Analyzing and Modeling Longitudinal Security Data: Promise and Pitfalls

Presentation pdf 2.7MB

Many cybersecurity problems today occur on a worldwide scale. However, we lack rigorous methods for determining how best to intervene and mitigate damage globally, both short- and long-term. Analysis of longitudinal security data promises to provide insight into the effectiveness and differential impacts of security interventions on a global scale. In this paper we consider the example of spam, studying a large high-resolution data set of messages sent from 260 ISPs in 60 countries over the course of a decade. The analysis is careful to use appropriate statistical techniques and avoid common pitfalls that could lead to erroneous conclusions. We show how factors such as geography, national economics, Internet connectivity and traffic flow impact can affect local spam concentrations. Additionally, we develop a statistical model to study temporal transitions in the dataset, and we use a simple extension of the model to investigate the effect of historical botnet takedowns on spam levels. We find that in aggregate most historical takedowns are beneficial in the short-term, but few have long-term impact. Further, even when takedowns are effective globally, they are often detrimental in specific geographic regions or countries. The analysis and modeling described here are based on a single data set. However, the techniques are general and could be adapted to other data sets to help improve decision making about when and how to deploy security interventions.

Author(s):

Benjamin Edwards    
University of New Mexico
United States

Steven Hofmeyr    
Lawrence Berkeley National Laboratory
United States

Stephanie Forrest    
University of New Mexico / Santa Fe Institute
United States

Michel van Eeten    
Delft University of Technology
Netherlands