Discovery of persistent threat structures through temporal and geo-spatial characterization in evolving networks

The focus of this paper is to characterize the behavior of large, evolving networks, in terms of central nodes to identify patterns that may be conducive to persistent threat structures over time and geo-spatial regions. We propose an approach to monitor central nodes to determine Consistency and Inconsistency (CoIn) in their availability across time periods. Our approach also identifies the time periods and spatial regions associated with CoIn. We present experimental results using real world internet traffic trace data which indicates the potential of our approach to identify actionable information in terms of identifying locations of interest and patterns of deviations.