Characterization and Planning for Computer Network Operations

Whom we e-mail, where we browse, what we purchase, and the things we search for on the World Wide Web all leave identifiable traces of who we are as individuals. In today’s technology focused landscape, cyberspace represents the new environment in which we communicate, work, shop, and play, and the cyber behaviors we exhibit there give a great deal of insight into our individual identities. This dissertation proposes a novel approach to the modeling and analysis of behaviors based on a user’s cyber activities. We present a methodology to identify, extract, and analyze cyber behaviors providing the foundation for cyber-based behavioral modeling. In addition, we define the underpinnings necessary to support this approach through our behavioral extraction, Bayesian sample size estimation, and behavioral state-based techniques, then empirically evaluate their use. Methods are implemented to characterize, predict, and detect change in individual and group behaviors and we demonstrate their effectiveness using real world data. This research offers valuable contributions to a number of areas. Within the Department of Defense, this work provides the foundation to accurately and effectively represent and analyze the behavioral layers of the cyber situational awareness environment, which in turn will provide planners and decision makers critical information to achieve their mission. In addition, the financial sector may leverage behavioral models for fraud prevention and credit scoring while human resources can track employees by monitoring their behavior for malicious activity (insider threat) and for classifying and ranking user’s skills. E-commerce can use these techniques to further expand the scope of its profiling techniques to best characterize and predict purchase patterns for individuals and groups of online shoppers as well.