# A Review of Topological Data Analysis for Cybersecurity

Thomas Davies

###### Abstract

In cybersecurity it is often the case that malicious or anomalous activity can
only be detected by combining many weak indicators of compromise, any one of
which may not raise suspicion when taken alone. The path that such indicators
take can also be critical. This makes the problem of analysing cybersecurity
data particularly well suited to Topological Data Analysis (TDA), a field that
studies the high level structure of data using techniques from algebraic
topology, both for exploratory analysis and as part of a machine learning
workflow. By introducing TDA and reviewing the work done on its application to
cybersecurity, we hope to highlight to researchers a promising new area with
strong potential to improve cybersecurity data science.

##  1 Introduction

Topological Data Analysis (TDA) allows practitioners to study the topology of
a dataset using mathematical tools that come with strong theoretical
guarantees. Roughly, the topology of data is its global structure, meaning we
can use TDA to analyse the ‘shape’ of datasets in ways that traditional data
analysis methods cannot. In cybersecurity, many of the actions that threat
actors take are individually not problematic; it is only when you consider the
actions together that an issue becomes apparent (Winding, Wright, and Chapple
2006). This makes cybersecurity data particularly well-suited to analysis by
TDA, as it is capable of spotting anomalous patterns at a global level.

The primary techniques in TDA are Mapper and persistent homology. Mapper is an
algorithm that can embed large high-dimensional datasets into a much smaller
graph in a topology-preserving way, enabling its visualisation and analysis.
Persistent homology produces a persistence diagram: a concise summary of the
topology of a dataset which can be vectorised and used as input to other
machine learning methods. There is an increasing body of work that shows TDA
capable of performing at the state of the art on a large number of machine
learning tasks. To give just one example, Zhao et al. (2020) add persistent
homology to graph neural networks to achieve the state of the art on many
graph classification tasks. Both strands of TDA have found applications in
cybersecurity. Vast networks are common in this domain, and Mapper can reduce
the size of large datasets in a principled way, allowing human operators to
better visualise and understand the data they are working with. Indeed, the
primary application of Mapper that we see in the literature is to reduce large
datasets of network traffic into more interpretable graphs that can be viewed
by human analysts. Clusters in the mapper graph are shown to correspond to
types of anomaly (Coudriau, Lahmadi, and François 2016), and proximity to
potential anomalies within the mapper graph can alert analysts to traffic
worth further investigation (Bihl et al. 2020). Persistence diagrams have also
been used with success on cybersecurity data. Winding, Wright, and Chapple
(2006) say that ‘little information can be gained from analysing individual
records, [as] often the presence of intrusion behaviour or other anomalous
activity can only be detected by looking at the aggregate behaviour of related
records’. Persistence diagrams offer the ability to summarise the global
behaviour of a large number of records, so their application to cybersecurity
is very natural. This is demonstrated in the literature, with persistence
diagrams being applied to successfully identify anomalies in network logs
(Bruillard, Nowak, and Purvine 2016) and, coupled with convolutional neural
networks (CNNs), identify IoT devices from encrypted packet data (Collins et
al. 2020). More broadly, this relates to detecting change points. Indeed,
there is an active research grant on TDA for Threat
Detection111https://www.nsf.gov/awardsearch/showAward?AWD˙ID=1925346 which has
produced research on detecting change points topologically (Islambekov,
Yuvaraj, and Gel 2019).

Before we can apply TDA we need to embed cybersecurity data in a way that is
compatible with topological tools. This can either be by embedding into
$\mathbb{R}^{d}$, or we can apply other tricks to embed directly into
simplicial complexes – the type of structure required for TDA. The choice of
embedding has a large influence on the success of TDA, so we review different
choices made in the literature. These range from general graph embedding
techniques to those that are cybersecurity specific.

Figure 1: In Mapper data is split up, clustered, then the resulting cluster
centres are connected together based on shared nodes, leading to a graph that
summarises the dataset in a topology-preserving way.

The structure of this review is as follows. In Section 2 we give an
introduction to Mapper and persistent homology, providing references for the
interested reader. In Section 3 we summarise techniques to embed cybersecurity
data as either vectors or graphs. In Sections 4 and 5 we review the literature
on Mapper and persistent homology for cybersecurity respectively. In Section 6
we summarise research on graph metrics for cybersecurity that are closely tied
to TDA. We conclude in Section 7, and in Appendix A we list datasets that may
be of interest to readers.

##  2 Overview of TDA

Topological Data Analysis can be split into the Mapper algorithm and the
persistent homology pipeline. Although not at first glance related, they both
rely on the Nerve Theorem: a result in algebraic topology that guarantees a
certain representation of a space preserves its topology (Hatcher 2000,
Corollary 4G.3). This theoretical guarantee underpins TDA, allowing
representations of data that preserve global structure. In the following we
give a brief overview of TDA, but for more details see the textbook by
Edelsbrunner and Harer (2010) or the lecture notes from Nanda (2021).

### Mapper

The Mapper algorithm (Singh, Mémoli, and Carlsson 2007) was the first
algorithm to take advantage of a topological viewpoint of data. It can map
complex high-dimensional datasets into lower-dimensional structures – most
commonly graphs – in a topology-preserving way. This low-dimensional
representation of the data is more interpretable than the data itself, and can
be used to highlight areas of interest. Figure 1 gives an example of the whole
Mapper process that we’d recommend referring to as we describe the algorithm.
Given a dataset we split it up into overlapping areas. This is most commonly
done with hypercubes, but can be done with any function (the domain of the
function determines what structure you map onto). For the data contained in
each hypercube run a clustering algorithm; each cluster is a node in the
output of the algorithm. When two clusters from different hypercubes share a
point from the original data (which will happen, as the hypercubes overlap),
add an edge between the nodes in the output of the algorithm. In this way you
can map large high-dimensional datasets into a graph which the Nerve Theorem
guarantees will preserve the structure of the initial dataset.

