On the Applicability of the Power Law Signature in the Cyber Security Data

The power law distribution is a common statistical phenomenon observed in a wide range of natural and human-made systems including the cybersecurity data such as network and endpoint logs. We analyze the power law distribution of both laboratory and real-world data in cybersecurity. The signature, in most experiments, is in the form of a power law distribution. The tail or head of the power law distribution can show the presence of an attacker depending on the application. In a DDoS attack, the head of the power law distribution shows the probability of an attacker's sending huge traffic. On the other hand, in a threat hunting application, the tail of the distribution shows the probability of the suspicious activity of an attacker that is rare in the network. Furthermore, learning the parameters of the power law distribution, as a new approach, can be embedded in the neural network model to help increase the generalizability of the model as well as out-of-distribution detection. Parameters of this distribution, in the context of the real-world, help understand the structure of the data in real time for attack detection purposes and to define a baseline for detecting an attack or anomaly behavior.