Directional Laplacian Centrality for Cyber Situational Awareness

TL;DR

This paper introduces a novel spectral graph theory-based centrality measure called Directional Laplacian Centrality, designed to detect anomalies and important nodes in cyber network data without relying on signatures.

Contribution

It proposes a new graph-theoretic centrality measure derived from the Laplacian matrix derivative, enhancing anomaly detection in cyber network analysis.

Findings

Effectively identifies key IP addresses in network flow data.

Detects injected attack profiles with noticeable centrality changes.

Performs well with real and synthetic data, even with small anomalies.

Abstract

Cyber operations is drowning in diverse, high-volume, multi-source data. In order to get a full picture of current operations and identify malicious events and actors analysts must see through data generated by a mix of human activity and benign automated processes. Although many monitoring and alert systems exist, they typically use signature-based detection methods. We introduce a general method rooted in spectral graph theory to discover patterns and anomalies without a priori knowledge of signatures. We derive and propose a new graph-theoretic centrality measure based on the derivative of the graph Laplacian matrix in the direction of a vertex. To build intuition about our measure we show how it identifies the most central vertices in standard network data sets and compare to other graph centrality measures. Finally, we focus our attention on studying its effectiveness in identifying important IP addresses in network flow data. Using both real and synthetic network flow data, we conduct several experiments to test our measure's sensitivity to two types of injected attack profiles, and show that vertices participating in injected attack profiles exhibit noticeable changes in our centrality measures, even when the injected anomalies are relatively small, and in the presence of simulated network dynamics.