An Architecture-Driven Adaptation Approach for Big Data Cyber Security Analytics

Big Data Cyber Security Analytics (BDCA) systems leverage big data technologies (e.g., Hadoop and Spark) for collecting, storing, and analyzing large volume of security event data to detect cyber-attacks. Accuracy and response time are the two most important quality concerns for BDCA systems. However, the frequent changes in the operating environment of a BDCA system (such as quality and quantity of security event data) significantly impact these qualities. In this paper, we first study the impact of such environmental changes. We then present ADABTics, an architecture-driven adaptation approach that (re)composes the system at runtime with a set of components to ensure optimal accuracy and response time. We finally evaluate our approach both in a single node and multinode settings using a Hadoop-based BDCA system and different adaptation scenarios. Our evaluation shows that on average ADABTics improves BDCA's accuracy and response time by 6.06% and 23.7% respectively.