Exploring Information Centrality for Intrusion Detection in Large
  Networks
  Modern networked systems are constantly under threat from systemic attacks.
There has been a massive upsurge in the number of devices connected to a
network as well as the associated traffic volume. This has intensified the need
to better understand all possible attack vectors during system design and
implementation. Further, it has increased the need to mine large data sets,
analyzing which has become a daunting task. It is critical to scale monitoring
infrastructures to match this need, but a difficult goal for the small and
medium organization. Hence, there is a need to propose novel approaches that
address the big data problem in security. Information Centrality (IC) labels
network nodes with better vantage points for detecting network-based anomalies
as central nodes and uses them for detecting a category of attacks called
systemic attacks. The main idea is that since these central nodes already see a
lot of information flowing through the network, they are in a good position to
detect anomalies before other nodes. This research first dives into the
importance of using graphs in understanding the topology and information flow.
We then introduce the usage of information centrality, a centrality-based
index, to reduce data collection in existing communication networks. Using
IC-identified central nodes can accelerate outlier detection when armed with a
suitable anomaly detection technique. We also come up with a more efficient way
to compute Information centrality for large networks. Finally, we demonstrate
that central nodes detect anomalous behavior much faster than other non-central
nodes, given the anomalous behavior is systemic in nature.
