Enterprise Computer Network Research Articles

Spectral Clustering on Spherical Coordinates Under the Degree-Corrected Stochastic Blockmodel

ABSTRACT Spectral clustering is a popular method for community detection in network graphs: starting from a matrix representation of the graph, the nodes are clustered on a low-dimensional projection obtained from a truncated spectral decomposition of the matrix. Estimating correctly the number of communities and the dimension of the reduced latent space is critical for good performance of spectral clustering algorithms. Furthermore, many real-world graphs, such as enterprise computer networks studied in cyber-security applications, often display heterogeneous within-community degree distributions. Such heterogeneous degree distributions are usually not well captured by standard spectral clustering algorithms. In this article, a novel spectral clustering algorithm is proposed for community detection under the degree-corrected stochastic blockmodel. The proposed method is based on a transformation of the spectral embedding to spherical coordinates, and a novel modeling assumption in the transformed space. The method allows for simultaneous and automated selection of the number of communities and the latent dimension for spectral embeddings of graphs with uneven node degrees. Results show improved performance over competing methods in representing computer networks.

Distributed Intrusion Detection Systems in Big Data: A Survey

We live in a time where data stream by the second, which makes intrusion detection a more difficult and tiresome task, and in turn intrusion detection systems require an efficient and improved detection mechanism to detect the intrusive activities. Moreover, handling the size, complexity, and availability of big data requires techniques that can create beneficial knowledge from huge streams of the information, which imposes the challenges on the process of both designing and management of both Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) in terms of performance, sustainability, security, reliability, privacy, energy consumption, fault tolerance, scalability, and flexibility. IDSs and IPSs utilize various methodologies to guarantee security, accessibility and reliability of enterprise computer networks. This paper presents a comprehensive study of the Distributed Intrusion Detection Systems in Big Data, and presents intrusion detection and prevention techniques that utilize machine learning, big data analytics techniques in distributed systems of the intrusion detection.

Computer Network System Security Management and Maintenance Strategy

Computer network system security management has always been an important part of computer management. In the process of enterprises using computers, network security has always been one of the important factors affecting the security and stable development of enterprises. Therefore, strengthening computer network system security management has always been one of the important tasks for enterprise development. This article mainly analyzes the influencing factors of computer network system security and proposes corresponding security management strategies in order to build a comprehensive computer network security defense system and promote the enterprise computer network environment to achieve more security and stability.

Emulation Software for Enterprise Network Data Collection at the Stage of DSS Development for EOR Implementation at Oilfields

Frequently, at the stage of decision support systems adaptation, oriented to real-time data analysis, coming from distributed systems of an enterprise computer network, connection between the DSS and working equipment is unavailable at early stages of software development. Such connection is usually available at final development stages after successful alpha testing on simulation models, confirming the declared operating parameters of software and hardware DSS complexes. For development, research and modeling of new approaches to data analysis, it is necessary to perform multiple starts of the system in conditions, close to the real ones. In the paper, we represent a method, which provides access to historical data of industrial equipment operating, using intermediate program layer. The layer simulates data input and allows the user to define the data load rate, equal to the same rate of real processes or several times exceeding it.

Development of a Model for Detecting Unauthorized Traffic

Information systems and technologies are the main means of increasing people’s productivity and efficiency. And today, along with the tasks of effective processing and transmission of information, the most important task is to ensure the information security of enterprises. According to the global study by InfoWatch, the number of information leaks is growing every year. The largest number of data leaks were recorded in high-tech companies, educational institutions, government agencies and banks. Most often, network traffic is a threat. This threat consists in the interception of data over the network, the purpose of which is to obtain confidential data, passwords, corporate secrets, addresses of network computers, etc. There is a need to create hardware and software tools to protect network resources. Therefore, creating a tool for detecting unauthorized traffic is relevant. The authors consider the problem of information security in the enterprise computer network and carry out the analysis of unauthorized traffic in order to identify its signs. The researchers analyze methods for detecting unauthorized traffic to select the best one and present a developed formalized model for detecting unauthorized traffic.

