Pith. sign in

REVIEW 3 major objections 5 minor 39 references

Network Risk Estimation: A Risk Estimation Paradigm for Cyber Networks

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Entity-level risks in a cyber network can be estimated from connection logs and sparse measurements by learning a functional connectivity graph and propagating risk through it with a Kalman filter.

desk verdict A clearly written graph-based risk propagation proposal for cyber networks, but the experiments never test the advertised measurement-refinement step. read the letter →

arxiv 2501.16487 v1 pith:PDSOS3AL submitted 2025-01-27 eess.SY cs.SY

Arda Bayer , David Maluf , Behnaam Aazhang This is my paper · ORCID
classification eess.SYcs.SY
keywords cybernetworksecurityquantitativeriskassessmentfunctionalconnectivitygraphKalmanfilterpropagationstateinferencesaferoutingsparsemeasurements
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Network Risk Estimation (NRE) is proposed as a data-driven replacement for risk measurement when only some endpoints can be measured. It tries to establish that entity risks propagate along learned relationships in the connection data, so that sparse observations can be extended into a full probabilistic risk picture. If this works, security teams can score every endpoint, route packets away from risky zones, and detect abnormal network states in real time. The paper demonstrates the scheme on a public intrusion dataset, where estimated entity risks support network-state classification even when raw measurements alone are not descriptive.

What carries the argument

The carrying object is the functional connectivity graph, a weighted matrix $F^{(t)}$ whose entry $F^{(t)}_{ij}$ is the magnitude of the Pearson correlation between entity $i$'s and entity $j$'s aggregated flow signals in a time window. This matrix is the linear system model: $x_{t+\tau}=F^{(t)}x_t$ says each entity's risk carries over and gains a weighted sum of its neighbors' risks. The Kalman predict/update recursions convert sparse measurements $z_t=H_t x_t+v_t$ into MMSE estimates, while a "relief factor" rescales posteriors to keep risks bounded, and spectral partitioning splits the network into independently estimated groups for scaling.

What would settle it

Run NRE on a network with known ground-truth infection times (for example, a red-team or worm-spread experiment): if entities NRE ranks as highest-risk are not infected before its low-ranked entities, the propagation model is wrong. A cleaner check is to replace the absolute Pearson correlation weights with a directed measure on the same flows and see whether the top-risk ordering changes materially.

Watch

Extended reading notes

Core claim

The paper's central claim is that risk behaves like a diffusing quantity on a time-varying weighted graph of entity influence. From flow records, the method builds a functional connectivity graph whose edge weights are the absolute Pearson correlations of synchronized per-entity activity signals. It then assumes the next risk vector is the current one multiplied by this graph matrix, $x_{t+\tau}=F^{(t)}x_t$, and uses a Kalman filter to fuse this propagation model with whichever entities happen to be measured. The output is a mean risk estimate $\hat{x}_{t|t}$ and an error covariance $P_{t|t}$ for every entity, which the paper argues provides a complete description of network state and supports quantitative management decisions such as safe routing.

Load-bearing premise

The load-bearing premise is that each entity's future risk is a weighted sum of its neighbors' current risks, with weights equal to the absolute correlation of their past activity signals; if attacks spread in a directed, nonlinear, or correlation-invisible way, the estimated scores could reflect statistical association rather than real compromise risk.

Editorial extensions

If this is right

  • Every entity in the network gets a quantitative risk score and a variance, including entities that are never directly measured.
  • Routing and other network management can be made security-aware by minimizing the maximum mean risk along a path, as illustrated by the simple safe-routing example.
  • When measurements are sparse or the measured connection parameter is weakly informative, NRE's propagated entity risks support attack/benign classification more consistently than a flow-only measurement model in the paper's experiments.
  • The method's running time scales as $O(n^{1.81})$ in entity count and the paper measures a 255-to-1 simulation-to-data time ratio, indicating real-time deployment is feasible with partitioned sub-networks.
  • The same probabilistic estimator applies whenever risk measurements arrive irregularly: no measurement just means running the predict step.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension, left implicit, is that the same functional-connectivity-plus-Kalman recipe applies to other dynamic networks where a latent state diffuses over measured activity, such as congestion, contamination, or financial stress.
  • The paper does not study feedback: safe routing changes flow patterns, which changes the functional connectivity graph, and the estimates would need to account for that loop in deployment.
  • The experiments validate against network-level attack labels, not ground-truth entity compromises; a direct test of whether top-ranked entities are compromised before low-ranked ones is still needed.
  • The paper notes other influence measures are possible; using directed information would test how much the undirected Pearson simplification matters for identifying directions of risk flow.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Network Risk Estimation (NRE), a probabilistic framework that estimates entity-level risks in a cyber network from connection data and sparse risk measurements. The method builds a functional connectivity graph from Pearson correlations of aggregated flow signals, assumes linear risk propagation via the update xt+τ = F(t)xt, and applies a Kalman filter to refine estimates when measurements arrive. The authors also introduce a relief factor to control risk scaling, use spectral partitioning for scalability, and demonstrate an application to safe routing. The main experimental evaluation is a binary classification task on the CIC-IDS-2017 dataset in which the network state (ATTACK vs. BENIGN) is inferred from the risk estimates, compared against a flow-based baseline (FBNSI), together with running-time measurements.

