the psychology lying behind cyber intrusion, a full top-to-bottom machine learning formulism and methodology for characterizing a computer network system is explored.The new aspect of this work is the utilization not only of classical frequentist methods for analysis but manifold learning and Bayesian methods for characterization and modelling of the interrelationships of cyber system network nodes.Such systematic analysis allows for ease of implementation of dynamic programming-based analysis directed towards optimal pathway and optimal stopping estimation.The focus of this work is on the application of statistical methods to noise-laden, freely available 4-dimensional computer network data consisting of date, internet protocol site number, remote autonomous system numbers, and connection counts across 10 computer server sites.The objective is to demonstrate how confidence in statistical cyber behavior can be gained using multiple exploratory machine learning techniques exploited as local and global describers of cyber intrusion variability.Preliminary results show that frequentist statistics and matrix factorizations can distill Poisson probability distributions along with sub-group structure for internet protocol network traffic.Such methods can also provide insight into the relative contributions of specific internet protocol sites to global and local connection count variance.A particular sub-group of locally non-distinct, correlated internet protocol sites possess a background network structure which could be interpreted as a hidden mode of network intrusion.Manifold learning provides consistent topological results where characteristic changes in internet protocol connection counts appear near a cusp in the manifolds.Principal component analysis eigenvalue and scree plots provide evidence that only four dimensions or internet protocol sites are responsible for the global variance-based manifold.This is consistent with non-negative matrix factorization eigenmode spectral results.Bayesian belief networks are applied as a tool to analyze the conditional probabilistic relationships existing between internet protocol server sites modeled as multi-state random variable nodes.Using the Peter and Clark algorithm for Bayesian belief network structural network learning, Bayesian belief network analysis shows specific IP sites which comprise sub-networks, including converging ones, and which parameterize the conditional probability of intrusion at server site A given server site B. The connections learned by the model are similar but not totally consistent with the correlations found in the frequentist statistics-based correlation matrix.Simulation-based instantiations at specific IP sites in the Bayesian belief network provide evidence of intrusion frequency probability, allowing information technology personnel insight into where and how resources should be placed and used to protect vital cyber systems.