大数据分析在内部威胁检测中的应用

需积分: 9 35 浏览量更新于2024-07-18 1 收藏 74.93MB PDF 举报

"《大数据分析在内部威胁检测中的应用》是一本由Bhavani Thuraisingham、Pallabi Parveen和Mehedy Masud、Latifur Khan合著的专业书籍，针对当前IT安全领域的一个重要挑战——内部威胁检测进行了深入探讨。随着现代恶意软件的进化，它们变得越来越智能，通过随机变异以躲避传统的反病毒软件检测。这种被称为反应性适应性恶意软件（reactively adaptive malware）的新型威胁，利用与反病毒软件相似的算法，不断学习和适应新的计算机防御策略，从而得以绕过检测。本书详述了用于对抗这种新型威胁的工具和技术细节，包括这些工具能够识别的各种类型的恶意软件。作者重点介绍了如何在云计算环境中实施这些工具，以提升检测效率和覆盖范围。此外，书中还深入讨论了大数据分析在这个框架下的应用，因为大数据能够提供丰富的数据源，帮助发现潜在的内部威胁行为模式。内部威胁，如员工滥用权限或恶意泄露信息，是企业信息安全的关键关注点。这本书通过大数据分析技术，展示了如何通过监控和分析海量数据，来提早识别出可能的内部威胁信号，从而采取预防措施或及时响应。这不仅有助于保护企业的关键信息资产，也对提高整体网络安全水平具有重要意义。总结来说，《大数据分析在内部威胁检测中的应用》是一本实用的指南，它结合了最新的IT技术和数据分析方法，旨在帮助企业和组织更好地理解和应对内部威胁，确保数据安全和业务连续性。对于IT专业人士和安全管理人员来说，这是一本不可或缺的参考资料，对于理解当今复杂威胁环境下的防护策略至关重要。"

xvContents

23.5.5 Breaking Ties by Summary Statistics .............................................. 277

23.5.6 MapReduce Join Execution ..............................................................278

23.6 Results ...........................................................................................................279

23.6.1 Experimental Setup .......................................................................... 279

23.6.2 Evaluation .........................................................................................280

23.7 Security Extensions ....................................................................................... 281

23.7.1 Access Control Model ...................................................................... 282

23.7.2 Access Token Assignment ................................................................283

23.7.3 Conicts ...........................................................................................284

23.8 Summary and Directions ...............................................................................285

References ................................................................................................................286

Chapter 24 Big Data Analytics for Multipurpose Social Media Applications ...........................289

24.1 Introduction ...................................................................................................289

24.2 Our Premise ...................................................................................................290

24.3 Modules of Inxite .......................................................................................... 291

24.3.1 Overview .......................................................................................... 291

24.3.2 Information Engine .......................................................................... 291

24.3.2.1 Entity Extraction ...............................................................292

24.3.2.2 Information Integration ....................................................293

24.3.3 Person of Interest Analysis ...............................................................293

24.3.3.1 InXite Person of Interest Prole Generation and

Analysis ............................................................................293

24.3.3.2 InXite POI Threat Analysis ..............................................294

24.3.3.3 InXite Psychosocial Analysis ...........................................296

24.3.3.4 Other features ...................................................................297

24.3.4 InXite Threat Detection and Prediction ...........................................298

24.3.5 Application of SNOD .......................................................................300

24.3.5.1 SNOD++ ..................................................................300

24.3.5.2 Benets of SNOD++ ..................................................300

24.3.6 Expert Systems Support ...................................................................300

24.3.7 Cloud-Design of Inxite to Handle Big Data .....................................301

24.3.8 Implementation .................................................................................302

24.4 Other Applications.........................................................................................302

24.5 Related Work .................................................................................................303

24.6 Summary and Directions ...............................................................................304

References ................................................................................................................304

Chapter 25 Big Data Management and Cloud for Assured Information Sharing .......................307