Measuring Detection of Signature On Enterprise Computer Network

The purpose of this study is to measure the comparative success rate methods of signature-based anomaly based on enterprise computer network attack detected. The application of information technology in many fields often cause the occurrence of attacks and threats that lead to data loss, the crippled system, and destruction of the system. To address these threats required the presence of early detection against any threats that occur at the enterprise computer network system. Early detection function to minimize and prevent the loss of the more extensive system. Methods used in the detection of the threat that is signature based and anomaly-based method. Both methods are used for detection of any threats to the network system, then that method will be between the two measured how many threats can be detected by both methods, and measure the level of success detection. The results obtained in this study, Method of Anomaly Based successfully detect 89.66% attack, while the method Signature based successfully detected 91.87% attack. If the results of the great early attack detection, then the security level of the network are also great and can reduce the risk posed by a threat.

Modelling dynamic network evolution as a Pitman-Yor process

Dynamic interaction networks frequently arise in biology, communications technology and the social sciences, representing, for example, neuronal connectivity in the brain, internet connections between computers and human interactions within social networks. The evolution and strengthening of the links in such networks can be observed through sequences of connection events occurring between network nodes over time. In some of these applications, the identity and size of the network may be unknown a priori and may change over time. In this article, a model for the evolution of dynamic networks based on the Pitman-Yor process is proposed. This model explicitly admits power-laws in the number of connections on each edge, often present in real world networks, and, for careful choices of the parameters, power-laws for the degree distribution of the nodes. A novel empirical method for the estimation of the hyperparameters of the Pitman-Yor process is proposed, and some necessary corrections for uniform discrete base distributions are carefully addressed. The methodology is tested on synthetic data and in an anomaly detection study on the enterprise computer network of the Los Alamos National Laboratory, and successfully detects connections from a red-team penetration test.

Evolving Bipartite Authentication Graph Partitions

As large scale enterprise computer networks become more ubiquitous, finding the appropriate balance between user convenience and user access control is an increasingly challenging proposition. Suboptimal partitioning of users’ access and available services contributes to the vulnerability of enterprise networks. Previous edge-cut partitioning methods unduly restrict users’ access to network resources. This paper introduces a novel method of network partitioning superior to the current state-of-the-art which minimizes user impact by providing alternate avenues for access that reduce vulnerability. Networks are modeled as bipartite authentication access graphs and a multi-objective evolutionary algorithm is used to simultaneously minimize the size of large connected components while minimizing overall restrictions on network users. Results are presented on a real world data set that demonstrates the effectiveness of the introduced method compared to previous naive methods.

Detecting Weak Dependence in Computer Network Traffic Patterns by Using Higher Criticism

SummaryTo perform robust statistical anomaly detection in cybersecurity, we must build realistic models of the traffic patterns within a computer network. It is therefore important to understand the dependences between the large number of routinely interacting communication pathways within such a network. Pairs of interacting nodes in any directed communication network can be modelled as point processes where events in a process indicate information being sent between two nodes. For two processes A and B denoting the interactions between two distinct pairs of computers, called edges, we wish to assess whether events in A trigger events then to occur in B. A test is introduced to detect such dependence when only a subset of the events in A exhibit a triggering effect on process B; this test will enable us to detect even weakly correlated edges within a computer network graph. Since computer network events occur as a high frequency data stream, we consider the asymptotics of this problem as the number of events goes to ∞, while the proportion exhibiting dependence goes to 0, and examine the performance of tests that are provably consistent in this framework. An example of how this method can be used to detect genuine causal dependences is provided by using real world event data from the enterprise computer network of Los Alamos National Laboratory.

The reliability model of the fault-tolerant border routing with two Internet services providers in the enterprise computer network

This paper deals with the reliability model of the fault-tolerant border routing with two Internet Services Providers in the enterprise computer network. Developed by authors, the generalized mathematical model of the fault-tolerant routing with two Internet providers and derivation of the calculation formula for the availability factor are presented. The calculation examples of the availability factor for the different cases with the specific routing schemes, which are used in modern border routing, are also provided. Calculation results show more realistic values of the availability factor for fault-tolerant border routing with two Internet Services Providers, rather than values, which can be obtained by well-known simplified formula for the duplex system in reliability theory.

Performance Evaluation and Scalability of IP-based and Heuristic-based Job Scheduling Algorithm Backup Systems

Background/Objectives: One of the most important factors in the design of enterprise computer networks is data storage method. Increase the volume, recovery and security of stored information is the biggest challenge. Using backup systems is a perfect solution to solve these challenges. Traditional methods can be used to perform backups, but new methods and new backup systems are more efficient. Methods/Statistical Analysis: To analyze and compare overall backup session time, backup session processing time, overhead, fragmentation of large data and efficiency of the IP-based schedule and the heuristic-based job scheduling algorithm. Findings: My analysis show that the simple heuristic-based job scheduling algorithm with adaptive number of active DAs is close to optimal while having no additional computing overhead compared to the compute expensive IP-based solution. The simulator-based on heuristic-based job scheduling algorithm enables the analysis to minimize the number of actively used backup servers while meeting backup window constraints and data restore satisfying rates. Applications/Improvements: This algorithm is close to the results that reduce backup time by 60 percent without additional computing overhead and fragmentation of large data processing compared to IP-based methods. As well as, the algorithm can simulate the analysis of a backup system will help. The proposed approach significantly increases the performance, reliability and quality of implemented solutions.