The results of Mapper depend heavily on the way you split your data and the
clustering algorithm used, but experiments have shown Mapper to be very
capable of providing new insight to data with sufficient parameter tuning,
particularly when complemented with domain knowledge. To give some examples,
Lum et al. (2013) gave applications of Mapper to tumours, voting, and player
performance in the NBA. Nicolau, Levine, and Carlsson (2011) used Mapper to
identify a new subtype of breast cancer with high survival rates, a result
that was one of the early indications of the efficacy of TDA.

Figure 2: On the left is a Vietoris-Rips filtration, shown with increasing
values for $\epsilon$. On the right is the persistence diagram of the
filtration. Each blue point is in the 0-persistence diagram, and represents a
connected component. The orange point is in the 1-persistence diagram and
represents the hole.

### Persistent homology

In the following we summarise how the persistent homology pipeline works. The
key takeaway is that we end up with a (potentially vectorised) persistence
diagram that concisely summarises the global structure of the inputted data.
This can be used as-is or fed into a machine learning technique of your
choosing for downstream tasks.

To compute the persistent homology we need a filtration of simplicial
complexes. A simplicial complex is a collection of nodes, edges, triangles,
and other higher dimensional equivalents, such that every simplex contains
each of its constituent simplices (i.e., for any triangle in the complex, the
complex also contains its edges and vertices), and the intersection of any two
simplices in the complex is also a simplex in the complex. A filtration of
simplicial complexes is a series of simplicial complexes
$K_{0},K_{1},K_{2},\dots$ such that $K_{0}\subseteq K_{1}\subseteq
K_{2}\subseteq\dots$ (see Figure 2). The parameter $\epsilon$ for complex
$K_{\epsilon}$ is referred to as the time or scale of the filtration. We can
build simplicial complexes from data in many ways. Given a point dataset, a
common way is the $\epsilon$-Vietoris-Rips complex (Vietoris 1927). We add $k$
points as a simplex to the complex when they are pairwise within $\epsilon$
distance of each other. Letting $K_{\epsilon}$ be the $\epsilon$-Vietoris-Rips
complex gives a filtration of simplicial complexes which we can use to compute
the persistent homology. We can also create complexes in other ways. For
example, in cybersecurity we may want to to build complexes from network data,
connecting nodes that have had network connections with each other. In this
case our scale parameter $\epsilon$ could be the time at which the network
connection took place. This results in an equally valid filtration which we
can use to compute the persistent homology.

For each simplicial complex $K_{\epsilon}$ we compute the $p$-homology group.
This tells us the topology of $K_{\epsilon}$: the $0$-homology counts the
number of connected components, the $1$-homology counts the number of holes,
the $2$-homology counts the number of voids (e.g., the hole inside of a
football), and so on (Edelsbrunner, Letscher, and Zomorodian 2000). Thus we
can use homology groups to describe the topology of $K_{\epsilon}$. However,
we need to decide when computing the homology group which value of $\epsilon$
we want to consider. In the case of a Vietoris-Rips complex, small values of
$\epsilon$ will result in disconnected points, whereas large values of
$\epsilon$ will connect everything. The persistence trick circumvents that
choice by allowing us to consider every $\epsilon$ simultaneously. We
construct the $p$-persistent homology group by summing the $p$-homology groups
over all $\epsilon$. This allows us to see how topological features persist
throughout the filtration: simplices may enter the filtration at $K_{i}$ which
cause a hole. More simplices may enter the filtration, say at $K_{j}$, that
fill the hole. In this case, we refer to the birth of the hole as at time $i$,
its death at time $j$, and we say it persists for $j-i$. In this way we can
characterise the topological features present throughout the filtration. Some
features may never die (for example, there will always be at least one
connected component), in which case we say the death time is infinity.

Birth and death times for topological features offer a good way to visualise
the persistent homology of a filtration. We can plot a diagram called the
persistence diagram, in which the $x$-axis represents birth time, the $y$-axis
represents death time, and each point is a topological feature within the
filtration. An example is shown in Figure 2, in which the orange point is in
the $1$-persistence diagram and represents the hole we can see within the
filtration. The further above the diagonal a point is in the diagram, the
longer it persists for, and the more likely it is to represent a topological
feature rather than noise. There are distances defined on the space of
persistence diagrams (e.g., the Wasserstein distance), but the space of
persistence diagrams is not Hilbert. Therefore in order to conveniently
integrate persistence diagrams into machine learning workflows we must embed
them. Persistence diagrams can be vectorised by a large number of techniques,
but probably most common is persistent images (Chepushtanova et al. 2015).
This puts a Gaussian on each non-diagonal point of the persistence diagram and
integrates the resultant surface over a grid to vectorise the diagram. Other
common approaches are persistence landscapes (Bubenik et al. 2015) or Betti
curves (Rieck, Sadlo, and Leitte 2017), both of which end up with functional
embeddings.

