RankAOH

Context-driven similarity-based retrieval of experiences in cyber analysis

Chen Zhong, Deepak Samuel, John Yen, Peng Liu, Robert Erbacher, Steve Hutchinson, Renee Etoty, Hasan Cam, William Glodek

Research output: Chapter in Book/Report/Conference proceedingConference contribution

12 Citations (Scopus)

Abstract

In cyber analysis, it is highly desirable to support the analysis of junior analysts by leveraging the experiences of experts. But, there are two major challenges to achieve this goal. First, it is very costly to capture the experience of experts for the complex task of cyber analysis using traditional approaches such as protocol analysis. Second, it is difficult to identify previous experiences of experts that are relevant to the dynamic context of an analyst's cyber analysis task. To address the first challenge, a system has been developed to capture non-intrusively the analytical reasoning processes of analysts. To tackle the second challenge, this paper presents an effective and efficient approach for retrieving relevant experiences based on the dynamically changing context of cyber analysis. We define an experience as a process of analytical reasoning and adopt an Action-Observation-Hypothesis (A-O-H) model to represent the processes in cyber analysis. Based on this model, a tool for capturing and supporting the analytical reasoning processes is shown to be able to support the elusive cognitive process in dynamic cyber situations. The experience retrieval approach of this paper supports the efficient experience retrieval, and dynamically updates the results as the context of analysis evolves. The experience retrieval approach is evaluated, based on the precision and recall with respect to the ground truth. The evaluation results suggest that the proposed approach supports significantly the analytical reasoning of analysts by leveraging the experiences of experts.

Original languageEnglish (US)
Title of host publication2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014
PublisherIEEE Computer Society
Pages230-236
Number of pages7
ISBN (Print)9781479935642
DOIs
StatePublished - Jan 1 2014
Event2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014 - San Antonio, TX, United States
Duration: Mar 3 2014Mar 6 2014

Publication series

Name2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014

Other

Other2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014
CountryUnited States
CitySan Antonio, TX
Period3/3/143/6/14

All Science Journal Classification (ASJC) codes

  • Software

Cite this

Zhong, C., Samuel, D., Yen, J., Liu, P., Erbacher, R., Hutchinson, S., ... Glodek, W. (2014). RankAOH: Context-driven similarity-based retrieval of experiences in cyber analysis. In 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014 (pp. 230-236). [6816567] (2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014). IEEE Computer Society. https://doi.org/10.1109/CogSIMA.2014.6816567
Zhong, Chen ; Samuel, Deepak ; Yen, John ; Liu, Peng ; Erbacher, Robert ; Hutchinson, Steve ; Etoty, Renee ; Cam, Hasan ; Glodek, William. / RankAOH : Context-driven similarity-based retrieval of experiences in cyber analysis. 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014. IEEE Computer Society, 2014. pp. 230-236 (2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014).
@inproceedings{c603eed6dbf4446d90b3dbb2c6acc0f2,
title = "RankAOH: Context-driven similarity-based retrieval of experiences in cyber analysis",
abstract = "In cyber analysis, it is highly desirable to support the analysis of junior analysts by leveraging the experiences of experts. But, there are two major challenges to achieve this goal. First, it is very costly to capture the experience of experts for the complex task of cyber analysis using traditional approaches such as protocol analysis. Second, it is difficult to identify previous experiences of experts that are relevant to the dynamic context of an analyst's cyber analysis task. To address the first challenge, a system has been developed to capture non-intrusively the analytical reasoning processes of analysts. To tackle the second challenge, this paper presents an effective and efficient approach for retrieving relevant experiences based on the dynamically changing context of cyber analysis. We define an experience as a process of analytical reasoning and adopt an Action-Observation-Hypothesis (A-O-H) model to represent the processes in cyber analysis. Based on this model, a tool for capturing and supporting the analytical reasoning processes is shown to be able to support the elusive cognitive process in dynamic cyber situations. The experience retrieval approach of this paper supports the efficient experience retrieval, and dynamically updates the results as the context of analysis evolves. The experience retrieval approach is evaluated, based on the precision and recall with respect to the ground truth. The evaluation results suggest that the proposed approach supports significantly the analytical reasoning of analysts by leveraging the experiences of experts.",
author = "Chen Zhong and Deepak Samuel and John Yen and Peng Liu and Robert Erbacher and Steve Hutchinson and Renee Etoty and Hasan Cam and William Glodek",
year = "2014",
month = "1",
day = "1",
doi = "10.1109/CogSIMA.2014.6816567",
language = "English (US)",
isbn = "9781479935642",
series = "2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014",
publisher = "IEEE Computer Society",
pages = "230--236",
booktitle = "2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014",
address = "United States",

