Waltham, MA, United States
Waltham, MA, United States
Time filter
Source Type

Alavedra J.,Milcord | Stroh L.,Milcord | Caglayan A.,Milcord | Das S.,Milcord | Das S.,Machine Analytics
Fusion 2011 - 14th International Conference on Information Fusion | Year: 2011

Bayesian belief network (BN) models allow users to perform sensitivity analyses on a dependent/target variable given a combination of input variables. Such analyses on BN models are possible due to their holistic nature, interconnecting variables in a model through a combination of deductive and abductive inferencing. A sensitivity analysis provides the basis for hypothesis testing to extract rules from a BN model for explaining and characterizing the target variable with respect to input variables. However, determining which combinations of input variables have the most impact on a given target variable is challenging due to the combinatorial complexity of a large BN model containing hundreds of variables. Here we present an approach based on a statistical significance test that recursively generates combinations of evidence on input variables and prunes paths from the search tree that are unlikely to produce any results. To address the combinatorial complexity issue, we exclude those combinations of input variables from consideration that are d-separated from the target variable. To demonstrate the utility and scalability of our approach, we first extract a BN model semi-automatically from a corruption survey dataset on Afghanistan and then analyze and cluster sentiments from various provinces of that country applying the proposed sensitivity analysis technique. We also provide details of how the extracted rules are represented in an executable format to support decision making. © 2011 IEEE.

Caglayan A.,Milcord | Toothaker M.,Milcord | Drapeau D.,Milcord | Burke D.,Milcord | Eaton G.,Milcord
Information Systems and e-Business Management | Year: 2012

This paper examines the behavioral patterns of fast-flux botnets for threat intelligence. The Threat Intelligence infrastructure, which we have specifically developed for fast-flux botnet detection and monitoring, enables this analysis. Cyber criminals and attackers use botnets to conduct a wide range of operations including spam campaigns, phishing scams, malware delivery, denial of service attacks, and click fraud. The most advanced botnet operators use fast-flux infrastructure and DNS record manipulation techniques to make their networks more stealthy, scalable, and resilient. Our analysis shows that such networks share common lifecycle characteristics, and form clusters based on size, growth and type of malicious behavior. We introduce a social network connectivity metric, and show that command and control and malware botnets have similar scores with this metric while spam and phishing botnets have similar scores. We describe how a Guilt-by-Association approach and connectivity metric can be used to predict membership in particular botnet families. Finally, we discuss the intelligence utility of fast-flux botnet behavior analysis as a cyber defense tool against advanced persistent threats. © 2011 Springer-Verlag.

Loading Milcord collaborators
Loading Milcord collaborators