DocumentCode :
140660
Title :
RankAOH: Context-driven similarity-based retrieval of experiences in cyber analysis
Author :
Chen Zhong ; Samuel, Dupont ; Yen, J. ; Peng Liu ; Erbacher, Robert ; Hutchinson, Seth ; Etoty, Renee ; Cam, Hasan ; Glodek, William
Author_Institution :
Pennsylvania State Univ., State College, PA, USA
fYear :
2014
fDate :
3-6 March 2014
Firstpage :
230
Lastpage :
236
Abstract :
In cyber analysis, it is highly desirable to support the analysis of junior analysts by leveraging the experiences of experts. But, there are two major challenges to achieve this goal. First, it is very costly to capture the experience of experts for the complex task of cyber analysis using traditional approaches such as protocol analysis. Second, it is difficult to identify previous experiences of experts that are relevant to the dynamic context of an analyst´s cyber analysis task. To address the first challenge, a system has been developed to capture non-intrusively the analytical reasoning processes of analysts. To tackle the second challenge, this paper presents an effective and efficient approach for retrieving relevant experiences based on the dynamically changing context of cyber analysis. We define an experience as a process of analytical reasoning and adopt an Action-Observation-Hypothesis (A-O-H) model to represent the processes in cyber analysis. Based on this model, a tool for capturing and supporting the analytical reasoning processes is shown to be able to support the elusive cognitive process in dynamic cyber situations. The experience retrieval approach of this paper supports the efficient experience retrieval, and dynamically updates the results as the context of analysis evolves. The experience retrieval approach is evaluated, based on the precision and recall with respect to the ground truth. The evaluation results suggest that the proposed approach supports significantly the analytical reasoning of analysts by leveraging the experiences of experts.
Keywords :
information retrieval; security of data; RankAOH; action-observation-hypothesis model; analyst analytical reasoning process; cyber analysis; dynamic cyber situations; elusive cognitive process; experience context-driven similarity-based retrieval; protocol analysis; Analytical models; Cognition; Context; IP networks; Indexing; Servers; Context-based retrieval; Decision support; Intrusion detection; Knowledge management;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Cognitive Methods in Situation Awareness and Decision Support (CogSIMA), 2014 IEEE International Inter-Disciplinary Conference on
Conference_Location :
San Antonio, TX
Print_ISBN :
978-1-4799-3563-5
Type :
conf
DOI :
10.1109/CogSIMA.2014.6816567
Filename :
6816567
Link To Document :
بازگشت