Graph coarsening for path finding in cybersecurity graphs

Authors:
Emilie Hogan;John R. Johnson;Mahantesh Halappanavar
Affiliations:
Pacific Northwest National Laboratory, Richland, WA;Pacific Northwest National Laboratory, Richland, WA;Pacific Northwest National Laboratory, Richland, WA
Venue:
Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop
Year:
2013

Citing 6
Cited 0

Approximating s-t minimum cuts in Õ(n2) time

STOC '96 Proceedings of the twenty-eighth annual ACM symposium on Theory of computing
A Fast and High Quality Multilevel Scheme for Partitioning Irregular Graphs

SIAM Journal on Scientific Computing
Fast Monte Carlo Algorithms for Matrices I: Approximating Matrix Multiplication

SIAM Journal on Computing
Graph sparsification by effective resistances

STOC '08 Proceedings of the fortieth annual ACM symposium on Theory of computing
Comparison of Coarsening Schemes for Multilevel Graph Partitioning

Learning and Intelligent Optimization
Applying graph-based anomaly detection approaches to thediscovery of insider threats

ISI'09 Proceedings of the 2009 IEEE international conference on Intelligence and security informatics

Quantified Score

Hi-index	0.00

Visualization

Abstract

A network hacking attack in which hackers repeatedly steal password hashes and move through a computer network with the goal of reaching a computer with high level administrative privileges is known as a pass-the-hash attack. In this paper we apply graph coarsening on graphs obtained from computer network data for the purpose of (a) detecting hackers using this attack and (b) assessing the risk level of the network's current state. We repeatedly contract edges (obtaining a graph minor), which preserves the existence of paths in the graph, and take powers of the adjacency matrix to count the paths. This allows us to detect the existence of paths as well as find paths that have high risk of being exploited by adversaries.