Deconstructing Information Security Analysis

Security resources often simplify the analysis cycle into a single atomic unit or a series of highly contextual steps rather than outline the process of building relationships in security data. Analysis workflows may be generalized for anomaly detection in positive security models. This paper explores common analytical techniques to deconstruct and reconstruct security data for analyst benefit. These techniques identify outliers and edges in behaviors and highlight contexts where these edges may occur. Methods are introduced to measure the effectiveness and efficiency of these pivots in investigation while covert channels are introduced to contrast practical application. Methods in this paper should supplement analyst workflows rather than replace existing processes.