##  3 Embedding cybersecurity data

Cybersecurity data usually comes in forms that aren’t immediately amenable to
TDA or, in fact, any machine learning algorithm. As such, choosing how to
embed the data is an important step in any data science workflow for
cybersecurity. Much of the data naturally has a graph structure, as many
things that we consider live on a network. Some researchers choose to embed
the data in a way that respects this graph structure, whereas others choose to
disregard it; both options have had success in the literature. In this section
we cover cyber-specific embeddings that both respect and disregard the graph
structure, as well as more general graph embedding techniques.

In the TDA for cybersecurity literature, we most often see Mapper applied to
vectors that are built in a graph-agnostic way, even when the initial data has
a graph structure. This is unnecessary, as Mapper can be applied directly to
graphs (Hajij, Rosen, and Wang 2018), but the tools to do so are less
developed. In the case of persistent homology, again the majority of papers
embed the data in a graph-agnostic way before computing the Vietoris-Rips
complex. However, some approaches (Collins et al. 2020) use the existing
network structure and create their filtration using features in the data,
showing that such an approach is feasible.

### Graph-agnostic embeddings

Winding, Wright, and Chapple (2006) proposed vectorising network log data by
summing numeric fields and counting enumerated fields. They suggested the
following feature vectors:

  * •

source IP, number of destination IP addresses;

  * •

destination IP, number of failed access attempts;

  * •

source IP, destination IP;

  * •

destination perspective vector (consisting of destination IP, number of
successful accesses, number of failed accesses, count of destination points,
number of inbound bytes, number of outbound bytes).

This technique has been used in several pieces of anomaly detection research
(Jakub and Branišová 2015; Bihl et al. 2020).

Bruillard, Nowak, and Purvine (2016) proposed embedding NetFlow data into
feature vectors that summarise either the cumulative number of packets sent or
received by an IP of interest, the total number of packets sent or received by
each IP, or the total number of packets sent or received by each IP to an IP
of interest. These vectors are created over a window of a given length that
advances over the whole dataset. The length of window and increment time are
parameters that the authors vary. They show that the choice of window length
and increment time can affect the performance on downstream tasks.

Figure 3: Mapper applied to firewall logs. Nodes in close proximity to those
flagged as potentially anomalous could be worth further investigation.
Reproduced with permission from Bihl et al. (2020).

### Event data as graphs

Aksoy et al. (2019) considered a sliding window of 60 seconds that advanced 20
seconds at a time over event logs. For the events in each window they
construct a graph – the specific graphs they consider are listed below.

  * •

Authentication graphs are unweighted graphs built from authentication data
that has source user/destination user as edges.

  * •

Authentication failure graphs are as above, but restricted to failed
authentication events.

  * •

Process graphs are built from start/stop records of processes. The graph
consists of edges between computers and process names.

  * •

DNS graphs are built from DNS lookup events with edges from source computer to
resolved computer.

  * •

Flow graphs are built from the records of every network flow event. The edges
are between the source computer and the destination computer.

Collins et al. (2020) used encrypted packet data to build a filtration. They
picked a device of interest and connected it to the last $n$ devices that it
exchanged packets with. They induced a filtration by the inter-packet arrival
time, a metric that has previously been shown to contain discriminative
information when the traffic is encrypted. Once all edges of a 2-simplex were
present, they added the 2-simplex (Figure 6a). By doing so they avoided
computing the expensive Vietoris-Rips complex, and instead used the natural
structure of the data and a relevant feature to induce a filtration.

### Graph embeddings

Given the prevalence of graph-structured datasets in cybersecurity, we offer a
brief review of techniques to embed graphs into $\mathbb{R}^{d}$.

Skip-gram based models. Skip-gram was introduced by Mikolov et al. (2013a, b)
to improve word embeddings for NLP. Given a word from a sentence, the idea of
skip-gram is to maximise the average log probability that your model can
predict the next word. Node2Vec (Grover and Leskovec 2016) and LINE (Tang et
al. 2015) adapted this for graph-structured data by maximising the probability
that, given a node $v$, you can predict a node in the neighbourhood of $v$.
Since the neighbourhoods over several hops can grow prohibitively large, they
are sampled by random walk, with different adaptations using different
sampling techniques.

Graph neural networks. GNNs learn to aggregate feature vectors across nodes by
combining features with those of their neighbours. Initially graph neural
networks were classified as either spectral - aggregating neighbours in the
spectral domain - or spatial - aggregating otherwise. However, true spectral
filters require an expensive computation of the Fourier basis, so in general
this was approximated, resulting in networks that were essentially spatial. As
such, GNNs are now categorised as either convolutional, attentional, or
message-passing. The difference lies in how information from the neighbourhood
is aggregated. Convolutional networks aggregate with a linear sum using fixed
edge weights as coefficients for a function of the node feature vectors (Kipf
and Welling 2017). Attentional networks learn an attention function on edges
that acts as the coefficient (Monti et al. 2017). Message-passing networks are
the most general, learning one function on adjacent feature vectors that
decides now to aggregate them (Battaglia et al. 2016).

Figure 4: Data collected by a network telescope is shown on the left. In the
middle diagram is the Mapper graph of the data. Manual examination of the
connected components showed that the large green dot is traffic attempting to
exploit a known router vulnerability, the red component is traffic trying to
access Telnet or SSH, the orange component is a sparse port scan from a single
address, and the yellow component is a randomised scan and some noise. On the
right the initial data is coloured according to the Mapper graph. We can see
that the components are disorderly within the data, despite Mapper pulling out
distinct attack types. Reproduced with permission from Coudriau, Lahmadi, and
François (2016).

