SLIDE 3 MIT Lincoln Laboratory
Slide-3
Statistical Network Detection
Problem Problem: Forensic Back-T : Forensic Back-Tracking acking
- Currently, significant analy
Currently, significant analyst effort dedicated to st effort dedicated to manually identifying links manually identifying links between threat between threat events and events and their im their immediat diate precursor sites e precursor sites
– Days of ma Days of manu nual effo al effort to fu rt to fully expl lly explore candi
ate tracks – Correl Correlations missed unless re ations missed unless recurring sites are recognized curring sites are recognized by analysts by analysts – Precursor sites may be low-val Precursor sites may be low-value stagi ue staging areas ng areas – Man Manual a l analysis wi lysis will n ll not sup t support furth rt further b er back cktrackin tracking fro from m stagi staging areas to potentially higher-val ng areas to potentially higher-value sites ue sites
Problem Problem: Forensic Back-T : Forensic Back-Tracking acking
- Currently, significant analy
Currently, significant analyst effor effort ded dedica cated ted to to manually identifying links manually identifying links between threat events and between threat events and their im their immediat diate precursor sites e precursor sites
– Days of ma Days of manu nual effo al effort to fu rt to fully expl lly explore candi
ate tracks – Correl Correlations missed unless re ations missed unless recurring sites are recognized curring sites are recognized by analysts by analysts – Precursor sites may be low-val Precursor sites may be low-value stagi ue staging areas ng areas – Man Manual a l analysis wi lysis will n ll not sup t support furth rt further b er back cktrackin tracking fro from m stagi staging areas to potentially higher-val ng areas to potentially higher-value sites ue sites
Concept Concept: Statistica Statistical Network Detection l Network Detection
- Develop graph algorithms to
Develop graph algorithms to identify adversary nodes identify adversary nodes by estimating connect by estimating connectivity to known events ivity to known events
– Tracks d Tracks describ scribe gra graph betwe between know known sites or events n sites or events which act as sources which act as sources – Unknow Unknown sites are detected by n sites are detected by the aggregati the aggregation of threat
propagated over many potential connecti propagated over many potential connections
Concept Concept: Statistica Statistical Network Detection l Network Detection
- Develop graph algorithms to
Develop graph algorithms to identify adversary nodes identify adversary nodes by estimating connect by estimating connectivity to known events ivity to known events
– Tracks d Tracks describ scribe gra graph betwe between know known sites or events n sites or events which act as sources which act as sources – Unknow Unknown sites are detected by n sites are detected by the aggregati the aggregation of threat
propagated over many potential connecti propagated over many potential connections
Event Event A A Event Event B B
Computationally demanding graph processing – ~ 106 seconds based on benchmarks & scale – ~ 103 seconds needed for effective CONOPS (1000x improvement)
Planned system capability (over major urban area)
- 1M Tracks/day (100,000 at any time)
- 100M Tracks in 100 day database
- 1M nodes (starting/ending points)
- 100 events/day (10,000 events in
database)
1st Neighbor 1st Neighbor 2nd Neighbor 2nd Neighbor 3rd Neighbor 3rd Neighbor