Cyber threat detection and analytics play a pivotal role in providing security to organizations that provide web services, and to their users. Importance of this field is continuously growing due to the increasing abundance of Internet services, wireless networks, smart devices, etc.   Since the cybersecurity domain is hugely complex, it is also one of the major challenges of the contemporary world.

In this challenge, the task is to detect truly suspicious events and false alarms within the set of so-called network traffic alerts, that the Security Operations Center (SOC) Team members @ SOD have to analyze on an everyday basis. An efficient classification model could help the SOC Team to optimize their operations significantly. It is worth adding that although the competition sponsor is entirely commercial, the knowledge and experience that can be gathered by the competition participants may be highly beneficial to improve the intelligent cybersecurity modules in many organizations.

More details regarding the task and a description of the challenge data can be found in the Task description section.

Special track at IEEE BigData 2019: A special session devoted to the challenge will be held at the IEEE BigData 2019 conference. We will invite authors of selected challenge reports to extend them for publication in the conference proceedings (after reviews by Organizing Committee members) and presentation at the conference. The publications will be indexed in the same way as regular conference papers. The invited teams will be chosen based on their final rank, innovativeness of their approach and quality of the submitted report. 

References:

• A. Janusz, D. Kałuza, A. Chadzynska-Krasowska, B. Konarsk, J. Holland, D. Slezak: IEEE BigData 2019 Cup: Suspicious Network Event Recognition. BigData 2019.
• D. Ślęzak, A. Chądzyńska-Krasowska, J. Holland, P. Synak, R. Glick, M. Perkowski: Scalable Cyber-security Analytics with a New Summary-based Approximate Query Engine. IEEE BigData 2017: 1840-1849

The data set available in the challenge consist of alerts investigated by a SOC team at SoD (called ‘investigated alerts’). Each record is described by various statistics selected based on experts’ knowledge, and a hierarchy of associated IP addresses (anonymized), called assets. For each alert in the ‘investigated alerts’ data tables, there is a history of related log events (a detailed set of network operations acquired by SoD, anonymized to ensure the safety of SoD clients).

In total, training and test data sets cover a period between October 1, 2018, and March 31, 2019. A description of columns from the ‘investigated alerts’ data is provided in a separate file column_descriptions.txt. The main data was divided into a training set and a test set based on alert timestamps. Approximately four months are used as the training set (the file cybersecurity_training.csv) and the remaining part is used as a test set (the file cybersecurity_test.csv). The format of those two files is the same - columns are separated by the '|' sign, however, the target column called 'notified' is missing in the test data.

There will also be a second data set available to participants of the challenge. Due to its large size, it will be hosted on an external platform. We will provide access to this data on request, to participants who exceed the baseline score on the public leaderboard. This data contains information about individual event logs associated with each of the alerts from the main data (both training and test parts). A more detailed description of this set will be provided at a later stage of the competition.

The task and the format of submissions: the task for participants of this challenge is to predict which of the investigated alerts were considered truly suspicious by the SOC team and led to issuing a notification to SoD’s clients. In the training data, this information is indicated by the column 'notified'. A submission should have a form of scores assigned to every record from the test data - each score in a separate line of a text file. An example of a correctly formatted submission file is provided in the Data files section.

Evaluation: the quality of submissions will be evaluated using the AUC measure. Solutions will be evaluated online and the preliminary results will be published on the public leaderboard. The preliminary score will be computed on a small subset of the test records, fixed for all participants. The final evaluation will be performed after completion of the competition using the remaining part of the test records. Those results will also be published online. It is important to note that only teams which submit a report describing their approach before the end of the challenge will qualify for the final evaluation. 

After the end of this challenge, all data sets remain available on request. Any registered team can get access to the data after receiving written consent from the organizers. 

If you are using the competition data in your publications, please consider adding a reference to our BigData 2019 paper:
Andrzej Janusz, Daniel Kałuza, Agnieszka Chadzynska-Krasowska, Bartek Konarsk, Joel Holland, Dominik Slezak: IEEE BigData 2019 Cup: Suspicious Network Event Recognition. BigData 2019.

• May 27, 2019: web site of the challenge opens, the task is revealed,
• June 15, 2019 July 1, 2019: start of the competition, data become available,
• September 29, 2019 (23:59 GMT): deadline for submitting the solutions,
• October 2, 2019 (23:59 GMT): deadline for sending the reports, end of the competition,
• October 7, 2019: online publication of the final results, sending invitations for submitting papers for the special track at the IEEE BigData 2019 conference,
• October 28, 2019: deadline for submiting invited papers,
• November 4, 2019: notification of paper acceptance,
• November 15, 2019: camera-ready of accepted papers due,
• December 9-12, 2019: the IEEE BigData 2019 conference (special track date TBA).

Authors of the top-ranked solutions (based on the final evaluation scores) will be awarded prizes funded by our sponsors:

• First Prize: 1500 USD + one free IEEE BigData 2019 conference registration,
• Second Prize: 1000 USD + one free IEEE BigData 2019 conference registration,
• Third Prize: 500 USD + one free IEEE BigData 2019 conference registration.

The award ceremony will take place during the special track at IEEE BigData 2019 conference.

• Dominik Ślęzak, QED Software & Security On-Demand & University of Warsaw
• Agnieszka Chądzyńska-Krasowska, Security On-Demand & Polish-Japanese Academy of Information Technology
• Joel Holland, Security On-Demand
• Andrzej Janusz, QED Software & University of Warsaw
• Daniel Kałuża, QED Software
• Bartek Konarski, Security On-Demand
• Agnieszka Sochal, QED Software

In case of any questions please post on the competition forum or write an email at contact {at} knowledgepit.ml