Early Detection of Cybersecurity Threats Using Collaborative Cognition

Thumbnail Image

Files

901.pdf (4.13 MB)

Links to Files

https://ieeexplore.ieee.org/document/8537852

Permanent Link

10.1109/CIC.2018.00054
 http://hdl.handle.net/11603/19228

Collections

UMBC Computer Science and Electrical Engineering Department
UMBC Faculty Collection
UMBC Information Systems Department
UMBC Student Collection

Author/Creator

Author/Creator ORCID

Date

2018-11-19

Type of Work

conference papers and proceedings preprints
Text

Department

Program

Citation of Original Publication

S. N. Narayanan, A. Ganesan, K. Joshi, T. Oates, A. Joshi and T. Finin, "Early Detection of Cybersecurity Threats Using Collaborative Cognition," 2018 IEEE 4th International Conference on Collaboration and Internet Computing (CIC), Philadelphia, PA, 2018, pp. 354-363, doi: 10.1109/CIC.2018.00054.

Rights

This item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
© 2018 IEEE

Subjects

UMBC Ebiquity Research Group

Abstract

The early detection of cybersecurity events such as attacks is challenging given the constantly evolving threat landscape. Even with advanced monitoring, sophisticated attackers can spend more than 100 days in a system before being detected. This paper describes a novel, collaborative framework that assists a security analyst by exploiting the power of semantically rich knowledge representation and reasoning integrated with different machine learning techniques. Our Cognitive Cybersecurity System ingests information from various textual sources and stores them in a common knowledge graph using terms from an extended version of the Unified Cybersecurity Ontology. The system then reasons over the knowledge graph that combines a variety of collaborative agents representing host and network-based sensors to derive improved actionable intelligence for security administrators, decreasing their cognitive load and increasing their confidence in the result. We describe a proof of concept framework for our approach and demonstrate its capabilities by testing it against a custom-built ransomware similar to WannaCry.