RiskRank: Security risk ranking for IP flow records

Abstract

This paper proposes RiskRank as a joint measure of cyclical and cross-sectional systemic risk. RiskRank is a general-purpose aggregation operator that concurrently accounts for risk levels for individual entities and their interconnectedness. The measure relies on the decomposition of systemic risk into sub-components that are in turn assessed using a set of risk measures and their relationships. For this purpose, motivated by the development of the Choquet integral, we employ the RiskRank function to aggregate risk measures, allowing for the integration of the interrelation of different factors in the aggregation process. The use of RiskRank is illustrated through a real-world case in a European setting, in which we show that it performs well in out-of-sample analysis. In the example, we provide an estimation of systemic risk from country-level risk and cross-border linkages.

Interdependent Security Risk Analysis of Hosts and Flows

“…We use three categories of flow information to formulate this likelihood: timing information, source and destination addresses, and a correlation among flows. The intuition behind the timing information is that a flow is more likely to be the cause of other flows if these flows started shortly after it [2]. Moreover, two flows can exhibit high correlation because a causal relationship exists between them [4].…”

“…To evaluate the effectiveness, we perform our risk computation on both these datasets and show that our method assigns high risk scores to the victims and attackers which are involved in the attacks. To evaluate the efficiency, we measure the elapsed time for our approach and two other recent models based on PageRank and HITS [2]. All the experiments were conducted on an iMac PC with 2.00GHz Intel Core 2 Duo processor and 4GB RAM running Ubuntu 12.04 LTS.…”

“…Therefore, there is an interdependency relationship between network flows and hosts with respect to the assessment of their risk scores. The idea of employing link analysis techniques, such as PageRank and HITS [1], for detecting relevant flows has been recently proposed [2]. However, in such an approach the risk scores of hosts and flows are evaluated separately, without considering their interdependency.…”

BotTrack: Tracking Botnets Using NetFlow and PageRank

“…This work is related to our previous one [37] but the construction of the dependency does not need any prior knowledge about potential risks in this paper.…”

“…The closest related work is [25], which is based on random walk and clustering techniques to isolate interaction subgraphs related to P2P communications. Our previous work has leveraged link analysis algorithms on flow dependency graphs [35,36] and host dependency graphs [37] for tracing the root cause flow records corresponding to the malicious traffic. They help to select PageRank as the much suitable algorithm for this paper.…”