Embedding large graphs. The techniques we have discussed so far cannot scale
to large graphs, which is problematic as cybersecurity data can be very large.
GraphSage (Hamilton, Ying, and Leskovec 2017) samples neighbours rather than
fully computing the neighbourhood, and mini-batches, i.e., only updates the
gradients for a limited number of nodes at a time. By doing so it enables
large graphs (>100,000 nodes) to be processed with GNNs. ClusterGCN (Chiang et
al. 2019) and GraphSAINT (Zeng et al. 2020) speed up GraphSage by removing
some redundant computations. Facebook and Twitter have both also released
methods for prcessing very large graphs. Twitter restricted large GNNs to a
single layer (Frasca et al. 2020) enabling huge computational speed-ups with
much more parallelisation. However, the authors of this work suggest in a blog
post222https://blog.twitter.com/engineering/en˙us/topics/insights/2021/simple-
scalable-graph-neural-networks that it is best used as as a fast benchmark for
other models, so the lack of depth does ultimately seem to effect the
performance of the network. Facebook proposed Pytorch Big Graph (Lerer et al.
2019). PBG works on multi-relational graphs: graphs where you can have
different types of edges. It introduces several tricks to allow multi-
relational GNNs to work on graphs with billions of nodes and trillions of
edges.

##  4 Mapper for cybersecurity

In this section we review the literature on applications of Mapper to
cybersecurity, splitting it by application domain. We find that it is most
often used as an investigative and visualisation tool, although in some cases
can provide quantitative information.

Anomaly detection. Bihl et al. (2020) applied Mapper to firewall logs from an
enterprise-level organisation. The authors used a graph agnostic embedding
technique developed by Winding, Wright, and Chapple (2006) that we cover in
Section 3 (counting categorical fields and summing numerical fields). After
embedding the logs they computed the histogram matrix (HMAT) introduced by
Gutierrez et al. (2018). This was intended to provide a way for analysts to
visualise logs that may be anomalous over some block of time. Bihl et al.
(2020) associated an HMAT with each node in the mapper graph, then anomalous
nodes in the Mapper graph can flag to analysts that adjacent nodes may also be
worth further investigation (Figure 3). However, this claim goes relatively
untested, and the tool is framed more as an exploratory technique than
something that can reliably find anomalous events. Rizzo (2020) similarly used
Mapper to plot intrusion detection system data.

Network telecopes. Ranges of IPs with no active domains can be used to analyse
traffic not directed towards real hosts. Since devices listening to this
traffic are not real, any traffic to them is likely to be malicious (Fachkha
and Debbabi 2015). In the literature such traffic is called internet
background radiation (IBR) and the listening devices are referred to as
network telescopes. Coudriau, Lahmadi, and François (2016) used Mapper on data
from a network telescope to find port scans and DDoS attacks, outperforming
traditional clustering algorithms when attacks don’t cover the full range of
possible ports or IPs. Of the many port scans identified by Mapper in the
data, only a small proportion were found by the ruleset of the intrusion
detection system Suricata, demonstrating that Mapper can outperform standard
industry techniques in some cases. Mapper is also able to distinguish types of
attack from complex data: examining the connected components of the Mapper
graph of source/destination IP/port data from a network telescope showed that
most components represent a distinct attack, including the attempted
exploitation of a known router vulnerability (Figure 4).

Narita (2021) also computed the Mapper graphs of network telescope data, but
instead focused on describing the resultant graphs without attempting to link
them to different attack types.

Tor traffic detection. If encrypted Tor traffic is detected as it passes
through a network then connections can be immediately shut down and
investigated. van Veen (2018) investigated Mapper as an unsupervised technique
for visualising and classifying Tor traffic within a network. There is some
success, with qualitative observations that Tor traffic tends to be on the
extremes of the Mapper graph.

Ransomware payments. Akcora et al. (2020) computed a Mapper graph from Bitcoin
transaction data. If a certain proportion of addresses that are within a node
of the Mapper graph are known to receive ransomware payments then the
remaining addresses have their risk scores increased. Repeating over the
entire map and thresholding the acceptable risk gave a list of suspicious
Bitcoin addresses. This approach outperformed DBSCAN and XGBoost at detecting
suspicious addresses.

Attack graphs. An attack on a computer network consists of several different
stages, which are categorised by the Mitre ATT&CK® framework as
reconnaissance, delivery, exploitation, operation, data collection, and
exfiltration. Such a sequence of actions naturally admits a graph structure,
referred to as an attack graph. This graph is susceptible to analysis with
topological techniques, which was the focus of work by Navarro et al. (2018).
They focused on context, attack patterns, and events, which combine to create
an attack graph. They applied mapper to this attack graph in the hope that the
reduced graph is able to be analysed by humans who can find repeated
structures across attacks.

##  5 Persistence for cybersecurity

Persistence diagrams capture specific topological information about data which
can be used independently for data analysis, or vectorised and fed into
machine learning methods for further analysis and prediction. We see in this
section that this can be used for anomaly detection and classification in far
more quantitative ways than Mapper.

Anomaly detection. Bruillard, Nowak, and Purvine (2016) used the distance
between persistence diagrams computed from NetFlow data to detect anomalies.
Vectorising the NetFlow data with a sliding window over the data counting
packets (as described in Section 3), the authors computed a baseline
persistence diagram from a collection of feature vectors $B$. For every other
vector $x$, they computed the Wasserstein distance between the persistence
diagrams of $B$ and $B\cup\\{x\\}$. The larger the distance, the more
topologically different the points are, and they found that spikes in
topological dissimilarity are indicative of anomalies (Figure 5).

