2.4 Cyber Security
Total Page:16
File Type:pdf, Size:1020Kb
Improving Cyber Situational Awareness via Data mining and Predictive Analytic Techniques POURMOURI, Sina Available from the Sheffield Hallam University Research Archive (SHURA) at: http://shura.shu.ac.uk/24949/ A Sheffield Hallam University thesis This thesis is protected by copyright which belongs to the author. The content must not be changed in any way or sold commercially in any format or medium without the formal permission of the author. When referring to this work, full bibliographic details including the author, title, awarding institution and date of the thesis must be given. Please visit http://shura.shu.ac.uk/24949/ and http://shura.shu.ac.uk/information.html for further details about copyright and re-use permissions. Improving Cyber Situational Awareness via Data mining and Predictive Analytic Techniques Sina Pournouri A dissertation submitted in partial fulfilment of the requirements of Sheffield Hallam University for the Degree of Doctor of Philosophy January 2019 Acknowledgment Many people have earned my gratitude for supporting me in this journey. First, I would like to send my love to my beautiful family. My father, Mansour, you have been always a role model for me and as I always say you are my best friend. My mother, Farahnaz, I want to say you are the best. In this journey you listened to my moans always and you have been very supportive. My sister, Saba, in difficult times, you have been a great support. I hope one day you achieve what you deserve as you just started your path towards a great success. Also I would like to express my gratitude to my Director of Studies, Professor Babak Akhgar. His support, encouragement, and enthusiasm have been inspirational. I would also like to thank my supervisor Doctor Shahrzad Zargari for her support and advice. I would like to express my appreciation to Sheffield Hallam University and Cultural Communication and Computing Research Institute (C3RI) for support and the opportunity I was given to learn and develop my skills and follow my dream. At last I want to say thank you to everyone that I cannot name them here, you all will stay in my heart forever. Abstract As cyber-attacks have become more common in everyday life, there is a need for maintaining and improving cyber security standards in any business or industry. Cyber Situational Awareness (CSA) is a broad strategy which can be adopted by any business or government to tackle cyber-attacks and incidents. CSA is based on current and past incidents, elements and actors in any system. Managers and decision makers need to monitor their systems constantly to understand ongoing events and changes which it can lead to predict future incidents. Prediction of future cyber incidents then can guide cyber managers to be prepared against future cyber threats and breaches. This research aims to improve cyber situational awareness by developing a framework based on data mining techniques specifically classification methods known as predictive approaches and Open Source Intelligence (OSINT). OSINT is another important element in this research because not only it is accessible publicly but also it is cost effective and research friendly. This research highlights the importance of understanding past and current CSA, which it can lead to more preparation against future cyber threats, and cyber security experts can use the developed framework with other different methods and provide a comprehensive strategy to improve cyber security and safety. List of Publications Pournouri, S., Zargari, S. and Akhgar, B., 2018. Predicting the Cyber Attackers; A Comparison of Different Classification Techniques. In Cyber Criminology (pp. 169-181). Springer, Cham. Pournouri, S., Akhgar, B. and Bayerl, P.S., 2017, January. Cyber attacks analysis using decision tree technique for improving cyber situational awareness. In International Conference on Global Security, Safety, and Sustainability (pp. 155-172). Springer, Cham. Pournouri, S. and Akhgar, B., 2015, September. Improving Cyber Situational Awareness Through Data Mining and Predictive Analytic Techniques. In International Conference on Global Security, Safety, and Sustainability (pp. 21-34). Springer, Cham. Table of Contents CHAPTER 1 INTRODUCTION ..................................................................................... 1 1.1 RESEARCH RATIONALE .......................................................................................... 3 1.1.1 Research Question ...................................................................................... 3 1.1.2 Aim and Objectives ...................................................................................... 4 1.1.3 Research Methodology ................................................................................ 5 1.2 THESIS OUTLINE .................................................................................................. 10 CHAPTER 2 LITERATURE REVIEW ......................................................................... 12 2.1 INTRODUCTION .................................................................................................... 12 2.2 DATA MINING ....................................................................................................... 12 2.2.1 Classification.............................................................................................. 13 2.2.2 Clustering................................................................................................... 21 2.2.3 Regression................................................................................................. 23 2.2.4 Association rule ......................................................................................... 25 2.3 OPEN SOURCE INTELLIGENCE .............................................................................. 26 2.4 CYBER SECURITY ................................................................................................ 27 2.4.1 Cyber threats ............................................................................................. 28 2.4.2 Cyber attackers and their motivations ....................................................... 29 2.4.3 Cyber Activities .......................................................................................... 30 2.5 CYBER SITUATIONAL AWARENESS ........................................................................ 31 2.5.1 Practical examples of Cyber Situational Awareness ................................. 34 2.5.2 Existing approaches .................................................................................. 36 2.5.3 Summary ................................................................................................... 57 2.6 APPLICATION OF PREDICTIVE ANALYTIC IN SIMILAR FIELDS ...................................... 61 2.7 CONCLUSION ....................................................................................................... 66 CHAPTER 3 DATA STRUCTURE AND PRE-PROCESSING ................................... 68 3.1 INTRODUCTION .................................................................................................... 68 3.2 TOOLS AND PLATFORMS ....................................................................................... 68 3.2.1 Open Refine............................................................................................... 68 3.2.2 R ................................................................................................................ 68 3.2.3 WEKA ........................................................................................................ 70 3.3 DATA COLLECTION .............................................................................................. 71 3.4 DATA CATEGORIZATION ....................................................................................... 72 3.5 SUMMARY ........................................................................................................... 75 CHAPTER 4 DATA ANALYSIS AND APPLYING CLASSIFICATION TECHNIQUES ..................................................................................................................................... 76 4.1 INTRODUCTION .................................................................................................... 76 4.2 DECISION TREE ANALYSIS ................................................................................... 77 4.2.1 Prediction of Type of Threat by Decision tree ........................................... 77 4.2.2 Prediction of Cyber Attackers by Decision tree ......................................... 85 4.2.3 Prediction of Targeted Country by Decision tree....................................... 93 4.2.4 Prediction of Type of Target by Decision tree ......................................... 102 4.2.5 Prediction of Cyber Attack Activity by Decision tree................................ 109 4.2.6 Discussion and Interpretation .................................................................. 117 4.3 K NEAREST NEIGHBOUR ANALYSIS ..................................................................... 118 4.3.1 Prediction of Type of Threat by KNN ....................................................... 118 4.3.2 Prediction of Cyber attackers by KNN ..................................................... 120 4.3.3 Prediction of Type of Target by KNN ....................................................... 122 4.3.4 Prediction of Targeted Country by KNN .................................................. 124 4.3.5 Prediction of Cyber Attack Activity by KNN ............................................