Big Data Analytics in Cyber Security: Network Traffic and Attacks

ABSTRACT

Network attacks, intrusion detection, and intrusion prevention are important topics in cyber security. Network flows and system events generate big data, which often leads to challenges in intrusion detection with high efficiency and good accuracy. This paper focuses on the ‘Volume’, ‘Veracity’, and ‘Variety’ of big data characteristics in network traffic and attacks. Datasets with various data types including numerical data and categorical data (such as status or flag data) are analyzed with the help of R language and its functions. Data duplicates detection and removal, missing values detection, and data quality analysis are also performed. The analysis of masquerades for various users is conducted. In addition, the correlation analysis of variables and a clustering analysis based on k-means are also performed.

KEYWORDS:

• Big data analytics
• cyber security
• network attacks
• duplicate data
• missing data
• masquerade

Acknowledgments

This paper is based upon work supported by the U.S. Army TACOM Life Cycle Command under Contract No. W56HZV-08-C-0236, through a subcontract with Mississippi State University (MSU), and was completed for the Simulation Based Reliability and Safety (Sim-BRS) research program at MSU.

Disclaimer

Reference herein to any specific commercial company, product, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favouring by the United States Government or the Department of the Army (DoA). The opinions of the authors expressed herein do not necessarily state or reflect those of the United States Government or the DoA, and shall not be used for advertising or product endorsement purposes.

As the author(s) is (are) not a Government employee(s), this document was only reviewed for export controls, and improper Army association or emblem usage considerations. All other legal considerations are the responsibility of the author and his/her/their employer(s).

Additional information

Funding

This work was supported by U.S. Army Tank-automotive and Armaments Command (TACOM) Life Cycle Command [W56HZV-08-C-0236].