Activity prediction. Gabdrakhmanova (2018) summarised persistence diagrams
with the Euler characteristic. Specifically, this is the alternating sum of
the Betti numbers, which are approximated by the total persistence of the
points in persistence diagrams, increasing by dimension. Given the levels of
recent activity at a network switch (say, at an ISP), they wished to predict
the future levels of activity. They have bits/minute data for 7 days. They
split the data into two hour chunks and computed a persistence diagram for
each two hour period. From that, they estimated the Euler characteristic of
that period, as described above. They inputted the Euler characteristics into
a neural network to predict future activity, but did not evaluate the success
of their approach.

Figure 5: The spike in topological dissimilarity indicates a predicted
anomaly. In fact, this was a port scan. Reproduced with permission from
Bruillard, Nowak, and Purvine (2016).

IoT device fingerprinting. Postol et al. (2019) showed that persistent
homology works particularly well for classifying incomplete and noisy data
from internet of things (IoT) devices on networks. They computed the
persistence diagrams of embedded IoT network traffic, and used feature
selection then logistic regression on functional embeddings of the diagrams to
classify types of IoT devices (differentiating cameras, sensors, and
multipurpose devices like tablets). With data over a longer period of time
(months) this worked very well, but over shorter periods of time (days) it did
not.

Collins et al. (2020) also studied IoT data, only they used the natural
network structure of the data, inducing a filtration with the inter-packet
arrival time (IAT), a feature which has been previously shown to contain
valuable information for traffic classification and anomaly detection (Uluagac
et al. 2013). By using the intrinsic structure of the data, they got rid of
the need to compute the often prohibitively expensive Rips complex (Figure
6a). Next they computed the 1-persistent homology of the filtration. Finally
they vectorised the persistence diagrams by mapping them to persistence images
(Figure 6b), and used those to train a CNN. With these higher-dimensional
topological features, they were able to identify IoT devices with high
accuracy, recall, and precision.

##  6 Graph metrics for cybersecurity

(a) A simplicial complex built from packet data.

(b) Examples of 1-persistence images of encrypted packet data.

Figure 6: The 1-persistent homology of packet data can be used to accurately
fingerprint IoT devices on networks, even when the traffic is encrypted.
Reproduced with permission from Collins et al. (2020).

Aksoy, Purvine, and Young (2021) introduced a new centrality measure for
graphs based on the derivative of the graph Laplacian. The kernel of the
Laplacian is exactly the 0-homology group, whilst the non-zero image is known
to contain rich geometric descriptors of the graph. Therefore by using the
Laplacian we capture both topological and geometric information about the
network. Their centrality measure can detect synthetic anomalies that have
been injected into the network data. Another measure to compare graphs is the
relative Hausdorff distance. This offers a fast but nuanced way to compare two
graphs based on their complementary cumulative degree histograms (CCDH). The
CCDH of a graph $G$ is $(N(k))_{k=1}^{\infty}$, where $N(k)$ denotes the
number of vertices in $G$ with degree at least $k$. Comparing the CCDHs gives
us the relative Hausdorff distance, which Aksoy et al. (2019) used to detect
anomalies in graph sequences built from the Los Alamos dataset (see Appendix
A). They built authentication graphs, authentication failure graphs, process
graphs, DNS graphs, and flow graphs. Over longer time windows, they found that
a spike in pairwise RH distance is indicative of a red-team event.

##  7 Conclusion

In this review we have introduced Mapper and persistent homology, and reviewed
how they have been applied to cybersecurity problems. Mapper has mainly been
used for visualisation, providing an effective way for analysts to get a
better grasp of large datasets and suggesting data points for further
investigation. However, it is hard to critically evaluate the success of these
techniques, as the papers offer no robust feedback on how useful analysts find
the visualisations. Coudriau, Lahmadi, and François (2016) clustered the
Mapper graph of network telescope data, showing that each cluster represents
individual attack types. This demonstrates the potential of Mapper for
unsupervised classification of anomalies in network data.

We have also seen that persistent homology can work on cybersecurity data.
Bruillard, Nowak, and Purvine (2016) showed that topological dissimilarity can
detect anomalous events taking place in network data using the 0-persistent
homology: a spike in topological dissimilarity indicated port scans or DDoS
attacks in the network logs. Collins et al. (2020) built simplicial complexes
directly from the intrinsic network structure in the data, training CNNs on
the 1-persistence images. This demonstrated that higher order topological
features can be used in cybersecurity, as they are able to very accurately
fingerprint devices using just topological representations of encrypted
network traffic.

There is a lot of scope for further work in applying topological data analysis
to cybersecurity. In particular, current literature on persistent homology
demonstrates that it is able to use TDA’s ability to concisely summarise
global structure to perform valuable tasks in cybersecurity. We hope that this
review brings more attention to TDA from people working on AI in
cybersecurity.

##  Appendix A List of datasets

We have compiled a list of datasets that may be of interest to researchers in
TDA for cybersecurity. Some of them are described in a review paper by
Yavanoglu and Aydos (2017).

  * •

KDD Cup 1999 provides TCP connections, content features suggested by domain
knowledge, and traffic features, along with labels for anomaly detection
(Lippmann et al. 2000). It is a very popular dataset for anomaly detection
(although fairly outdated these days) and is available online at
http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html. It is based on the
data captured for the DARPA’98 IDS evaluation program.

