System and method for privacy-enhanced cyber data fusion using temporal-behavioral aggregation and analysis

A monitoring device for determining, within a deployed environment over a data communication network, network threats and their associated behaviors, the monitoring device comprising:

• a processor configured to
• acquire sensor data that identifies a specific contact;
• normalize the acquired sensor data to generate transformed sensor data;
• derive, for the specific contact from the transformed sensor data, a contact behavior feature vector for each of a plurality of time periods;
• determine, for the specific contact from the contact behavior feature vector, scores associated with each of a plurality of classification modules to form a contact score vector, the contact score vector being independent of an identity of the specific contact;
• identify a type of the specific contact based on the contact score vector;
• and
• determine a threat type, based on the contact behavioral profile and the contact score vector, when the type of the specific contact is determined to be a threat.

A system for determining, within a deployed environment over a data communication network, network threats and their associated behaviors, the system comprising:

• means for acquiring sensor data that identifies a specific contact;
• means for normalizing the acquired sensor data to generate transformed sensor data;
• means for deriving, for the specific contact from the transformed sensor data, a contact behavior feature vector for each of a plurality of time periods;
• means for determining, for the specific contact from the contact behavior feature vector, scores associated with each of a plurality of classification modules to form a contact score vector, the contact score vector being independent of an identity of the specific contact;
• means for identifying a type of the specific contact based on the contact score vector;
• and
• means for determining a threat type, based on the contact behavioral profile and the contact score vector, when the type of the specific contact is determined to be a threat.

A non-transitory computer-readable medium storing a computer program, which when executed by a computer, causes the computer to determine, within a deployed environment over a data communication network, network threats and their associated behaviors by performing the steps of:

• acquiring sensor data that identifies a specific contact;
• normalizing the acquired sensor data to generate transformed sensor data;
• deriving, for the specific contact from the transformed sensor data, a contact behavior feature vector for each of a plurality of time periods;
• determining, for the specific contact from the contact behavior feature vector, scores associated with each of a plurality of classification modules to form a contact score vector, the contact score vector being independent of an identity of the specific contact;
• identifying a type of the specific contact based on the contact score vector;
• and
• determining a threat type, based on the contact behavioral profile and the contact score vector, when the type of the specific contact is determined to be a threat in the identifying step.