Significance. If validated, NRE would be a useful scalable tool for quantitative cyber-risk assessment that goes beyond direct measurement of a small set of entities. The paper is clearly written, the Kalman-filter derivation in Appendix A is standard and correct, and the implementation is open-source. The authors correctly identify a real practical problem: risk measurements are sparse in large, dynamic networks. The proposed architecture—graph inference, propagation, and Bayesian update—is plausible and the running-time analysis indicates that real-time operation is feasible on the tested scale. However, the central claim that sparse measurements refine and improve the risk estimates is not supported by the experiments as reported, and the comparison with FBNSI is not controlled. These gaps are load-bearing because the measurement-update step is the advertised contribution over a generic graph-diffusion score.

major comments (3)
  1. [Section 5.3.1] The main quantitative experiment explicitly states that risk estimation is performed "without any measurements provided." This means the Kalman update in Eq. (6)—the component that the abstract and Section 4.2.1 claim refines estimates whenever risk measurements are provided—is never exercised in the evaluation. Section 5.1 provides only one synthetic measurement on entity 1 and reports no quantitative accuracy against any entity-level ground truth. The central contribution of measurement-based refinement is therefore untested. I would like to see an experiment where a varying number of entities are measured, with the update step enabled, and the resulting entity-level risk estimates are compared against a ground-truth risk score (e.g., attack labels or simulated compromise states) and against the open-loop propagation xt+τ = F(t)xt. Without such an experiment, the paper does not substantiate its main advertised capability.
  2. [Section 5.3.1 and Figure 12] The comparison with FBNSI is not controlled on several axes. NRE uses 141 discovered entities, while FBNSI is restricted to the 13 entities of the insider network; NRE operates in a 141-dimensional feature space, whereas FBNSI uses one or two flow-derived features; the reported test metric is the peak balanced accuracy among three classifiers chosen on the validation set; and the test window size τ = 180 s is optimal for FBNSI but suboptimal for NRE, whose tuned value was τ = 90 s. Because these factors are confounded, the conclusion that "NRE is descriptive of network state regardless of the modeled aspect of flows" is not established. A fair comparison would use the same entity set, report results for all classifiers (or a fixed classifier), and evaluate NRE at both its tuned and the baseline-compatible window sizes, with sensitivity analysis.
  3. [Section 4.2, Eq. (3)] The risk propagation model xt+τ = F(t)xt assumes that future risk is a weighted linear combination of current risks, with weights equal to the absolute Pearson correlation of aggregated flow signals. This is an assumption, not a derived consequence of attack behavior, and the paper acknowledges that the graph is only an association network (Section 4.1.2). The risk scores may therefore reflect correlation structure rather than true risk. This is a correctness-risk concern rather than an internal inconsistency, but it should be addressed with a concrete test: for example, a synthetic network with known directed/nonlinear propagation, or an evaluation where entity-level risk estimates are compared to ground-truth compromise states during an attack. Without such a check, the claim that the estimates provide "a robust description of the network state in the presence of threats" remains unsupported.
minor comments (5)
  1. [Section 5.1] The narrative refers to the measurement target as "entity 1" but then identifies the highest-risk entity as "entity 0" with IP 192.168.10.3; the indexing is confusing and should be reconciled.
  2. [Table 1] In Table 1, the reference to the flow-attribute source appears as the literal LaTeX command "citecicflowmeter"; this should be replaced with a proper citation.
  3. [Section 4.2.1] The statement that the Kalman filter "guarantees that the estimation error will converge to zero" is imprecise for time-varying F(t) and when the model is misspecified; the authors should state the standard conditions (fixed, known parameters and correct model) or qualify the claim.
  4. [Section 4.2.2] The relief factor ρr is described as a design parameter and a rule of thumb ρr* = 1 − 1/λmax is given, but the paper does not state how ρr was set in the Section 5.1 experiment beyond "slightly below the rule of thumb"; a concrete value or a sensitivity check would aid reproducibility.
  5. [Section 5.3.1] The feature-engineering step for NRE is not fully specified: the text says the risk estimate vector x̂t|t ∈ R^141 is used as a sample, but the exact way the risk at a single time step is derived from a chunk of flows (e.g., which time index within the chunk) should be stated precisely.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: NRE's risk model is an explicit assumed linear dynamical system, and the proof-of-concept is standard supervised evaluation on an external benchmark.

