Application of the Subdue Graph-based Relational Learning System to Detecting Anomalies and Security Threats (2004)

Content Provider	CiteSeerX
Author	Holder, Lawrence Cook, Diane Coble, Jeff Mukherjee, Miatrayee
Abstract	The ability to mine relational data has become a crucial challenge in many security-related domains. For example, the U.S. House and Senate Intelligence Committees ’ report on their inquiry into the activities of the intelligence community before and after the September 11, 2001 terrorist attacks revealed the necessity for “connecting the dots ” [], that is, focusing on the relationships between entities in the data, rather than merely on an entity's attributes. A natural representation for this information is a graph, and the ability to discover previously-unknown patterns in such information could lead to significant improvement in our ability to identify potential threats. We have developed techniques for learning patterns from relational data represented as a graph and implemented these techniques in the Subdue system []. We are applying Subdue to two specific security-related tasks: anomaly detection and threat detection. Anomaly Detection We investigate two methods for graph-based anomaly detection that have been implemented using the Subdue system []. The first, anomalous substructure detection, looks for specific, unusual substructures within a graph. In the second method, anomalous subgraph detection, the graph is partitioned into distinct sets of vertices (subgraphs), each of which is tested against the others for
File Format	PDF
Publisher Date	2004-01-01
Access Restriction	Open
Subject Keyword	Detecting Anomaly Security Threat Subdue Graph-based Relational Learning System Subdue System Relational Data Anomaly Detection Terrorist Attack Natural Representation Second Method U.s. House Specific Security-related Task Anomalous Substructure Detection Unusual Substructure Intelligence Community Anomalous Subgraph Detection Graph-based Anomaly Detection Previously-unknown Pattern Potential Threat Distinct Set Senate Intelligence Committee Report Many Security-related Domain Threat Detection Crucial Challenge
Content Type	Text