An effective cyber early warning system (CEWS) should pick up threat activity at an early stage, with an emphasis on establishing hypotheses and predictions as well as generating alerts on (unclassified) situations based on preliminary indications. The design and implementation of such early warning systems involve numerous challenges such as generic set of indicators, intelligence gathering, uncertainty reasoning and information fusion. This chapter begins with an understanding of the behaviours of intruders and then related literature is followed by the proposed methodology using a Bayesian inference-based system. It also includes a carefully deployed empirical analysis on a data set labelled for reconnaissance activity. Finally, the chapter concludes with a discussion on results, research challenges and necessary suggestions to move forward in this research line.
KALUTARAGE, H.K. and SHAIKH, S.A. 2018. Feature trade-off analysis for reconnaissance detection. In Heard, N., Adams, N., Rubin-Delanchy, P. and Turcotte, M. (eds.) Data science for cyber security. Security science and technology, 3. London: World Scientific [online], chapter 5, pages 95-126. Available from: https://doi.org/10.1142/9781786345646_005