Cyber Key Terrain Identification Using Adjusted PageRank Centrality

Investor logo

Warning

This publication doesn't include Faculty of Education. It includes Institute of Computer Science. Official publication website can be found on muni.cz.
Authors

SADLEK Lukáš ČELEDA Pavel

Year of publication 2024
Type Article in Proceedings
Conference ICT Systems Security and Privacy Protection. SEC 2023. IFIP Advances in Information and Communication Technology, vol 679.
MU Faculty or unit

Institute of Computer Science

Citation
Doi http://dx.doi.org/10.1007/978-3-031-56326-3_21
Keywords cyber key terrain; network centrality; host criticality; hill climbing; random walk
Attached files
Description The cyber terrain contains devices, network services, cyber personas, and other network entities involved in network operations. Designing a method that automatically identifies key network entities to network operations is challenging. However, such a method is essential for determining which cyber assets should the cyber defense focus on. In this paper, we propose an approach for the classification of IP addresses belonging to cyber key terrain according to their network position using the PageRank centrality computation adjusted by machine learning. We used hill climbing and random walk algorithms to distinguish PageRank’s damping factors based on source and destination ports captured in IP flows. The one-time learning phase on a static data sample allows near-real-time stream-based classification of key hosts from IP flow data in operational conditions without maintaining a complete network graph. We evaluated the approach on a dataset from a cyber defense exercise and on data from the campus network. The results show that cyber key terrain identification using the adjusted computation of centrality is more precise than its original version.
Related projects:

You are running an old browser version. We recommend updating your browser to its latest version.