Analyzing Network Traffic for Malicious Hacker Activity

Since the Internet came into life in the 1970s, it has been growing more than 100% every year. On the other hand, the solutions to detecting network intrusion are far outpaced. The economic impact of malicious attacks in lost revenue to a single e-commerce company can vary from 66 thousand up to 53 million US dollars. At the same time, there is no effective mathematical model widely available to distinguish anomaly network behaviours such as port scanning, system exploring, virus and worm propagation from normal traffic. PDS proposed by Random Knowledge Inc., detects and localizes traffic patterns consistent with attacks hidden within large amounts of legitimate traffic. With the network’s packet traffic stream being its input, PDS relies on high fidelity models for normal traffic from which it can critically judge the legitimacy of any substream of packet traffic. Because of the reliability on an accurate baseline model for normal network traffic, in this workshop, we concentrate on modelling normal network traffic with a Poisson process

Network analysis of online bidding activity

With the advent of digital media, people are increasingly resorting to online channels for commercial transactions. Online auction is a prototypical example. In such online transactions, the pattern of bidding activity is more complex than traditional online transactions; this is because the number of bidders participating in a given transaction is not bounded and the bidders can also easily respond to the bidding instantaneously. By using the recently developed network theory, we study the interaction patterns between bidders (items) who (that) are connected when they bid for the same item (if the item is bid by the same bidder). The resulting network is analyzed by using the hierarchical clustering algorithm, which is used for clustering analysis for expression data from DNA microarrays. A dendrogram is constructed for the item subcategories; this dendrogram is compared with a traditional classification scheme. The implication of the difference between the two is discussed.Comment: 8 pages and 11 figure

Shaping Social Activity by Incentivizing Users

Events in an online social network can be categorized roughly into endogenous events, where users just respond to the actions of their neighbors within the network, or exogenous events, where users take actions due to drives external to the network. How much external drive should be provided to each user, such that the network activity can be steered towards a target state? In this paper, we model social events using multivariate Hawkes processes, which can capture both endogenous and exogenous event intensities, and derive a time dependent linear relation between the intensity of exogenous events and the overall network activity. Exploiting this connection, we develop a convex optimization framework for determining the required level of external drive in order for the network to reach a desired activity level. We experimented with event data gathered from Twitter, and show that our method can steer the activity of the network more accurately than alternatives

Noise Enhanced Activity in a Complex Network

We consider the influence of local noise on a generalized network of populations having positive and negative feedbacks. The population dynamics at the nodes is nonlinear, typically chaotic, and allows cessation of activity if the population falls below a threshold value. We investigate the global stability of this large interactive system, as indicated by the average number of nodal populations that manage to remain active. Our central result is that the probability of obtaining active nodes in this network is significantly enhanced under fluctuations. Further, we find a sharp transition in the number of active nodes as noise strength is varied, along with clearly evident scaling behaviour near the critical noise strength. Lastly, we also observe noise induced temporal coherence in the active sub-network, namely, there is an enhancement in synchrony among the nodes at an intermediate noise strength.Comment: 7 pages, 11 figure

Contagion effects in the world network of economic activities

Using the new data from the OECD-WTO world network of economic activities we construct the Google matrix $G$ of this directed network and perform its detailed analysis. The network contains 58 countries and 37 activity sectors for years 1995, 2000, 2005, 2008, 2009. The construction of $G$, based on Markov chain transitions, treats all countries on equal democratic grounds while the contribution of activity sectors is proportional to their exchange monetary volume. The Google matrix analysis allows to obtain reliable ranking of countries and activity sectors and to determine the sensitivity of CheiRank-PageRank commercial balance of countries in respect to price variations and labor cost in various countries. We demonstrate that the developed approach takes into account multiplicity of network links with economy interactions between countries and activity sectors thus being more efficient compared to the usual export-import analysis. Our results highlight the striking increase of the influence of German economic activity on other countries during the period 1995 to 2009 while the influence of Eurozone decreases during the same period. We compare our results with the similar analysis of the world trade network from the UN COMTRADE database. We argue that the knowledge of network structure allows to analyze the effects of economic influence and contagion propagation over the world economy.Comment: this work is linked with arXiv:1504.06773 [q-fin.ST