  Cyber operations is drowning in diverse, high-volume, multi-source data. In
order to get a full picture of current operations and identify malicious events
and actors analysts must see through data generated by a mix of human activity
and benign automated processes. Although many monitoring and alert systems
exist, they typically use signature-based detection methods. We introduce a
general method rooted in spectral graph theory to discover patterns and
anomalies without a priori knowledge of signatures. We derive and propose a new
graph-theoretic centrality measure based on the derivative of the graph
Laplacian matrix in the direction of a vertex. To build intuition about our
measure we show how it identifies the most central vertices in standard network
data sets and compare to other graph centrality measures. Finally, we focus our
attention on studying its effectiveness in identifying important IP addresses
in network flow data. Using both real and synthetic network flow data, we
conduct several experiments to test our measure's sensitivity to two types of
injected attack profiles, and show that vertices participating in injected
attack profiles exhibit noticeable changes in our centrality measures, even
when the injected anomalies are relatively small, and in the presence of
simulated network dynamics.
