Big Data Analytics in Cybersecurity

Onur Savas, Julia Deng, Onur Savas, Julia Deng

• Publisher: CRC Press
• Year: 2017
• Print ISBN: 9781032096360
• eBook ISBN: 9781351650410
• Edition: 1
• Topic: Economics
• Subtopic: Statistics for Business & Economics
• Index: Economics

Big data is presenting challenges to cybersecurity. For an example, the Internet of Things (IoT) will reportedly soon generate a staggering 400 zettabytes (ZB) of data a year. Self-driving cars are predicted to churn out 4000 GB of data per hour of driving. Big data analytics, as an emerging analytical technology, offers the capability to collect, store, process, and visualize these vast amounts of data. Big Data Analytics in Cybersecurity examines security challenges surrounding big data and provides actionable insights that can be used to improve the current practices of network operators and administrators.

Applying big data analytics in cybersecurity is critical. By exploiting data from the networks and computers, analysts can discover useful network information from data. Decision makers can make more informative decisions by using this analysis, including what actions need to be performed, and improvement recommendations to policies, guidelines, procedures, tools, and other aspects of the network processes.

Bringing together experts from academia, government laboratories, and industry, the book provides insight to both new and more experienced security professionals, as well as data analytics professionals who have varying levels of cybersecurity expertise. It covers a wide range of topics in cybersecurity, which include:

• Network forensics
• Threat analysis
• Vulnerability assessment
• Visualization
• Cyber training.

In addition, emerging security domains such as the IoT, cloud computing, fog computing, mobile computing, and cyber-social networks are examined.

The book first focuses on how big data analytics can be used in different aspects of cybersecurity including network forensics, root-cause analysis, and security training. Next it discusses big data challenges and solutions in such emerging cybersecurity domains as fog computing, IoT, and mobile app security. The book concludes by presenting the tools and datasets for future cybersecurity research.

IApplying Big Data into Different Cybersecurity Aspects

1The Power of Big Data in Cybersecurity

Song Luo, Malek Ben Salem, and Yan Zhai

1.1Introduction to Big Data Analytics

1.1.1What Is Big Data Analytics?

1.1.2Differences between Traditional Analytics and Big Data Analytics

1.1.2.1Distributed Storage

1.1.2.2Support for Unstructured Data

1.1.2.3Fast Data Processing

1.1.3Big Data Ecosystem

1.2The Need for Big Data Analytics in Cybersecurity

1.2.1Limitations of Traditional Security Mechanisms

1.2.2The Evolving Threat Landscape Requires New Security Approaches

1.2.3Big Data Analytics Offers New Opportunities to Cybersecurity

1.3Applying Big Data Analytics in Cybersecurity

1.3.1The Category of Current Solutions

1.3.2Big Data Security Analytics Architecture

1.3.3Use Cases

1.3.3.1Data Retention/Access

1.3.3.2Context Enrichment

1.3.3.3Anomaly Detection

1.4Challenges to Big Data Analytics for Cybersecurity

References

This chapter introduces big data analytics and highlights the needs and importance of applying big data analytics in cybersecurity to fight against the evolving threat landscape. It also describes the typical usage of big data security analytics including its solution domains, architecture, typical use cases, and the challenges. Big data analytics, as an emerging analytical technology, offers the capability to collect, store, process, and visualize big data, which are so large or complex that traditional data processing applications are inadequate to deal with them. Cybersecurity, at the same time, is experiencing the big data challenge due to the rapidly growing complexity of networks (e.g., virtualization, smart devices, wireless connections, Internet of Things, etc.) and increasing sophisticated threats (e.g., malware, multistage, advanced persistent threats [APTs], etc.). Accordingly, traditional cybersecurity tools become ineffective and inadequate in addressing these challenges and big data analytics technology brings in its advantages, and applying big data analytics in cybersecurity becomes critical and a new trend.

1.1Introduction to Big Data Analytics

1.1.1What Is Big Data Analytics?

Big data is a term applied to data sets whose size or type is beyond the ability of traditional relational databases to capture, manage, and process. As formally defined by Gartner [1], “Big data is high-volume, high-velocity and/or high-variety information assets that demand cost-effective, innovative forms of information processing that enable enhanced insight, decision making, and process automation.” The characteristics of big data are often referred to as 3Vs: Volume, Velocity, and Variety. Big data analytics refers to the use of advanced analytic techniques on big data to uncover hidden patterns, unknown correlations, market trends, customer preferences and other useful business information. Advanced analytics techniques include text analytics, machine learning, predictive analytics, data mining, statistics, natural language processing, and so on. Analyzing big data allows analysts, researchers, and business users to make better and faster decisions using data that was previously inaccessible or unusable.

1.1.2Differences between Traditional Analytics and Big Data Analytics

There is a big difference between big data analytics and handling a large amount of data in a traditional manner. While a traditional data warehouse mainly focuses more on structured data relying on relational databases, and may not be able to handle semistructured and unstructured data well, big data analytics offers key advantages of processing unstructured data using a nonrelational database. Furthermore, data warehouses may not be able to handle the processing demands posed by sets of big data that need to be updated frequently or even continually. Big data analytics is able to deal with them well by applying distributed storage and distributed in-memory processing.

1.1.2.1Distributed Storage

“Volume” is the first “V” of Gartner’s definition of big data. One key feature of big data is that it usually relies on distributed storage systems because the data is so massive (often at the petabyte or higher level) that it is impossible for a single node to store or process it. Big data also requires the storage system to scale up with future growth. Hyperscale computing environments, used by major big data companies such as Google, Facebook, and Apple, satisfy big data’s storage requirements by constructing from a vast number of commodity servers with direct-attached storage (DAS).

Many big data practitioners build their hyberscale computing environments using Hadoop [2] clusters. Initiated by Google, Apache Hadoop is an open-source software framework for distributed stor...

Table of contents

• Cover
• Half Title Page
• Series Page
• Title Page
• Copyright Page
• Contents
• Preface
• About the Editors
• Contributors
• Section I Applying Big Data into Different Cybersecurity Aspects
• Section II Big Data in Emerging Cybersecurity Domains
• Section III Tools and Datasets for Cybersecurity
• Index