A Review of Topological Data Analysis for Cybersecurity

TL;DR

This paper reviews how Topological Data Analysis (TDA), a technique from algebraic topology, can be applied to cybersecurity data to improve detection of malicious activities by analyzing data structure and patterns.

Contribution

It provides a comprehensive review of TDA applications in cybersecurity, highlighting its potential for enhancing data analysis and threat detection methods.

Findings

TDA offers new insights into cybersecurity data structures.

TDA can improve anomaly detection in cybersecurity.

The review identifies promising research directions in TDA for cybersecurity.

Abstract

In cybersecurity it is often the case that malicious or anomalous activity can only be detected by combining many weak indicators of compromise, any one of which may not raise suspicion when taken alone. The path that such indicators take can also be critical. This makes the problem of analysing cybersecurity data particularly well suited to Topological Data Analysis (TDA), a field that studies the high level structure of data using techniques from algebraic topology, both for exploratory analysis and as part of a machine learning workflow. By introducing TDA and reviewing the work done on its application to cybersecurity, we hope to highlight to researchers a promising new area with strong potential to improve cybersecurity data science.