Malicious software activities, commonly known as “malware,” represent a big threat to modern society.

A UTSA-led research team is investigating ways to accurately predict these attacks. Mechanical Engineering Professor Yusheng Feng and doctoral student Van Trieu-Do in the Margie and Bill Klesse College of Engineering and Integrated Design, in collaboration with professor Shouhuai Xu from the Department of Computer Science at the University of Colorado at Colorado Springs, are studying how to use mathematical tools and supercomputer simulation to foresee cyberattacks.

According to the recent findings by the Atlas VPN team, blockchain hackers netted nearly $1.3 billion in 78 hack events throughout Q1 2022. In addition, hacks on Ethereum and Solana's ecosystems attributed to over $1 billion in losses alone during this quarter.

The current pervasive security threats motivated the UTSA researchers to develop and use cyber defense tools and sensors to monitor the threats and collect data, which can be used for various purposes in developing defense mechanisms.

“The current damages call for studies to understand and characterize cyber attacks from different perspectives and at various levels of intrusion. There are multiple variables that go into predicting the potential damage these attacks may cause as the aggressors get more sophisticated,” said Feng.

Using predictive situational awareness analysis, the team studied the distinctive nature of the attacks to accurately predict the threats that target and potentially harm personal devices, servers, and networks.

“Most studies on cyberattacks focus on microscopic levels of abstractions, meaning how to defend against a particular attack,” Feng said. “Cyber attackers can successfully break in by exploiting a single weakness in a computer system.”

The study aims to analyze the macroscopic levels of abstractions.

“Such macroscopic-level studies are important because they would offer insights towards holistic solutions to defending cyberattacks,” he added.

Feng explains, “It’s very hard to single out the cause of each attack, however, we have big data with time series for each IP address (location). In this research, we use ‘causality’ when there are inter-relationships among IP addresses that have similar patterns of temporal features for identifying the threat.”

The researchers utilized Granger causality (G-causality) to study the vulnerabilities from a regional perspective of multiple threats, analyzing the cause and effect to identify cyber vulnerabilities or how the infiltrators attack an entity, in this case, IP addresses.

G-causality is a statistical concept of causation that is based on prediction, to characterize causality, a well-defined mathematical notion has to be established. The research team used Granger causality to determine the nature of the cyberattack signals so the signals can be compared and analyzed holistically.

The team also plans to expand the current body of research and study further what other kinds of causality will impact users and how to develop the appropriate defense tools to protect against sophisticated attacks.

Any high-performance computing should be able to handle a vast amount of data in a short amount of time, an important aspect on which entire fields are based. Usually, the first step to managing a large amount of data is to either classify it based on well-defined attributes or--as is typical in machine learning "cluster" them into groups such that data points in the same group are more similar to one another than to those in another group. However, for an extremely large dataset, which can have trillions of sample points, it is tedious to even group data points into a single cluster without huge memory requirements.

"The problem can be formulated as follows: Suppose we have a clustering tool that can process up to lmax samples. The tool classifies l (input) samples into M(l) groups (as output) based on some attributes. Let the actual number of samples be L and G = M(L) be the total number of attributes we want to find. The problem is that if L is much larger than lmax, we cannot determine G owing to limitations in memory capacity," explains Professor Ryo Maezono from the Japan Advanced Institute of Science and Technology (JAIST) in Ishikawa, Japan, who specializes in computational condensed matter theory.

Interestingly enough, very large sample sizes are common in materials science, where calculations involving atomic substitutions in a crystal structure often involve possibilities ranging in trillions! However, a mathematical theorem called "Polya's theorem," which utilizes the symmetry of the crystal often simplifies the calculations to a great extent. Unfortunately, Polya's theorem only works for problems with symmetry and is, therefore, of limited scope.

In a recent study published in Advanced Theory and Simulations, a team of scientists led by Prof. Maezono and his colleague, Keishu Utimula, Ph.D. in material science from JAIST (In 2020) and first author of the study, proposed an approach based on statistical randomness to identify G for sample sizes much larger (~ trillion) than lmax. The idea, essentially, is to pick a sample of size l that is much smaller than L, identify M(l) using machine learning "clustering," and repeat the process by varying l. As l increases, the estimated M(l) converges to M(L) or G, provided G is considerably smaller than lmax (which is almost always satisfied). However, this is still a computationally expensive strategy, because it is tricky to know exactly when convergence has been achieved.

To address this issue, the scientists implemented another ingenious strategy: they made use of the "variance", or the degree of spread, in M(l). From simple mathematical reasoning, they showed that the variance of M(l), or V[M(l)], should have a peak for a sample size ~ G. In other words, the sample size corresponding to a maximum in V[M(l)] is approximately G! Furthermore, numerical simulations revealed that the peak variance itself scaled as 0.1 times G, and was thus a good estimate of G.

While the results are yet to be mathematically verified, the technique shows promise of finding applications in high-performance computing and machine learning. "The method described in our work has much wider applicability than Polya's theorem and can, therefore, handle a broader category of problems. Moreover, it only requires a machine learning clustering tool for sorting the data and does not require a large memory or whole sampling. This can make AI recognition technology feasible for larger data sizes even with small-scale recognition tools, which can improve their convenience and availability in the future," comments Prof. Maezono excitedly.

Sometimes, statistics is nothing short of magic, and this study proves that!