  * •

ECML-PKDD 2007 provides requests to web servers and was designed for
identifying web attacks with machine learning (Dray et al. 2007). It is real-
world data that has been manually processed and is available at
https://gitlab.fing.edu.uy/gsi/web-application-attacks-datasets.

  * •

CSIC 2010 is another dataset for web attacks and is based off real data from
an e-commerce application. It is also available at
https://gitlab.fing.edu.uy/gsi/web-application-attacks-datasets.

  * •

ISOT Botnet and Ransomware provides DNS queries for 9 botnets plus 19 malign
applications, and 420GB of ransomware and benign program execution traces. It
is available at https://www.uvic.ca/ecs/ece/isot/datasets/botnet-
ransomware/index.php.

  * •

CTU-13 consists of network logs for botnets, verified normal hosts, and
unverified background noise (Garcia et al. 2014). It is available at
https://www.stratosphereips.org/datasets-ctu13.

  * •

ADFA was compiled in 2013 to update intrusion detection datasets like KDD Cup
that were over a decade old. The data consists of labelled system calls and is
split into Linux, Windows, and Windows stealth attacks. It is available at
https://research.unsw.edu.au/projects/adfa-ids-datasets.

  * •

UNSW-NB15 is a comprehensive dataset that covers a variety of different
attacks and is aimed at training and evaluating intrusion detection systems
(Moustafa, Turnbull, and Choo 2019). It is available at
https://research.unsw.edu.au/projects/unsw-nb15-dataset.

  * •

DARPA Operationally Transparent Cyber (OpTC) is a dataset of event logs from
1000 hosts that have a period of baseline activity, followed by having malware
injected by a red team. It is available at
https://github.com/FiveDirections/OpTC-data.

  * •

LANL ARCS, the Los Alamos National Lab Advanced Research in Cyber Systems
dataset, consists of three separate datasets and is available at
https://csr.lanl.gov/data/. The datasets are

    * –

Comprehensive, Multi-Source Cyber-Security Events, consisting of DNS and event
data from across the LANL internal network, including labelled red team
anomalies;

    * –

Unified Host and Network Data Set, consisting of network data from the LANL
internal network;

    * –

User-Computer Authentication Associations in Time, which consists of around
700 million successful authentication events from the LANL enterprise network.

  * •

BETH is a recent anomaly detection dataset created by collecting over eight
million DNS logs and kernel level events from 23 honeypots (Highnam et al.
2021). The data is real-life, contemporary and provided in a consistent
format, and is available at https://www.kaggle.com/katehighnam/beth-dataset.

## Acknowledgements

This research was supported by the Defence and Security programme at the Alan
Turing Institute, funded by the UK Government.