full rationale

The paper's derivation chain is explicitly model-based rather than circular. Equation (1) defines the functional connectivity weights as absolute Pearson correlations of synchronized flow-derived signals, and Equation (3) then assumes a linear risk-propagation model xt+τ = F(t)xt. Neither equation is claimed to follow from the other, and neither is fitted to the evaluation labels. The Kalman update (Equations 5 and 6) is a standard MMSE estimator derived in Appendix A from the assumed model; it is not tuned to the classification outcome. The proof-of-concept in Section 5.3 trains classifiers on risk-estimate features and tunes hyperparameters (δ, τ, ρf) on the validation set, which is standard supervised model selection, not a fitted-parameter-renamed-as-prediction. The central advertised contribution—refinement with measurements—is not exercised in Section 5.3.1 ('without any measurements provided'), but that is an evidence gap, not a circular reduction. Self-citations (references [19] and [34]) appear in background and alternative-metric contexts and are not load-bearing. No step reduces by construction to its input.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central method relies on a set of tunable hyperparameters and a strong linear-propagation assumption. The functional connectivity graph is inferred from the same connection data used for evaluation, and no external ground-truth risk is used to validate the risk scores.

free parameters (6)
  • Synchronization window size δ = 1.2 s (chosen via grid search)
    Hyperparameter controlling the aggregation of flows into synchronous signals; tuned on validation set to maximize AUC.
  • Graph window size τ = 90 s for NRE, 180 s for comparison (tuned)
    Hyperparameter controlling the time window for functional connectivity graph estimation; tuned on validation set.
  • Forget factor ρf = 0.5 (chosen via grid search)
    Controls exponential smoothing of the functional connectivity graph; tuned on validation set.
  • Relief factor ρr = Set below 1 - 1/λmax (rule of thumb)
    Scaling factor to keep risk estimates bounded; a design parameter not tuned in the classification experiment.
  • Initial risk mean c and variance σ² = N(c1, σ²I)
    Chosen as an uninformative prior; arbitrary.
  • Number of entity groups / partition size = 141 relevant entities discovered via spectral partitioning
    Approximation that discards inter-group edges; affects the sub-network used in experiments.
assumptions (5)
  • ad hoc to paper Risk propagates linearly through the network according to xt+τ = F(t)xt
    Central modeling assumption in Eq. (3); if false, the Kalman filter is mis-specified.
  • domain assumption Pearson correlation of synchronized flow signals captures influence between entities
    Section 4.1.2 uses the magnitude of Pearson correlation as the edge weight; assumes that correlated activity implies risk influence.
  • domain assumption Risk measurements from different sources are mapped to the same risk units
    Stated in Section 3; needed for the measurement model zt = Htxt + vt to be meaningful.
  • standard math Process and measurement noise are zero-mean Gaussian with diagonal covariance
    Standard Kalman filter assumptions in Eq. (4); not empirically validated.
  • domain assumption Node partitioning discards inter-group edges with minimal error
    Section 4.1.4 approximates by solving a relaxed ratio cut; discards small non-zero edges between groups.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Network Risk Estimation: A Risk Estimation Paradigm for Cyber Networks." pith.science (2026). https://pith.science/paper/PDSOS3AL

@misc{pith2026250116487,
  author       = {Pith},
  title        = {Pith review of: Network Risk Estimation: A Risk Estimation Paradigm for Cyber Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PDSOS3AL}},
  note         = {Machine review of arXiv:2501.16487}
}
read the original abstract

