Manifold Learning and Bayesian Characterization of Computer NetworkTraffic Supporting Machine Learning-Based Cyber System Protection
Bibliographic record
Abstract
State-of-the-art cyber security rests on dynamic creation of graphical networks which model computer network traffic.This in turn allows for the assessment of optimal pathways relating different nodal components which comprise the cyber system.The estimation of such networks for cyber systems relies on robust statistical methods which provide structural understanding of cyber system components.Considering new technological initiatives directed towards using network theory as a tool to model the psychology lying behind cyber intrusion, a full top-to-bottom machine learning formulism and methodology for characterizing a computer network system is explored.The new aspect of this work is the utilization not only of classical frequentist methods for analysis but manifold learning and Bayesian methods for characterization and modelling of the interrelationships of cyber system network nodes.Such systematic analysis allows for ease of implementation of dynamic programming-based analysis directed towards optimal pathway and optimal stopping estimation.The focus of this work is on the application of statistical methods to noise-laden, freely available 4-dimensional computer network data consisting of date, internet protocol site number, remote autonomous system numbers, and connection counts across 10 computer server sites.The objective is to demonstrate how confidence in statistical cyber behavior can be gained using multiple exploratory machine learning techniques exploited as local and global describers of cyber intrusion variability.Preliminary results show that frequentist statistics and matrix factorizations can distill Poisson probability distributions along with sub-group structure for internet protocol network traffic.Such methods can also provide insight into the relative contributions of specific internet protocol sites to global and local connection count variance.A particular sub-group of locally non-distinct, correlated internet protocol sites possess a background network structure which could be interpreted as a hidden mode of network intrusion.Manifold learning provides consistent topological results where characteristic changes in internet protocol connection counts appear near a cusp in the manifolds.Principal component analysis eigenvalue and scree plots provide evidence that only four dimensions or internet protocol sites are responsible for the global variance-based manifold.This is consistent with non-negative matrix factorization eigenmode spectral results.Bayesian belief networks are applied as a tool to analyze the conditional probabilistic relationships existing between internet protocol server sites modeled as multi-state random variable nodes.Using the Peter and Clark algorithm for Bayesian belief network structural network learning, Bayesian belief network analysis shows specific IP sites which comprise sub-networks, including converging ones, and which parameterize the conditional probability of intrusion at server site A given server site B. The connections learned by the model are similar but not totally consistent with the correlations found in the frequentist statistics-based correlation matrix.Simulation-based instantiations at specific IP sites in the Bayesian belief network provide evidence of intrusion frequency probability, allowing information technology personnel insight into where and how resources should be placed and used to protect vital cyber systems.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.002 | 0.012 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.001 | 0.001 |
| Bibliometrics | 0.002 | 0.001 |
| Science and technology studies | 0.001 | 0.002 |
| Scholarly communication | 0.001 | 0.002 |
| Open science | 0.001 | 0.001 |
| Research integrity | 0.001 | 0.001 |
| Insufficient payload (model declined to judge) | 0.002 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".