Information Security Analysis as Data Fusion

Engineering of detection systems for Information Security (InfoSec) is still an emerging field, when compared to Multisensor Data Fusion (MSDF). The two fields share important features: diverse data sources, a need for automated assistance in timely situation assessment, and an operational dimension with real consequences. There is an important difference: InfoSec operates mostly in an information space, so much of the MSDF literature on low-level data fusion is not transferable to the InfoSec domain. Application of advanced analytic approaches such as Machine Learning to InfoSec problems in intrusion detection has been uneven at best, with many projects failing to yield clean signals, and deep and widespread (and generally justified) skepticism among subject matter experts. [1] [2] It is vital to construct a useful model of what Security Analysis is, if we hope to automate the process, or even augment human effort with better automated support. The conceptual frameworks in use in InfoSec today focus on the operational dimension without providing a clear roadmap for building automation. In this paper, we present a framework for automation of security analysis based on the Dasarathy model of Data Fusion, as extended by Steinberg and Bowman [3] (DSB). Adapting the DSB framework to Information Security contextualizes much of the existing work in security automation, exposes its limitations and gaps, and provides a roadmap to closing those gaps. It is the goal of this work to guide Data Scientists and Engineers in how to develop semantic and contextual information in an automated data fusion system, to enable effective application of machine learning approaches to problems in detection & response.