Actionable knowledge discovery for threats intelligence support using a multi-dimensional data mining methodology

Olivier Thonnard, Marc Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

13 Scopus citations

Abstract

This paper describes a multi-dimensional knowledge discovery and data mining (KDD) methodology that aims at discovering actionable knowledge related to Internet threats, taking into account domain expert guidance and the integration of domain-specific intelligence during the data mining process. The objectives are twofold: i) to develop global indicators for assessing the prevalence of certain malicious activities on the Internet, and ii) to get insights into the modus operandi of new emerging attack phenomena, so as to improve our understanding of threats. In this paper, we first present the generic aspects of a domain-driven graph-based KDD methodology, which is based on two main components: a clique-based clustering technique and a concepts synthesis process using cliques' intersections. Then, to evaluate the applicability of this approach to our application domain, we use a large dataset of real-world attack traces collected since 2003. Our experimental results show that significant insights can be obtained into the domain of threat intelligence by using this multi-dimensional knowledge discovery method. © 2008 IEEE.
Original languageEnglish (US)
Title of host publicationProceedings - IEEE International Conference on Data Mining Workshops, ICDM Workshops 2008
Pages154-163
Number of pages10
DOIs
StatePublished - Dec 1 2008
Externally publishedYes

Fingerprint

Dive into the research topics of 'Actionable knowledge discovery for threats intelligence support using a multi-dimensional data mining methodology'. Together they form a unique fingerprint.

Cite this