25.1 Introduction ...................................................................................................307

25.2 Design Philosophy ......................................................................................... 308

25.3 System Design ...............................................................................................309

25.3.1 Design of CAISS .............................................................................. 309

25.3.2 Design of CAISS++ ................................................................. 312

25.3.2.1 Limitations of CAISS ....................................................... 312

25.3.3 Formal Policy Analysis .................................................................... 321

25.3.4 Implementation Approach ................................................................ 321

25.4 Related Work ................................................................................................. 321

xvi Contents

25.4.1 Our Related Research .......................................................................322

25.4.2 Overall Related Research ................................................................. 324

25.4.3 Commercial Developments ..............................................................326

25.5 Extensions for Big Data-Based Social Media Applications .......................... 326

25.6 Summary and Directions ............................................................................... 327

References ................................................................................................................ 327

Chapter 26 Big Data Management for Secure Information Integration ..................................... 331

26.1 Introduction ................................................................................................... 331

26.2 Integrating Blackbook with Amazon s3 ........................................................ 331

26.3 Experiments ................................................................................................... 336

26.4 Summary and Directions ............................................................................... 336

References ................................................................................................................ 336

Chapter 27 Big Data Analytics for Malware Detection .............................................................. 339

27.1 Introduction ...................................................................................................339

27.2 Malware Detection ........................................................................................340

27.2.1 Malware Detection as a Data Stream Classication Problem ..........340

27.2.2 Cloud Computing for Malware Detection ........................................ 341

27.2.3 Our Contributions ............................................................................. 341

27.3 Related Work ................................................................................................. 342

27.4 Design and Implementation of the System .................................................... 344

27.4.1 Ensemble Construction and Updating ..............................................344

27.4.2 Error Reduction Analysis .................................................................344

27.4.3 Empirical Error Reduction and Time Complexity ........................... 345

27.4.4 Hadoop/MapReduce Framework .....................................................345

27.5 Malicious Code Detection ............................................................................. 347

27.5.1 Overview ..........................................................................................347

27.5.2 Nondistributed Feature Extraction and Selection ............................347

27.5.3 Distributed Feature Extraction and Selection ..................................348

27.6 Experiments ...................................................................................................349

27.6.1 Datasets ............................................................................................349

27.6.2 Baseline Methods ............................................................................. 350

27.7 Discussion ...................................................................................................... 351

27.8 Summary and Directions ............................................................................... 352

References ................................................................................................................ 353

Chapter 28 A Semantic Web-Based Inference Controller for Provenance Big Data .................. 355

28.1 Introduction ................................................................................................... 355

28.2 Architecture for the Inference Controller ...................................................... 356

28.3 Semantic Web Technologies and Provenance ...............................................360

28.3.1 Semantic Web-Based Models ...........................................................360

28.3.2 Graphical Models and Rewriting ..................................................... 361

28.4 Inference Control through Query Modication ............................................ 361

28.4.1 Our Approach ................................................................................... 361

28.4.2 Domains and Provenance ................................................................. 362

28.4.3 Inference Controller with Two Users ...............................................363

28.4.4 SPARQL Query Modication ..........................................................364

xviiContents

28.5 Implementing the Inference Controller .........................................................365

28.5.1 Our Approach ...................................................................................365

28.5.2 Implementation of a Medical Domain .............................................365

28.5.3 Generating and Populating the Knowledge Base .............................366

28.5.4 Background Generator Module ........................................................ 366

28.6 Big Data Management and Inference Control ...............................................367

28.7 Summary and Directions ...............................................................................368

References ................................................................................................................368

Conclusion to Part IV ............................................................................................... 373

PART V Next Steps for BDMA and BDSP

Introduction to Part V .............................................................................................. 377

Chapter 29 Condentiality, Privacy, and Trust for Big Data Systems ........................................ 379

