A study on labeling network hostile behavior with Intelligent Interactive tools

Abstract

Labeling a real network dataset is specially expensive in computersecurity, as an expert has to ponder several factors before assigningeach label. This paper describes an interactive intelligent systemto support the task of identifying hostile behaviors in network logs.The RiskID application uses visualizations to graphically encodefeatures of network connections and promote visual comparison. Inthe background, two algorithms are used to actively organize con-nections and predict potential labels: a recommendation algorithmand a semi-supervised learning strategy. These algorithms togetherwith interactive adaptions to the user interface constitute a behaviorrecommendation. A study is carried out to analyze how the algo-rithms for recommendation and prediction influence the workflowof labeling a dataset. The results of a study with 16 participantsindicate that the behaviour recommendation significantly improvesthe quality of labels. Analyzing interaction patterns, we identify amore intuitive workflow used when behaviour recommendation isavailable.