1 Big Data Analytics for Sophisticated Attack Detection

The number and complexity of cyber-attacks has been increasing steadily in recent years. The major players in today’s cyber conflicts are well organized and heavily funded teams with specific goals and objectives, some of which are working under a state umbrella. Adversaries are targeting the communication and information systems of government, military and indus-trial organizations and are willing to use large amounts of money, time and expertise to reach their goals. It is important to understand the problems and limitations that current technolo-gies face against advanced persistent threats (APT) and the possible benefits that big data analytics could provide. Since 2006, there have been a large number of advanced, well-orchestrated attacks against industry, military and state infrastructures: In 2006, China was accused of download-ing 10 to 20 terabytes of data from the US NIPRNet Military Network. In 2007, Estonia suf-fered a large-scale cyber-attack that significantly affected the government’s online services and financial institutions. In the same year, high-ranking British and US officials publicly accused the Chinese government of penetrating government and business networks in the UK and US. In 2008, at least three US oil companies were targets of cyber-attacks; none of thes