Paul Hyden

Network topology and mean infection times

A fundamental concept of social network analysis is centrality. Many analyses represent the network topology in terms of concept transmission/variation, e.g., influence, social structure, community or other aggregations. Even when the temporal nature of the network is considered, analysis is conducted at discrete points along a continuous temporal scale. Unfortunately, well-studied metrics of centrality do not take varying probabilities into account. The assumption that social and other networks that may be physically stationary, e.g., hard wired, are conceptually static in terms of information diffusion or conceptual aggregation (communities, etc.) can lead to incorrect conclusions. Our findings illustrate, both mathematically and experimentally, that if the notion of network topology is not stationary or fixed in terms of the concept, e.g., groups, belonging, community or other aggregations, centrality should be viewed probabilistically. We show through some surprising examples that study of transmission behavior based solely on a graph’s topological and degree properties is lacking when it comes to modeling network propagation or conceptual (vs. physical) structure.

Using Network Topology to Supplement High Assurance Systems

We explore strategies for manipulating the topology of a network to promote increased and pragmatic high assurance. Topology matters to network threats and security, and the relative distance between nodes can impact the rate of dispersion of viruses, as well as access times in denial of service(DoS), probing, and insider threat attacks. We suggest methods to separate threatening and threatened nodes with enough hops to reduce and degrade risks. This analysis provides network analysts with an option to include other measures such as risk to the construction and management of high assurance systems. We consider a scaled down model to demonstrate the proof of concept using artificial data. Specifically, we explore the efficacy of ring networks and the structure that occurs on k-hop networks when there are a prime number of nodes. This provides strategies and processes for real network operators to include information about risks associated with network participants. We consider a scaled down model to demonstrate the proof of concept using artificial data. Specifically, we explore the efficacy of ring networks and the structure that occurs on k-hop networks when there are a prime number of nodes. This provides strategies and processes for real network operators to include information about risks associated with network participants.

A Survey of Community Detection Algorithms Based On Analysis-Intent

There has been a significant amount of research dedicated to identifying community structures within graphs. Most of these studies have focused on partitioning techniques and the resultant quality of discovered groupings (communities) without regard for the intent of the analysis being conducted (analysis-intent). In many cases, a given network community can be composed of significantly different elements depending upon the context in which a partitioning technique is used or applied. Moreover, the number of communities within a network will vary greatly depending on the analysis-intent and thus the discretion quality and performance of algorithms will similarly vary. In this survey we review several algorithms from the literature developed to discover community structure within networks. We review these approaches from two analysis perspectives: role/process focused (category-based methods) and topological structure or connection focused (event-based methods). We discuss the strengths and weaknesses of each algorithm and provide suggestions on the algorithms’ use depending on analysis context.

Managing risk in high assurance systems by optimizing topological resources

We explore strategies for manipulating the topology of a network to promote increased and pragmatic high assurance systems. Topology matters to network threats and security, and the relative distance between nodes can impact the rate of dispersion of viruses, as well as access times in denial of service, probing, and insider threat attacks. We suggest methods to separate threatening and threatened nodes with enough hops to reduce and degrade risks. This work provides network analysts with an option to include other measures such as risk assessments to the construction and management of high assurance systems. We consider a scaled down model to demonstrate the proof of concept using artificial data. Specifically, we explore the efficacy of ring networks and the structure that occurs on k‐hop networks when there are a prime number of nodes. We introduce techniques for the randomization of network topologies to manage real‐time risk and provide a dynamic means to improve network security by increasing technical debt to a potential attacker.

Leveraging human decision making through the optimal management of centralized resources

Combining results from mixed integer optimization, stochastic modeling and queuing theory, we will advance the interdisciplinary problem of efficiently and effectively allocating centrally managed resources. Academia currently fails to address this, as the esoteric demands of each of these large research areas limits work across traditional boundaries. The commercial space does not currently address these challenges due to the absence of a profit metric. By constructing algorithms that explicitly use inputs across boundaries, we are able to incorporate the advantages of using human decision makers. Key improvements in the underlying algorithms are made possible by aligning decision maker goals with the feedback loops introduced between the core optimization step and the modeling of the overall stochastic process of supply and demand. A key observation is that human decision-makers must be explicitly included in the analysis for these approaches to be ultimately successful. Transformative access gives warfighters and mission owners greater understanding of global needs and allows for relationships to guide optimal resource allocation decisions. Mastery of demand processes and optimization bottlenecks reveals long term maximum marginal utility gaps in capabilities.

Utilizing Network Science and Honeynets for Software Induced Cyber Incident Analysis

Increasing situational awareness and investigating the cause of a software-induced cyber attack continues to be one of the most difficult yet important endeavors faced by network security professionals. Traditionally, these forensic pursuits are carried out by manually analyzing the malicious software agents at the heart of the incident, and then observing their interactions in a controlled environment. Both these steps are time consuming and difficult to maintain due to the ever changing nature of malicious software. In this paper we introduce a network science based framework which conducts incident analysis on a dataset by constructing and analyzing relational communities. Construction of these communities is based on the connections of topological features formed when actors communicate with each other. We evaluate our framework using a network trace of the Black Energy malware network, captured by our honey net. We have found that our approach is accurate, efficient, and could prove as a viable alternative to the current status quo.

Communicating uncertainty information across conceptual boundaries

Information about data collection and modeling risks are frequently locked with information providers rather than shared with downstream information consumers. Information consumers often ingest products automatically. Without protocols to inject uncertainty, the ensemble modeling products common in the modeling discipline cannot accurately account for the input uncertainty inherent to those products. Future work to establish use cases and incorporate practitioner-driven rules and protocols for transmitting tiered uncertainty information between information product producers and consumers will advance the needs of environmental, social, and economic actors in the ensemble modeling production chain. This in turn will allow for improved error transmission throughout the decision making enterprise.