Application of the JDL data fusion process model for cyber security

Giacobe, Nicklaus A.

doi:10.1117/12.850275

Cited by 27 publications

(14 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Besides, the spontaneous and continuous attention of many researchers to this field has made the researches on cybersecurity the top hot issue. In order to fully understand the research status of network security situational awareness, this paper firstly searched and reviewed articles on this topic in the past 10 years in the core database in September 2017, and sorted out a total of 10 large citations of review literature [16,[37][38][39][40][41][42][43][44][45]. Based on the actor-network theory, Kopylec et al [37] explored the critical relationship between physical and network infrastructure, and demonstrated the results of situational awareness through visual cascading.…”

Section: Status Of Foreign Researchmentioning

confidence: 99%

“…With aspect to the multidisciplinary integration, Jajodia et al [39] conducted the research in relation to the questions and methods of network situational awareness in 2010 with an excellent conclusion and analyzed the key problem of the network situational awareness, as well as summarizes the main reasons for the lack of network situational awareness. Tadda and Salerno [16], Giacobe [40], and Schreiber-Ehle and Koch [42] inquired into the application process of JDL model in the field of situational awareness, especially in literature [40] for the favorable induction and summary of the data source information at level 0/1 in JDL model. In addition, Klein et al [41] and Vincent [45] et al applied the OODA loop model [15] to the network situational awareness and some stages in the model are prerequisites for others.…”

Section: Status Of Foreign Researchmentioning

confidence: 99%

“…In order to effectively analyze the research details of network security situational awareness, this paper concludes 75 papers in the core database in recent years and the research points of these articles are mainly concentrated on 9 aspects (the key points in these 9 aspects are shown in Table 3). The research content is mapped with the traditional Endsley model [36], the JDL model [40], and the logical phase of the OODA model [45]:…”

Section: Status Of Foreign Researchmentioning

confidence: 99%

“…The concept of the model (integration with other disciplines) [16, 18, 39, 45, 50-57, 63, 67, 68] The completeness and regularization of data acquisition variables [40,42,45,47,73,87] The optimization of related algorithms [58][59][60][61][62][63][64][65][66][67] The information fusion analysis [40,42,53,[69][70][71][72][73][74] The automation of process tools [33-35, 73, 75, 84, 85, 87] The visualization of work at each stage [5,11,55,61,[76][77][78][79]86] Practice testing and efficiency gains in large-scale real-world networks [80][81][82] The software engineering implementation of sensing methods [42,[83][84][85]88] The practical application of analysis and prediction results in specific fields [42,47,…”

Section: Status Of Foreign Researchmentioning

confidence: 99%

See 3 more Smart Citations

Analysis framework of network security situational awareness and comparison of implementation methods

Huang

Wang

et al. 2019

J Wireless Com Network

View full text Add to dashboard Cite

Information technology has penetrated into all aspects of politics, economy, and culture of the whole society. The information revolution has changed the way of communication all over the world, promoted the giant development of human society, and also drawn unprecedented attention to network security issues. Studies, focusing on network security, have experienced four main stages: idealized design for ensuring security, auxiliary examination and passive defense, active analysis and strategy formulation, and overall perception and trend prediction. Under the background of the new strategic command for the digital control that all countries are scrambled for, the discussion of network security situational awareness presents new characteristics both in the academic study and industrialization. In this regard, a thorough investigation has been made in the present paper into the literature of network security situational awareness. Firstly, the research status both at home and abroad is introduced, and then, the logical analysis framework is put forward concerning the network security situational awareness from the perspective of the data value chain. The whole process is composed of five successive stages: factor acquisition, model representation, measurement establishment, solution analysis, and situation prediction. Subsequently, the role of each stage and the mainstream methods are elaborated, and the application results on the experimental objects and the horizontal comparison between the methods are explained. In an attempt to provide a panoramic recognition of network security situational awareness, and auxiliary ideas for the industrialization of network security, this paper aims to provide some references for the scientific research and engineering personnel in this field.

show abstract

Section: Status Of Foreign Researchmentioning

confidence: 99%

Section: Status Of Foreign Researchmentioning

confidence: 99%

Section: Status Of Foreign Researchmentioning

confidence: 99%

Section: Status Of Foreign Researchmentioning

confidence: 99%

See 2 more Smart Citations

Analysis framework of network security situational awareness and comparison of implementation methods

Huang

Wang

et al. 2019

J Wireless Com Network

View full text Add to dashboard Cite

show abstract

“…The JDL Data Fusion Process Model [4] provided the basis for treating the network security data as sensor output in a fusion system [5]. First, we extracted entities, generally as computers by IP address, and applied the alert or log entry as properties of those entities to create Level 1 Fusion (entity-level refinement).…”

Section: Log File Parsing In Perlmentioning

confidence: 99%

Geovisual analytics for cyber security: Adopting the GeoViz Toolkit

Giacobe

2011

2011 IEEE Conference on Visual Analytics Science and Technology (VAST)

Self Cite

View full text Add to dashboard Cite

For the VAST 2011 Network Security Mini-Challenge, we adopted geovisual analytic methods and applied them in the field of network security. We used the GeoViz Toolkit [1] to represent cyber security events, by fabricating a simple "geography" of several sets of blocks (one for the workstations, one for the servers, and one for the Internet) using ArcGIS 10 (by ESRI -Environmental System Research Institute). Security data was tabulated using Perl scripts to parse the logs in order to create representations of event frequency and where they occurred on the network. The tabulated security data was then added as attributes of the geography. Exploration of the data and subsequent analysis of the meaning and impact of the cyber security events was made possible using the GeoViz Toolkit.

show abstract

Toward situational awareness in threat detection. A survey

Rendall

Mylonas

Vidalis

2021

WIREs Forensic Science

View full text Add to dashboard Cite

The pervasiveness of the Internet did not come without security risk. The current threat landscape is characterized by the rise of sophisticated cyber attacks, which target user devices and corporate infrastructure. To tackle the risk of compromise, data-driven detection strategies have become increasingly mainstream. The relevant literature includes many works that leverage opensource datasets, supervised learning or, less commonly, unsupervised learning. However, advanced network attacks' spatial and temporal characteristics prove standalone threat detection systems inadequate, especially for detecting a multi-stage attack and often stealthy techniques. Moreover, attackers have been demonstrating adversarial effects that are caused by deception and contaminating data-driven methods with adversarial learning. For these reasons, recent research in threat detection is moving away from commonly, and often obsolete, datasets as well as adopting more multi-layered decision strategies.As such, this article provides a comprehensive review of decision strategies. We also examine their ability to support cyber situational awareness (CSA), providing to security analysts CSA properties such as situation assessment and system refinement.

show abstract

Application of the JDL data fusion process model for cyber security

Cited by 27 publications

References 15 publications

Analysis framework of network security situational awareness and comparison of implementation methods

Analysis framework of network security situational awareness and comparison of implementation methods

Geovisual analytics for cyber security: Adopting the GeoViz Toolkit

Toward situational awareness in threat detection. A survey

Contact Info

Product

Resources

About