## References

  * Akcora et al. (2020) Akcora, C. G.; Li, Y.; Gel, Y. R.; and Kantarcioglu, M. 2020.  BitcoinHeist: Topological Data Analysis for Ransomware Prediction on the Bitcoin Blockchain.  In Bessiere, C., ed., _Proceedings of the Twenty-Ninth International Joint Conference on Artificial Intelligence, IJCAI-20_ , 4439–4445. International Joint Conferences on Artificial Intelligence Organization.  Special Track on AI in FinTech.
  * Aksoy et al. (2019) Aksoy, S. G.; Nowak, K. E.; Purvine, E.; and Young, S. J. 2019.  Relative Hausdorff distance for network analysis.  _Applied Network Science_ , 4(1): 1–25.
  * Aksoy, Purvine, and Young (2021) Aksoy, S. G.; Purvine, E.; and Young, S. J. 2021.  Directional Laplacian Centrality for Cyber Situational Awareness.  _Digital Threats: Research and Practice (DTRAP)_ , 2(4): 1–28.
  * Battaglia et al. (2016) Battaglia, P. W.; Pascanu, R.; Lai, M.; Rezende, D.; and Kavukcuoglu, K. 2016.  Interaction networks for learning about objects, relations and physics.  _NeurIPS_.
  * Bihl et al. (2020) Bihl, T.; Gutierrez, R.; Bauer, K.; Boehmke, B.; and Saie, C. 2020.  Topological Data Analysis for Enhancing Embedded Analytics for Enterprise Cyber Log Analysis and Forensics.  1937–1946. Proceedings of the 53rd Hawaii International Conference on System Sciences.
  * Bruillard, Nowak, and Purvine (2016) Bruillard, P.; Nowak, K.; and Purvine, E. 2016.  Anomaly Detection Using Persistent Homology.  In _2016 Cybersecurity Symposium (CYBERSEC)_ , 7–12.
  * Bubenik et al. (2015) Bubenik, P.; et al. 2015.  Statistical topological data analysis using persistence landscapes.  _J. Mach. Learn. Res._ , 16(1): 77–102.
  * Chepushtanova et al. (2015) Chepushtanova, S.; Emerson, T.; Hanson, E.; Kirby, M.; Motta, F.; Neville, R.; Peterson, C.; Shipman, P.; and Ziegelmeier, L. 2015.  Persistence Images: An Alternative Persistent Homology Representation.
  * Chiang et al. (2019) Chiang, W.-L.; Liu, X.; Si, S.; Li, Y.; Bengio, S.; and Hsieh, C.-J. 2019.  Cluster-gcn: An efficient algorithm for training deep and large graph convolutional networks.  In _Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining_, 257–266.
  * Collins et al. (2020) Collins, J. R.; Iorga, M.; Cousin, D.; and Chapman, D. 2020.  Passive Encrypted IoT Device Fingerprinting with Persistent Homology.  _UMBC Faculty Collection_.
  * Coudriau, Lahmadi, and François (2016) Coudriau, M.; Lahmadi, A.; and François, J. 2016.  Topological analysis and visualisation of network monitoring data: Darknet case study.  In _2016 IEEE International Workshop on Information Forensics and Security (WIFS)_ , 1–6.
  * Dray et al. (2007) Dray, G.; Raissi, C.; Brissaud, J.; Poncelet, P.; Roche, M.; and Teisseire, M. 2007\.  Web Analysis Traffic Challenge: Description and Results.  In _Discovery Challenge ECML/PKDD_.
  * Edelsbrunner and Harer (2010) Edelsbrunner, H.; and Harer, J. 2010.  _Computational Topology - an Introduction._ American Mathematical Society.  ISBN 978-0-8218-4925-5.
  * Edelsbrunner, Letscher, and Zomorodian (2000) Edelsbrunner, H.; Letscher, D.; and Zomorodian, A. 2000.  Topological persistence and simplification.  volume 28, 454 – 463.  ISBN 0-7695-0850-2.
  * Fachkha and Debbabi (2015) Fachkha, C.; and Debbabi, M. 2015.  Darknet as a Source of Cyber Intelligence: Survey, Taxonomy and Characterization.  _IEEE Communications Surveys & Tutorials_, 18: 1–1.
  * Frasca et al. (2020) Frasca, F.; Rossi, E.; Eynard, D.; Chamberlain, B.; Bronstein, M.; and Monti, F. 2020.  Sign: Scalable inception graph neural networks.  _ICML workshop on Graph Representation Learning and Beyond_.
  * Gabdrakhmanova (2018) Gabdrakhmanova, N. 2018.  Constructing a Neural-Net Model of Network Traffic Using the Topologic Analysis of Its Time Series Complexity.  In Kryzhanovsky, B.; Dunin-Barkowski, W.; and Redko, V., eds., _Advances in Neural Computation, Machine Learning, and Cognitive Research_ , 91–97. Cham: Springer International Publishing.
  * Garcia et al. (2014) Garcia, S.; Grill, M.; Stiborek, J.; and Zunino, A. 2014.  An empirical comparison of botnet detection methods.  _computers & security_, 45: 100–123.
  * Grover and Leskovec (2016) Grover, A.; and Leskovec, J. 2016.  node2vec: Scalable feature learning for networks.  In _Proceedings of the 22nd ACM SIGKDD international conference on Knowledge discovery and data mining_ , 855–864.
  * Gutierrez et al. (2018) Gutierrez, R. J.; Bauer, K. W.; Boehmke, B. C.; Saie, C. M.; and Bihl, T. J. 2018\.  Cyber anomaly detection: Using tabulated vectors and embedded analytics for efficient data mining.  _Journal of Algorithms & Computational Technology_, 12(4): 293–310.
  * Hamilton, Ying, and Leskovec (2017) Hamilton, W. L.; Ying, R.; and Leskovec, J. 2017.  Inductive representation learning on large graphs.  In _Proceedings of the 31st International Conference on Neural Information Processing Systems_ , 1025–1035.
  * Hatcher (2000) Hatcher, A. 2000.  _Algebraic topology_.  Cambridge: Cambridge Univ. Press.
  * Highnam et al. (2021) Highnam, K.; Arulkumaran, K.; Hanif, Z.; and Jennings, N. R. 2021.  BETH Dataset: Real Cybersecurity Data for Anomaly Detection Research.  _ICML Workshop on Uncertainty and Robustness in Deep Learning_.
  * Islambekov, Yuvaraj, and Gel (2019) Islambekov, U.; Yuvaraj, M.; and Gel, Y. R. 2019.  Harnessing the power of Topological Data Analysis to detect change points in time series.  _arXiv preprint arXiv:1910.12939_.
  * Jakub and Branišová (2015) Jakub, B.; and Branišová, J. 2015.  Anomaly Detection from Log Files Using Data Mining Techniques.  _Lecture Notes in Electrical Engineering_ , 339: 449–457.
