02583nas a2200241   4500008004100000022001400041245010600055210006900161260004200230300001000272490000600282520183100288653002202119653001802141653002502159653002702184653001802211100001602229700002302245700001702268700001902285856003702304       2017                        eng d  a1927-032100aCombining Exploratory Analysis and Automated Analysis for Anomaly Detection in Real-Time Data Streams0 aCombining Exploratory Analysis and Automated Analysis for Anomal  aOttawabTalent First Networkc04/2017  a25-310 v73 aSecurity analysts can become overwhelmed with monitoring real-time security information that is important to help them defend their network. They also tend to focus on a limited portion of the alerts, and therefore risk missing important events and links between them. At the heart of the problem is the system that analysts use to detect, explore, and respond to cyber-attacks. Developers of security analysis systems face the challenge of developing a system that can present different sources of information at multiple levels of abstraction, while also creating a system that is intuitive to use. In this article, we examine the complementary nature of exploratory analysis and automated analysis by testing the development of a system that monitors real-time Border Gateway Protocol (BGP) traffic for anomalies that might indicate security threats. BGP is an essential component for supporting the infrastructure of the Internet; however, it is also highly vulnerable and can be hijacked by attackers to propagate spam or launch denial-of-service attacks. Some of the attack scenarios on the BGP infrastructure can be quite elaborate, and it is difficult, if not impossible, to fully automate the detection of such attacks. This article makes two contributions: i) it describes a prototype platform for computing indicators and threat alerts in real time and for visualizing the context of an alert, and ii) it discusses the interaction of exploratory analysis (visualization) and automated analysis. This article is relevant to students, security researchers, and developers who are interested in the development or use of real-time security monitoring systems. They will gain insights into the complementary aspects of automated analysis and exploratory analysis through the development of a real-time streaming system.10aanomaly detection10acybersecurity10aexploratory analysis10areal-time data streams10avisualization1 aShah, Ahmed1 aAbualhaol, Ibrahim1 aGad, Mahmoud1 aWeiss, Michael  uhttp://timreview.ca/article/106800919nas a2200349   4500008004100000022001400041245004200055210003900097260004200136300000800178490000600186653002200192653001500214653001300229653001800242653001600260653002100276653002300297653000800320653001600328653002000344653001200364653001400376653002000390653002500410653001800435653002200453653002000475100001800495700001900513856003700532       2017                        eng d  a1927-032100aEditorial: Cybersecurity (April 2017)0 aEditorial Cybersecurity April 2017  aOttawabTalent First Networkc04/2017  a3-40 v710aanomaly detection10aautomation10abig data10acybersecurity10aexploration10aHypponen’s law10aInternet of Things10aIOT10alegislation10amedical devices10aprivacy10areal time10arisk assessment10asecurity engineering10asmart devices10avalue proposition10avulnerabilities1 aMcPhee, Chris1 aWeiss, Michael  uhttp://timreview.ca/article/1065