  The cyber terrain contains devices, network services, cyber personas, and
other network entities involved in network operations. Designing a method that
automatically identifies key network entities to network operations is
challenging. However, such a method is essential for determining which cyber
assets should the cyber defense focus on. In this paper, we propose an approach
for the classification of IP addresses belonging to cyber key terrain according
to their network position using the PageRank centrality computation adjusted by
machine learning. We used hill climbing and random walk algorithms to
distinguish PageRank's damping factors based on source and destination ports
captured in IP flows. The one-time learning phase on a static data sample
allows near-real-time stream-based classification of key hosts from IP flow
data in operational conditions without maintaining a complete network graph. We
evaluated the approach on a dataset from a cyber defense exercise and on data
from the campus network. The results show that cyber key terrain identification
using the adjusted computation of centrality is more precise than its original
version.