}

Zhong, C, Samuel, D, Yen, J, Liu, P, Erbacher, R, Hutchinson, S, Etoty, R, Cam, H & Glodek, W 2014, RankAOH: Context-driven similarity-based retrieval of experiences in cyber analysis. in 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014., 6816567, 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014, IEEE Computer Society, pp. 230-236, 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014, San Antonio, TX, United States, 3/3/14. https://doi.org/10.1109/CogSIMA.2014.6816567

RankAOH : Context-driven similarity-based retrieval of experiences in cyber analysis. / Zhong, Chen; Samuel, Deepak; Yen, John; Liu, Peng; Erbacher, Robert; Hutchinson, Steve; Etoty, Renee; Cam, Hasan; Glodek, William.

2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014. IEEE Computer Society, 2014. p. 230-236 6816567 (2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - RankAOH

T2 - Context-driven similarity-based retrieval of experiences in cyber analysis

AU - Zhong, Chen

AU - Samuel, Deepak

AU - Yen, John

AU - Liu, Peng

AU - Erbacher, Robert

AU - Hutchinson, Steve

AU - Etoty, Renee

AU - Cam, Hasan

AU - Glodek, William

PY - 2014/1/1

Y1 - 2014/1/1

N2 - In cyber analysis, it is highly desirable to support the analysis of junior analysts by leveraging the experiences of experts. But, there are two major challenges to achieve this goal. First, it is very costly to capture the experience of experts for the complex task of cyber analysis using traditional approaches such as protocol analysis. Second, it is difficult to identify previous experiences of experts that are relevant to the dynamic context of an analyst's cyber analysis task. To address the first challenge, a system has been developed to capture non-intrusively the analytical reasoning processes of analysts. To tackle the second challenge, this paper presents an effective and efficient approach for retrieving relevant experiences based on the dynamically changing context of cyber analysis. We define an experience as a process of analytical reasoning and adopt an Action-Observation-Hypothesis (A-O-H) model to represent the processes in cyber analysis. Based on this model, a tool for capturing and supporting the analytical reasoning processes is shown to be able to support the elusive cognitive process in dynamic cyber situations. The experience retrieval approach of this paper supports the efficient experience retrieval, and dynamically updates the results as the context of analysis evolves. The experience retrieval approach is evaluated, based on the precision and recall with respect to the ground truth. The evaluation results suggest that the proposed approach supports significantly the analytical reasoning of analysts by leveraging the experiences of experts.

AB - In cyber analysis, it is highly desirable to support the analysis of junior analysts by leveraging the experiences of experts. But, there are two major challenges to achieve this goal. First, it is very costly to capture the experience of experts for the complex task of cyber analysis using traditional approaches such as protocol analysis. Second, it is difficult to identify previous experiences of experts that are relevant to the dynamic context of an analyst's cyber analysis task. To address the first challenge, a system has been developed to capture non-intrusively the analytical reasoning processes of analysts. To tackle the second challenge, this paper presents an effective and efficient approach for retrieving relevant experiences based on the dynamically changing context of cyber analysis. We define an experience as a process of analytical reasoning and adopt an Action-Observation-Hypothesis (A-O-H) model to represent the processes in cyber analysis. Based on this model, a tool for capturing and supporting the analytical reasoning processes is shown to be able to support the elusive cognitive process in dynamic cyber situations. The experience retrieval approach of this paper supports the efficient experience retrieval, and dynamically updates the results as the context of analysis evolves. The experience retrieval approach is evaluated, based on the precision and recall with respect to the ground truth. The evaluation results suggest that the proposed approach supports significantly the analytical reasoning of analysts by leveraging the experiences of experts.

UR - http://www.scopus.com/inward/record.url?scp=84902096381&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84902096381&partnerID=8YFLogxK

U2 - 10.1109/CogSIMA.2014.6816567

DO - 10.1109/CogSIMA.2014.6816567

M3 - Conference contribution

SN - 9781479935642

T3 - 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014

SP - 230

EP - 236

BT - 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014

PB - IEEE Computer Society

ER -

Zhong C, Samuel D, Yen J, Liu P, Erbacher R, Hutchinson S et al. RankAOH: Context-driven similarity-based retrieval of experiences in cyber analysis. In 2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014. IEEE Computer Society. 2014. p. 230-236. 6816567. (2014 IEEE International Inter-Disciplinary Conference on Cognitive Methods in Situation Awareness and Decision Support, CogSIMA 2014). https://doi.org/10.1109/CogSIMA.2014.6816567