A likelihood ratio anomaly detector for identifying within-perimeter computer network attacks

The rapid detection of attackers within firewalls of enterprise computer networks is of paramount importance. Anomaly detectors address this problem by quantifying deviations from baseline statistical models of normal network behavior and signaling an intrusion when the observed data deviates significantly from the baseline model. However, many anomaly detectors do not take into account plausible attacker behavior. As a result, anomaly detectors are prone to a large number of false positives due to unusual but benign activity. This paper first introduces a stochastic model of attacker behavior which is motivated by real world attacker traversal. Then, we develop a likelihood ratio detector that compares the probability of observed network behavior under normal conditions against the case when an attacker has possibly compromised a subset of hosts within the network. Since the likelihood ratio detector requires integrating over the time each host becomes compromised, we illustrate how to use Monte Carlo methods to compute the requisite integral. We then present Receiver Operating Characteristic (ROC) curves for various network parameterizations that show for any rate of true positives, the rate of false positives for the likelihood ratio detector is no higher than that of a simple anomaly detector and is often lower. We conclude by demonstrating the superiority of the proposed likelihood ratio detector when the network topologies and parameterizations are extracted from real-world networks.

Enterprise Computer Network Reliability Analysis

This paper considers the multi-protocol label switching enterprise computer network routing optimization problem, in the network reliability constraints, by selecting the optimal work and alternate paths, and carries on the bandwidth allocation; network total construction cost is minimal. Due to the total construction cost and network reliability is related to choice of the length of the path, the optimal route network design problem can be decoupled into two sub-problems: cost and reliability related issues, among them, the cost of related sub problem study, Sohn et al. For reliability related problems, reduce the search space understanding, this chapter will work best and standby path search space from a hyper plane reduce to the hyper plane line; Then, reliability related algorithm is proposed to solve the problem. Because of the cost and reliability related sub-problem solutions are obtained based on the same search criterion, so the original problem of optimal work and backup path of solution set is by comparing the two sub problems solution to work out. Finally, related algorithm provides a numerical example to verify the reliability and the validity of the global network routing design method.

A Corporate Computer Network Security System Design and Implementation

With the rapid development of economy and society, the growing prosperous computer network technology has now become one of the indispensable elements in human life. Small to every household personal computer systems, large to computer systems concerned countries, they are incorporated into the scope of computer network security systems. Enterprises are social living cells, with important role of financial intermediation, the mining technology and training personnel. Corporate computer systems is an important part to ensure high-speed operation of enterprises, summarize business information and protect trade secrets, therefore, the more developed computer network technology is, the more important the development and maintenance of corporate computer network security systems is. This article will explore the design and function of enterprise computer network security system implementations based on the characteristics of computer network security and enterprise computer network system.

The Analysis of Enterprise Network Security Problems

This paper analyses the security risks of the internal and external enterprise computer network, points out that the internal internet security of enterprise should focus on prevention which includes a variety of network security technology and the establishment of logging and review system. This paper also discusses the main technology of external internet security prevention such as firewall technology and encryption technology and so on and provides some suggestions about risk management and network security for some small and medium enterprises.

Об оптимальной конфигурации обманных систем в компьютерной сети предприятия

The article is devoted to the optimal configuration of honeypots in the enterprise network. It describes the mathematical model of an enterprise computer network with honeypots. The authors analyze the standard ways of setting up honeypot parameters and propose the optimization criterion with regard to the dynamics of the external environment. The optimization problem of configuring decoys is reviewed and the solution of the problem is discussed. Also a procedure of searching optimal honeypot configuration is proposed and recommendations concerning practical appliance of the obtained results are given.

An OVAL-based active vulnerability assessment system for enterprise computer networks

Many security problems are caused by vulnerabilities hidden in enterprise computer networks. It is very important for system administrators to have knowledge about the security vulnerabilities. How...