Statistical detection of intruders within computer networks using scan statistics

Joshua Neil, Curtis Storlie, Curtis Hash, Alex Brugh

Research output: Chapter in Book/Report/Conference proceedingChapter

8 Scopus citations


We introduce a computationally scalable method for detecting small anomalous subgraphs in large, time-dependent graphs. This work is motivated by, and validated against, the challenge of identifying intruders operating inside enterprise-sized computer networks with 500 million communication events per day. Every observed edge (time series of communications between each pair of computers on the network) is modeled using observed and hidden Markov models to establish baselines of behavior for purposes of anomaly detection. These models capture the bursty, often human-caused, behavior that dominates a large subset of the edges. Individual edge anomalies are common, but the network intrusions we seek to identify always involve coincident anomalies on multiple adjacent edges. We show empirically that adjacent edges are primarily independent and that the likelihood of a subgraph of multiple coincident edges can be evaluated using only models of individual edges. We define a new scan statistic in which subgraphs of specific sizes and shapes (out-stars and 3-paths) are tested. We show that identifying these building-block shapes is sufficient to correctly identify anomalies of various shapes with acceptable false discovery rates in both simulated and real-world examples.

Original languageEnglish (US)
Title of host publicationData Analysis for Network Cyber-Security
PublisherImperial College Press
Number of pages34
ISBN (Electronic)9781783263752
ISBN (Print)9781783263745
StatePublished - Jan 1 2014

ASJC Scopus subject areas

  • Computer Science(all)
  • Mathematics(all)


Dive into the research topics of 'Statistical detection of intruders within computer networks using scan statistics'. Together they form a unique fingerprint.

Cite this