Cyber networks are fundamental to many organization's infrastructure, and the size of cyber networks is increasing rapidly. Risk measurement of the entities/endpoints that make up the network via available knowledge about possible threats has been the primary tool in cyber network security. However, the dynamic behavior of the entities and the sparsity of risk-measurable points are limiting factors for risk measurement strategies, which results in poor network visibility considering the volatility of cyber networks. This work proposes a new probabilistic risk estimation approach to network security, NRE, which operates on top of existing risk measurements. The proposed method NRE extracts relationships among system components from the network connection data, models risk propagation based on the learned relationships and refines the estimates whenever risk measurements are provided. In this work, (i) the risk estimation scheme is proposed, (ii) an application of quantitative risk estimates is devised, (iii) descriptiveness of the risk estimates are compared to a pure risk measurement alternative and (iv) low computational complexity of the proposed method is illustrated capable of real-time deployment. The proposed method, NRE, is ultimately a quantitative data-driven risk assessment tool that can be used to add security aspects to existing network functions, such as routing, and it provides a robust description of the network state in the presence of threats, capable of running in real-time.

Figures

Figures reproduced from arXiv: 2501.16487 by the authors.

Figure 1
Figure 1. An enterprise network [6] consisting of users, servers and routers. The intercon [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An application of risk estimation on a cyber network. The graph gives the network [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 2
Figure 2. This application of the proposed risk estimation method is illustrated [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figures from the paper (13 more)
Figure 3
Figure 3. Figure 3: An illustration of the synchronization process involving two entities. Shaded and [PITH_FULL_IMAGE:figures/full_fig_p009_3.png]
Figure 4
Figure 4. Figure 4: A Functional Connectivity Graph F that manifests the relationships among entities at two different timestamps. (a) F(t) and (b) F(t+τ) . For each pair of entities (i, j), the strength of influence F (.) ij is calculated, which results in a weighted directed graph in ge…
Figure 5
Figure 5. Figure 5: Entity groups detected via spectral partitioning algorithm. [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Risk Propagation Illustration for the Network Risk Estimation system. Entity A’s risk, which is an entry in risk vector xt, at the next time step is its previous risk plus the weighted sum of its neighbors’ risks weighted by the edge weights given by functional connec￾…
Figure 7
Figure 7. Figure 7: Flow chart for Real-Time Operation of NRE. The top row is done offline on a large set of past flows to infer entity communities. The bottom row computes the functional connectivity graph for the current time window and estimates the risks as flows occur. Related sectio…
Figure 8
Figure 8. Figure 8: Risk Estimates over time for the Network Risk Estimation system. (a) Functional Connectivity Graph F(t) that is calculated from the flows of usual activity for this network and is held fixed during risk estimation. (b) Mean of risk estimates xˆt|t and covariance matrix…
Figure 9
Figure 9. Figure 9: A solved case of simple safe routing for the insider network of CIC-IDS-2017 [29]. [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Flowchart of the Flow-Based Network State Inference ( [PITH_FULL_IMAGE:figures/full_fig_p023_10.png]
Figure 11
Figure 11. Figure 11: Comparison of ROC curves on validation set for the “ [PITH_FULL_IMAGE:figures/full_fig_p024_11.png]
Figure 12
Figure 12. Figure 12: In other words, judging the network state by its entity’s state and [PITH_FULL_IMAGE:figures/full_fig_p024_12.png]
Figure 12
Figure 12. Figure 12: Comparison of purely risk measurement approach [PITH_FULL_IMAGE:figures/full_fig_p025_12.png]
Figure 13
Figure 13. Figure 13: (a) Simulation Time vs. Graph Window Size with 1s Synchronization Windows. Running is proportional to the window size that is used to calculate the functional connectivity graph. (b) Simulation time vs. Synchronization Window size with 500s Graph Time Windows. Running…
Figure 14
Figure 14. Figure 14: (a) log Average running time vs. log Number of Entities in the network of interest. A dashed line with slope 1.81 is the line fitted to the tail of the running times obtained, which implies an experimental bound on running time of O(n 1.81). (b) Collection of time ins…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 35 canonical work pages

  1. [1]

    Olusola Akinrolabu, Jason RC Nurse, Andrew Martin, and Steve New

    work page

  2. [2]

    Sameer Hasan Albakri, Bharanidharan Shanmugam, Ganthan Narayana Samy, Norbik Bashah Idris, and Azuan Ahmed. 2014. Security risk assess- ment framework for cloud computing environments. Security and Commu- nication Networks 7, 11 (2014), 2114–2124

    work page 2014

  3. [3]

    Terje Aven. 2016. Risk assessment and risk management: Review of recent advances on their foundation. European Journal of Operational Research 253, 1 (2016), 1–13. 29

    work page 2016

  4. [4]