  * Kipf and Welling (2017) Kipf, T. N.; and Welling, M. 2017.  Semi-Supervised Classification with Graph Convolutional Networks.  In _International Conference on Learning Representations (ICLR)_.
  * Lerer et al. (2019) Lerer, A.; Wu, L.; Shen, J.; Lacroix, T.; Wehrstedt, L.; Bose, A.; and Peysakhovich, A. 2019.  PyTorch-BigGraph: A Large-scale Graph Embedding System.  In _Proceedings of the 2nd SysML Conference_. Palo Alto, CA, USA.
  * Lippmann et al. (2000) Lippmann, R. P.; Fried, D. J.; Graf, I.; Haines, J. W.; Kendall, K. R.; McClung, D.; Weber, D.; Webster, S. E.; Wyschogrod, D.; Cunningham, R. K.; et al. 2000.  Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation.  In _Proceedings DARPA Information Survivability Conference and Exposition. DISCEX’00_ , volume 2, 12–26. IEEE.
  * Lum et al. (2013) Lum, P.; Singh, G.; Lehman, A.; Ishkanov, T.; Vejdemo-Johansson, M.; Alagappan, M.; Carlsson, J.; and Carlsson, G. 2013.  Extracting insights from the shape of complex data using topology.  _Scientific Reports_ , 3.
  * Mikolov et al. (2013a) Mikolov, T.; Chen, K.; Corrado, G.; and Dean, J. 2013a.  Efficient estimation of word representations in vector space.  _ICLR workshop_.
  * Mikolov et al. (2013b) Mikolov, T.; Sutskever, I.; Chen, K.; Corrado, G. S.; and Dean, J. 2013b.  Distributed representations of words and phrases and their compositionality.  In _Advances in neural information processing systems_ , 3111–3119.
  * Monti et al. (2017) Monti, F.; Boscaini, D.; Masci, J.; Rodola, E.; Svoboda, J.; and Bronstein, M. M. 2017.  Geometric Deep Learning on Graphs and Manifolds Using Mixture Model CNNs.  In _2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , 5425–5434. Los Alamitos, CA, USA: IEEE Computer Society.
  * Moustafa, Turnbull, and Choo (2019) Moustafa, N.; Turnbull, B.; and Choo, K.-K. R. 2019.  An Ensemble Intrusion Detection Technique Based on Proposed Statistical Flow Features for Protecting Network Traffic of Internet of Things.  _IEEE Internet of Things Journal_ , 6(3): 4815–4830.
  * Nanda (2021) Nanda, V. 2021.  Computational Algebraic Topology lecture notes.  http://people.maths.ox.ac.uk/nanda/cat/TDANotes.pdf.  Accessed: 2021-09-17.
  * Narita (2021) Narita, M. 2021.  An Empirical Study on Darknet Visualization Based on Topological Data Analysis.  _International Journal of Networked and Distributed Computing_ , 9: 52–58.
  * Navarro et al. (2018) Navarro, J.; Legrand, V.; Lagraa, S.; François, J.; Lahmadi, A.; Santis, G.; Festor, O.; Lammari, N.; Hamdi, F.; Deruyver, A.; Goux, Q.; Allard, M.; and Parrend, P. 2018.  _HuMa: A Multi-layer Framework for Threat Analysis in a Heterogeneous Log Environment_ , 144–159.  ISBN 978-3-319-75649-3.
  * Nicolau, Levine, and Carlsson (2011) Nicolau, M.; Levine, A. J.; and Carlsson, G. 2011.  Topology based data analysis identifies a subgroup of breast cancers with a unique mutational profile and excellent survival.  _Proceedings of the National Academy of Sciences_ , 108(17): 7265–7270.
  * Postol et al. (2019) Postol, M.; Diaz, C.; Simon, R.; and Wicke, D. 2019.  Time-series data analysis for classification of noisy and incomplete Internet-of-Things datasets.  In _2019 18th IEEE International Conference On Machine Learning And Applications (ICMLA)_ , 1543–1550. IEEE.
  * Rieck, Sadlo, and Leitte (2017) Rieck, B.; Sadlo, F.; and Leitte, H. 2017.  Topological machine learning with persistence indicator functions.  In _Topological Methods in Data Analysis and Visualization_ , 87–101. Springer.
  * Rizzo (2020) Rizzo, N. 2020.  _Topological Data Analysis for Evaluation of Network Security Data_.  Master’s thesis, State University of New York at Albany.
  * Singh, Mémoli, and Carlsson (2007) Singh, G.; Mémoli, F.; and Carlsson, G. 2007.  Topological Methods for the Analysis of High Dimensional Data Sets and 3D Object Recognition.  In _PBG@Eurographics_.
  * Tang et al. (2015) Tang, J.; Qu, M.; Wang, M.; Zhang, M.; Yan, J.; and Mei, Q. 2015.  Line: Large-scale information network embedding.  In _Proceedings of the 24th international conference on world wide web_ , 1067–1077.
  * Uluagac et al. (2013) Uluagac, A. S.; Radhakrishnan, S. V.; Corbett, C.; Baca, A.; and Beyah, R. 2013\.  A passive technique for fingerprinting wireless devices with wired-side observations.  In _2013 IEEE conference on communications and network security (CNS)_ , 305–313. IEEE.
  * van Veen (2018) van Veen, H. 2018.  Detecting Encrypted TOR Traffic with Boosting and Topological Data Analysis.  https://kepler-mapper.scikit-tda.org/en/latest/notebooks/TOR-XGB-TDA.html.  Accessed: 2021-09-15.
  * Vietoris (1927) Vietoris, L. 1927.  Über den höheren Zusammenhang kompakter Röume und eine Klasse von zusammenhangstreuen Abbildungen.  _Mathematische Annalen_ , 97(1): 454–472.
  * Winding, Wright, and Chapple (2006) Winding, R. M.; Wright, T. E.; and Chapple, M. 2006.  System Anomaly Detection: Mining Firewall Logs.  _2006 Securecomm and Workshops_ , 1–5.
  * Yavanoglu and Aydos (2017) Yavanoglu, O.; and Aydos, M. 2017.  A Review on Cyber Security Datasets for Machine Learning Algorithms.
  * Zeng et al. (2020) Zeng, H.; Zhou, H.; Srivastava, A.; Kannan, R.; and Prasanna, V. 2020.  GraphSAINT: Graph Sampling Based Inductive Learning Method.  In _International Conference on Learning Representations_.
  * Zhao et al. (2020) Zhao, Q.; Ye, Z.; Chen, C.; and Wang, Y. 2020.  Persistence Enhanced Graph Neural Network.  In Chiappa, S.; and Calandra, R., eds., _Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics_ , volume 108 of _Proceedings of Machine Learning Research_ , 2896–2906. PMLR.