Download - Academy Publisher

aggregated to form the alarm flow. The aggregated flow
revealed not only the overall regularities but also the
behaviors of malicious events, even though the
significance of individual alarms was unclear. Therefore,
the flow characterization can be beneficial in enabling the
administrator to have a real-time view of security threat
situation.
Because of the dynamic characteristics of network
environments, alarm flow is dynamic, huge, infinite and
fast changing. So traditional stationary time series
analysis techniques can not work well to adapt to changes
in the flow. To overcome this problem, we apply Singular
Spectrum Analysis (SSA) [14] approach on the alarm
flow to process threat evaluations. We found that the
alarm flow has a small intrinsic dimension, and the
structure of alarm flow can be decomposed by two
subsets of principal components, that is, the subset of
leading components and the subset of residual
components. Base on this, we can reconstruct the two
parts of the original alarm flow, then threat situations
hidden in the flow are visible and threat trends can be
predicated.
The rest of the paper is organized as follows. In
Section 2, apply the SSA on the alarm flows, the leading
components which are responsible for the basic parts of
the flow, and the residual components which represents
noise part of the flow are separated. Section 3 process the
threat evaluation with case studies and experiments.
Section 4 concludes the paper and outlines future work
II. SSA-BASED FLOW DECOMPOSITION
The SSA method is a powerful non-parametric
technique of time series analysis, and based on principles
of multivariate statistics. It has been applied to many
areas such as analyzing meteorological, climatic and
geophysical time series [15]. The aim we using SSA is to
make a in-depth understanding of the structures of the
alarm flow. To understand the main features of the
components forming the alarm flow is critical for threat
evaluations.
Considering the original alarm flow X(t), we assume it
can be described by two parts: σ ( t)
and ε ( t)
; that is, a
decomposition of X(t) into a sum of two series:
xt = σ
t
+ εt
, where, the series σ ( t)
are associated with
leading components of the flow, which forms the basic
part of the information. It can be well approximated by
linear recurrence formula σ
t
= ασ +Lα σ of order
1 t−1
d t−d
d with coefficients α L α . This implies that the basic
1 d
part of the flow smooth enough to be modeled as
weighted sum of previous observations. Then, the ε ( t)
represents the residual components of the flow, which
capture the small variations, and it cannot be well
approximated by the finite-difference equations. In other
word, it do not fit in the basic part of the alarm flow and
can be interpreted as noise part of the flow. The noise
may be a interference to the threat evaluations.
Then, we apply SSA to separate the two parts of the
alarm flow. The process consists of four main steps,
which are performed as flows:
·Step 1: Embedding. Let X(t){ x t : 1