    Ekaba Bisong. 2019. Building machine learning and deep learning models on google cloud platform: A comprehensive guide for beginners . Apress Berkeley, CA, Berkeley, CA. 59–64 pages. https://doi.org/10.1007/ 978-1-4842-4470-8

    work page 2019

  5. [5]

    Brown and Patrickyc Hwang

    Robert G. Brown and Patrickyc Hwang. 1992. Introduction to random signals and applied Kalman filtering . New York, John Wiley & Sons, Inc.,

    work page 1992

  6. [6]

    S Sreenivasa Chakravarthia and Sakkaravarthi Ramanathanb. 2016. Moni- toring Cloud Services Exploitation using Heterogeneous Network Flowdata Analysis. International Journal of Control Theory and Applications 9, 51 (2016), 299–309

    work page 2016

  7. [7]

    Liyan Chang and Paula Branco. 2021. Graph-based Solutions with Resid- uals for Intrusion Detection: the Modified E-GraphSAGE and E-ResGAT Algorithms. arXiv:2111.13597 [cs.CR] https://arxiv.org/abs/2111. 13597

    arXiv 2021

  8. [8]

    Cisco. 2023. Cisco Secure Network Analytics (Stealth- watch) - Cisco Security Analytics [White paper]. https://www.cisco.com/c/en/us/products/collateral/ security/stealthwatch/white-paper-c11-740605.html https://www.cisco.com/c/en/us/products/collateral/security/stealthwatch/white- paper-c11-740605.html

    work page 2023

Show all 39 references
  1. [9]

    Luis Filipe Dias and Miguel Correia. 2020. Big data analytics for intru- sion detection: an overview. Handbook of Research on Machine and Deep Learning Applications for Cyber Security (2020), 292–316

    2020

  2. [10]

    Daji Ergu, Gang Kou, Yong Shi, and Yu Shi. 2014. Analytic network process in risk assessment and decision analysis. Computers & Operations Research 42 (2014), 58–74

    2014

  3. [11]

    Clark Glymour, Kun Zhang, and Peter Spirtes. 2019. Review of causal discovery methods based on graphical models. Frontiers in genetics 10 (2019), 524

    2019

  4. [12]

    Lars Hagen and Andrew B Kahng. 1992. New spectral methods for ratio cut partitioning and clustering. IEEE transactions on computer-aided design of integrated circuits and systems 11, 9 (1992), 1074–1085

    1992

  5. [13]

    Rick Hofstede, Pavel ˇCeleda, Brian Trammell, Idilio Drago, Ramin Sadre, Anna Sperotto, and Aiko Pras. 2014. Flow monitoring explained: From packet capture to data analysis with netflow and ipfix. IEEE Communica- tions Surveys & Tutorials 16, 4 (2014), 2037–2064

    2014

  6. [14]

    Steve Horvath. 2011. Weighted network analysis: applications in genomics and systems biology. Springer Science & Business Media, Los Angeles, CA. 30

    2011

  7. [15]

    International Organization for Standardization

  8. [16]

    Harjinder Singh Lallie, Kurt Debattista, and Jay Bal. 2020. A review of attack graph and attack tree visual syntax in cyber security. Computer Science Review 35 (2020), 100219

    2020

  9. [17]

    Ghorbani

    Arash Habibi Lashkari, Gerard Draper Gil, Mohammad Saiful Islam Ma- mun, and Ali A. Ghorbani. 2017. Characterization of Tor Traffic using Time based Features. In Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, . I...

    2017

  10. [18]

    Qianmu Li, Youhui Tian, Qiang Wu, Qi Cao, Haiyuan Shen, and Huaqiu Long. 2020. A cloud-fog-edge closed-loop feedback security risk prediction method. IEEE Access 8 (2020), 29004–29020

    2020

  11. [19]

    David A Maluf, Raghuram S Sudhaakar, and Kim-Kwang Raymond Choo

  12. [20]

    Shishir Nagaraja. 2014. Botyacc: Unified p2p botnet detection using be- havioural analysis and graph analysis. In European Symposium on Research in Computer Security . Springer, Cham, 439–456

    2014

  13. [21]

    Xinming Ou and Anoop Singhal. 2011. Quantitative security risk assess- ment of enterprise networks . Springer, New York, NY

    2011

  14. [22]

