Author: E. Allison Newcomb

Publisher:

Published: 2017

Total Pages: 155

ISBN-13:

Advances in information technology have transformed many aspects of how humans operate in today's world. We rely heavily on computer, information and communications networks for everything from entertainment and education, and from shopping to national defense. It is therefore critical that our networks and information are protected to ensure their availability and integrity. If one considers the omnipresent nature of information technology and its many users, it is easy to imagine that tremendous amounts of data are generated every minute of every day, all around the world. The volume, variety, velocity and veracity of that data complicate efforts to protect it and the networks used for its creation and transmission. Defending computer networks against infiltrations is a complex task. Intrusion detection systems alert analysts to activity that breaches security policy, but the alerts must be investigated to determine whether the activity was benign, suspicious or malicious. The attack surface is vast, the network components are heterogeneous, and the wide array of software applications complicate the analyst's investigation. Experience has shown that decreasing the time between an alert firing and starting an investigation (lag time) is essential to improving the security of the network. This dissertation addresses the issue of shortening the lag time through the implementation of a fuzzy logic construct, the novel use of a military targeting methodology, and a related business process improvement. As part of this dissertation, models were developed and simulations executed to validate the efficacy of the fuzzy logic construct. The research then extended the fuzzy logic construct from the domain of military intelligence analysis to the cyber security domain. Experiments using datasets from cyber defense competitions were performed to validate the successful extension and implementation of the fuzzy logic construct. The interpretation of the results from this research indicate that the method of identifying network critical assets and the resulting fuzzy logic rules significantly decrease lag time. These results also show that the increased granularity in the fuzzy logic rules leads to greater understanding of the network environments for which the computer and information security staff are responsible.