<p> Organizations of all types and their computer networks are constantly under threat of attack. While the overall detection time of these attacks is getting shorter, the average detection time of weeks to months allows the attacker ample time to potentially cause damage to the organization. Current detection methods are primarily signature based and typically rely on analyzing the available data sources in isolation. Any analysis of how the individual data sources relate to each other is usually a manual process, and will most likely occur as a forensic endeavor after the attack identification occurs via other means. The use of graph theory and the graph databases built to support its application can provide a repeatable and automated analysis of the data sources and their relationships. By aggregating the individual data sources into a graph database based on a model that supports the data types and relationships, database queries can extract information relevant to the detection of attack behavior within the network. The work in this Praxis shows how the graph model and database queries will reduce the overall time to detection of a successful attack by enabling defenders to understand better how the data elements and what they represent are related.</p><p>
| Identifer | oai:union.ndltd.org:PROQUEST/oai:pqdtoai.proquest.com:10785425 |
| Date | 27 April 2018 |
| Creators | Neise, Patrick |
| Publisher | The George Washington University |
| Source Sets | ProQuest.com |
| Language | English |
| Detected Language | English |
| Type | thesis |
Page generated in 0.0013 seconds