@inproceedings{86dc5af7e84d46c68e6f7e7872cf7bca,
title = "Analyst intuition based Hidden Markov Model on high speed, temporal cyber security big data",
abstract = "Hidden Markov Models (HMM) are probabilistic models that can be used for forecasting time series data. It has seen success in various domains like finance [1-5], bioinformatics [6-8], healthcare [9-11], agriculture [12-14], artificial intelligence[15-17]. However, the use of HMM in cyber security found to date is numbered. We believe the properties of HMM being predictive, probabilistic, and its ability to model different naturally occurring states form a good basis to model cyber security data. It is hence the motivation of this work to provide the initial results of our attempts to predict security attacks using HMM. A large network datasets representing cyber security attacks have been used in this work to establish an expert system. The characteristics of attacker's IP addresses can be extracted from our integrated datasets to generate statistical data. The cyber security expert provides the weight of each attribute and forms a scoring system by annotating the log history. We applied HMM to distinguish between a cyber security attack, unsure and no attack by first breaking the data into 3 cluster using Fuzzy K mean (FKM), then manually label a small data (Analyst Intuition) and finally use HMM state-based approach. By doing so, our results are very encouraging as compare to finding anomaly in a cyber security log, which generally results in creating huge amount of false detection.",
keywords = "Analyst Intuition, Big Data, Cyber security, Expectation Regulated, Fuzzy k-means (FKM), Hidden Markov Model (HMM), High Velocity, Multi-layer Perceptron (MLP), Network Protocols, Principal Component Analysis (PCA), Virus",
author = "Teoh, {T. T.} and Nguwi, {Y. Y.} and Yuval Elovici and Cheung, {N. M.} and Ng, {W. L.}",
note = "Publisher Copyright: {\textcopyright} 2017 IEEE.; 13th International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery, ICNC-FSKD 2017 ; Conference date: 29-07-2017 Through 31-07-2017",
year = "2018",
month = jun,
day = "21",
doi = "10.1109/FSKD.2017.8393092",
language = "English",
series = "ICNC-FSKD 2017 - 13th International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery",
publisher = "Institute of Electrical and Electronics Engineers",
pages = "2080--2083",
editor = "Liang Zhao and Lipo Wang and Guoyong Cai and Kenli Li and Yong Liu and Guoqing Xiao",
booktitle = "ICNC-FSKD 2017 - 13th International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery",
address = "United States",
}