29.1 Introduction ...................................................................................................379

29.2 Trust, Privacy, and Condentiality ................................................................ 379

29.2.1 Current Successes and Potential Failures ........................................380

29.2.2 Motivation for a Framework ............................................................. 381

29.3 CPT Framework ............................................................................................ 381

29.3.1 The Role of the Server ...................................................................... 381

29.3.2 CPT Process .....................................................................................382

29.3.3 Advanced CPT ................................................................................. 382

29.3.4 Trust, Privacy, and Condentiality Inference Engines .................... 383

29.4 Our Approach to Condentiality Management ............................................. 384

29.5 Privacy for Social Media Systems ................................................................. 385

29.6 Trust for Social Networks ..............................................................................387

29.7 Integrated System .......................................................................................... 387

29.8 CPT within the Context of Big Data and Social Networks ........................... 388

29.9 Summary and Directions ...............................................................................390

References ................................................................................................................390

Chapter 30 Unied Framework for Secure Big Data Management and Analytics ..................... 391

30.1 Overview ....................................................................................................... 391

30.2 Integrity Management and Data Provenance for Big Data Systems ............. 391

30.2.1 Need for Integrity ............................................................................. 391

30.2.2 Aspects of Integrity ..........................................................................392

30.2.3 Inferencing, Data Quality, and Data Provenance ............................. 393

30.2.4 Integrity Management, Cloud Services and Big Data ......................394

30.2.5 Integrity for Big Data .......................................................................396

30.3 Design of Our Framework ............................................................................. 397

30.4 The Global Big Data Security and Privacy Controller .................................. 400

30.5 Summary and Directions ............................................................................... 401

References ................................................................................................................ 401

Chapter 31 Big Data, Security, and the Internet of Things ........................................................403

31.1 Introduction ...................................................................................................403

xviii Contents

31.2 Use Cases .......................................................................................................404

31.3 Layered Framework for Secure IoT ............................................................... 406

31.4 Protecting the Data ........................................................................................ 407

31.5 Scalable Analytics for IoT Security Applications .........................................408

31.6 Summary and Directions ............................................................................... 411

References ................................................................................................................ 411

Chapter 32 Big Data Analytics for Malware Detection in Smartphones.................................... 413

32.1 Introduction ................................................................................................... 413

32.2 Our Approach ................................................................................................ 414

32.2.1 Challenges ........................................................................................ 414

32.2.2 Behavioral Feature Extraction and Analysis .................................... 415

32.2.2.1 Graph-Based Behavior Analysis ...................................... 415

32.2.2.2 Sequence-Based Behavior Analysis ................................. 416

32.2.2.3 Evolving Data Stream Classication ............................... 416

32.2.3 Reverse Engineering Methods ......................................................... 417

32.2.4 Risk-Based Framework .................................................................... 417

32.2.5 Application to Smartphones ............................................................. 418

32.2.5.1 Data Gathering ................................................................. 419

32.2.5.2 Malware Detection ........................................................... 419

32.2.5.3 Data Reverse Engineering of Smartphone

Applications .................................................................... 419

32.3 Our Experimental Activities.......................................................................... 419

32.3.1 Covert Channel Attack in Mobile Apps ...........................................420

32.3.2 Detecting Location Spoong in Mobile Apps .................................420

32.3.3 Large Scale, Automated Detection of SSL/TLS

Man-in-the-Middle Vulnerabilities in Android Apps ...................... 421

32.4 Infrastructure Development ........................................................................... 421

32.4.1 Virtual Laboratory Development ..................................................... 421

32.4.1.1 Laboratory Setup ............................................................. 421

32.4.1.2 Programming Projects to Support the Virtual Lab .........423

32.4.1.3 An Intelligent Fuzzier for the Automatic Android

GUIApplication Testing ................................................. 423

32.4.1.4 Problem Statement ........................................................... 423

32.4.1.5 Understanding the Interface.............................................423

32.4.1.6 Generating Input Events...................................................424

32.4.1.7 Mitigating Data Leakage in Mobile Apps Using a

Transactional Approach ..................................................424

32.4.1.8 Technical Challenges ....................................................... 425

32.4.1.9 Experimental System ....................................................... 425

32.4.1.10 Policy Engine ................................................................... 426

32.4.2 Curriculum Development ................................................................. 426

32.4.2.1 Extensions to Existing Courses .......................................426

32.4.2.2 New Capstone Course on Secure Mobile Computing ..... 428

32.5 Summary and Directions ............................................................................... 429

References ................................................................................................................ 429

