Using Google Analytics to Support Cybersecurity Forensics
This work addresses cybersecurity forensics for organizations by providing a more efficient way to detect anomalies in web traffic, though it is incremental as it adapts existing marketing tools to a new domain.
This study tackled the problem of analyzing web traffic for cybersecurity monitoring by developing a methodology using Google Analytics data, grouping individual traffic points into user sessions to emulate real user behavior, resulting in faster and better insights into large volumes of noisy data.
Web traffic is a valuable data source, typically used in the marketing space to track brand awareness and advertising effectiveness. However, web traffic is also a rich source of information for cybersecurity monitoring efforts. To better understand the threat of malicious cyber actors, this study develops a methodology to monitor and evaluate web activity using data archived from Google Analytics. Google Analytics collects and aggregates web traffic, including information about web visitors' location, date and time of visit, visited webpages, and searched keywords. This study seeks to streamline analysis of this data and uses rule-based anomaly detection and predictive modeling to identify web traffic that deviates from normal patterns. Rather than evaluating pieces of web traffic individually, the methodology seeks to emulate real user behavior by creating a new unit of analysis: the user session. User sessions group individual pieces of traffic from the same location and date, which transforms the available information from single point-in-time snapshots to dynamic sessions showing users' trajectory and intent. The result is faster and better insight into large volumes of noisy web traffic.