    IEEE Cloud Computing 5, 4 (2018), 24–32

    Trust Erosion: Dealing with Unknown-Unknowns in Cloud Security. IEEE Cloud Computing 5, 4 (2018), 24–32

    2018

  15. [23]

    Christopher J Quinn, Todd P Coleman, Negar Kiyavash, and Nicholas G Hatsopoulos. 2011. Estimating the directed information to infer causal relationships in ensemble neural spike train recordings. Journal of compu- tational neuroscience 30, 1 (2011), 17–44

    2011

  16. [24]

    Patricia AS Ralston, James H Graham, and Jefferey L Hieb. 2007. Cyber security risk assessment for SCADA and DCS networks. ISA transactions 46, 4 (2007), 583–594

    2007

  17. [25]

    Pedregosa, G

    F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Prettenhofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. 2011. Scikit-learn: Machine Learning in Python. Journal of Machine Le...

    2011

  18. [26]

    Prasad Saripalli and Ben Walters. 2010. Quirc: A quantitative impact and risk assessment framework for cloud security. In 2010 IEEE 3rd interna- tional conference on cloud computing . IEEE, Miami, FL, 280–288

    2010

  19. [27]

    Alireza Shameli Sendi and Mohamed Cheriet. 2014. Cloud Computing: A Risk Assessment Model. In 2014 IEEE International Conference on Cloud Engineering. IEEE, Boston, MA, 147–152. https://doi.org/10.1109/ IC2E.2014.17

    2014

  20. [28]

    Alex Ramos, Marcella Lazar, Raimir Holanda Filho, and Joel JPC Ro- drigues. 2017. Model-based quantitative network security metrics: A sur- vey. IEEE Communications Surveys & Tutorials 19, 4 (2017), 2704–2734. 31

    2017

  21. [29]

    Iman Sharafaldin, Arash Habibi Lashkari, and Ali Ghorbani. 2018. To- ward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. In 4th International Conference on Information Systems Security and Privacy (ICISSP 2018) . ICISSP, Madeira, Portugal,...

    2018 doi

  22. [30]

    Dan Simon. 2006. Optimal state estimation: Kalman, H infinity, and non- linear approaches. John Wiley & Sons, Hoboken, NJ

    2006

  23. [31]

    Iman Sharafaldin, Arash Habibi Lashkari, and Ali Ghorbani. 2018. Intrusion detection evaluation dataset (CIC-IDS2017) [Dataset]. http://www.unb.ca/cic/datasets/IDS2017.html

    2018

  24. [32]

    Zhe Wang, Ahmed Alahmadi, David Zhu, and Tongtong Li. 2015. Brain functional connectivity analysis using mutual information. In 2015 IEEE Global Conference on Signal and Information Processing (GlobalSIP) . IEEE, Orlando, FL, 542–546

    2015

  25. [33]

    Junrui Wu, Wenyong Wang, Lisheng Huang, and Fengjun Zhang. 2022. Intrusion detection technique based on flow aggregation and latent semantic analysis. Applied Soft Computing 127 (2022), 109375

    2022

  26. [34]

    Anna Sperotto, Gregor Schaffrath, Ramin Sadre, Cristian Morariu, Aiko Pras, and Burkhard Stiller. 2010. An overview of IP flow-based intrusion detection. IEEE communications surveys & tutorials 12, 3 (2010), 343– 356

    2010

  27. [35]

    Chao Zhou, Yajuan Guo, Wei Huang, Jing Guo, and Daohua Zhu. 2016. Network Security Risk Prediction Based on Time-Varying Markov Model. In Proceedings of the 2016 4th International Conference on Mechanical Materials and Manufacturing Engineering . Atlantis Press, Wuhan, China, ...

    2016 doi

  28. [37]

    Joseph Young, Curtis L Neveu, John H Byrne, and Behnaam Aazhang

  29. [2018]

    https://www.iso.org/obp/ui#iso:std:iso:31000:ed-2:v1:en

    ISO 31000: Risk Management - Guidelines. https://www.iso.org/obp/ui#iso:std:iso:31000:ed-2:v1:en

  30. [2019]

    Computers & Security 87 (2019), 101600

    Cyber risk assessment in cloud provider environments: Current models and future needs. Computers & Security 87 (2019), 101600. https://doi.org/10.1016/j.cose.2019.101600

    2019

  31. [2021]

    Journal of Neural Engineering 18, 4 (2021), 046019

    Inferring functional connectivity through graphical directed informa- tion. Journal of Neural Engineering 18, 4 (2021), 046019

    2021

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.