Chapter 33 Toward a Case Study in Healthcare for Big Data Analytics and Security ............... 433

33.1 Introduction ................................................................................................... 433

xixContents

33.2 Motivation ...................................................................................................... 433

33.2.1 The Problem ..................................................................................... 433

33.2.2 Air Quality Data ............................................................................... 435

33.2.3 Need for Such a Case Study ............................................................. 435

33.3 Methodologies ............................................................................................... 436

33.4 The Framework Design ................................................................................. 437

33.4.1 Storing and Retrieving Multiple Types of Scientic Data ............... 437

33.4.1.1 The Problem and Challenges ............................................ 437

33.4.1.2 Current Systems and Their Limitations ........................... 438

33.4.1.3 The Future System ............................................................ 439

33.4.2 Privacy and Security Aware Data Management for

Scientic Data ..................................................................................440

33.4.2.1 The Problem and Challenges ............................................ 440

33.4.2.2 Current Systems and Their Limitations ...........................440

33.4.2.3 The Future System ............................................................441

33.4.3 Ofine Scalable Statistical Analytics...............................................442

33.4.3.1 The Problem and Challenges ............................................442

33.4.3.2 Current Systems and Their Limitations ...........................443

33.4.3.3 The Future System ............................................................ 444

33.4.3.4 Mixed Continuous and Discrete Domains .......................444

33.4.4 Real-Time Stream Analytics ............................................................446

33.4.4.1 The Problem and Challenges ............................................ 446

33.4.5 Current Systems and Their Limitations ...........................................446

33.4.5.1 The Future System ............................................................ 446

33.5 Summary and Directions ...............................................................................448

References ................................................................................................................448

Chapter 34 Toward an Experimental Infrastructure and Education Program for BDMA

and BDSP ................................................................................................................. 453

34.1 Introduction ................................................................................................... 453

34.2 Current Research and Infrastructure Activities in BDMA

and BDSP ...................................................................................................... 454

34.2.1 Big Data Analytics for Insider Threat Detection ............................. 454

34.2.2 Secure Data Provenance ...................................................................454

34.2.3 Secure Cloud Computing .................................................................454

34.2.4 Binary Code Analysis ...................................................................... 455

34.2.5 Cyber-Physical Systems Security ..................................................... 455

34.2.6 Trusted Execution Environment ....................................................... 455

34.2.7 Infrastructure Development ............................................................. 455

34.3 Education and Infrastructure Program in BDMA ......................................... 455

34.3.1 Curriculum Development ................................................................. 455

34.3.2 Experimental Program ..................................................................... 457

34.3.2.1 Geospatial Data Processing on GDELT ...........................458

34.3.2.2 Coding for Political Event Data ........................................ 458

34.3.2.3 Timely Health Indicator ....................................................459

34.4 Security and Privacy for Big Data ................................................................. 459

34.4.1 Our Approach ...................................................................................459

34.4.2 Curriculum Development .................................................................460

34.4.2.1 Extensions to Existing Courses ........................................460

34.4.2.2 New Capstone Course on BDSP ....................................... 461

剩余578页未读，继续阅读

wang1062807258

粉丝: 13
资源: 272

大数据分析在内部威胁检测中的应用

如何退出insider preview

vscode insider和stable区别

Windows 11 Insider Preview 10.0.22621.2115

What is the principle of least privilege? Why does this principle matter?

我在硬盘上装了Windows To Go 10，它不能正常更新到 Windows 11 Insider Preview吗，

system design interview – an insider's guide: volume 2 pdf

system design interview an insider鈥檚 guide pdf

system design interview an insider's guide volume 2 pdf

code-insiders操作命令是什么意思?有什么作用

WslRegisterDistribution failed with error: 0x80070003 Error: 0x80070003 The system cannot find the path specified

最新资源