A genetic epidemiology approach to cyber-security

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• Limited understanding of factors determining host compromise likelihood in computer networks.
• Existing research primarily focuses on node and link failures, not individual host vulnerabilities.

Purpose of the Study:

• To systematically study patterns of threat activity for individual hosts within a university network.
• To associate network services running on hosts with their susceptibility to specific threats.
• To develop a methodology for determining host infection probabilities and creating cybersecurity metrics.

Main Methods:

• Collected and analyzed threat log data from a university network.
• Performed network-wide scans to observe host properties and running services.
• Applied a methodology inspired by genetic association studies to link services with threats.
• Calculated probabilities of infection based on observed data.

Main Results:

• Established associations between specific network services and susceptibility to particular cyber threats.
• Demonstrated a method to quantify host infection probabilities directly from observational data.
• Identified patterns of threat activity for individual hosts.

Conclusions:

• Network services are key indicators of a host's vulnerability to cyber threats.
• The proposed methodology offers an automated, high-throughput strategy for cybersecurity assessment.
• This approach enables the development of comprehensive metrics for enhancing network security.