Towards a Machine Learning Based Situational Awareness Framework for Cybersecurity: An SDN Implementation

被引:27
作者
Nikoloudakis, Yannis [1 ,2 ]
Kefaloukos, Ioannis [2 ]
Klados, Stylianos [2 ]
Panagiotakis, Spyros [2 ]
Pallis, Evangelos [2 ]
Skianis, Charalabos [1 ]
Markakis, Evangelos K. [2 ]
机构
[1] Univ Aegean, Dept Informat & Commun Syst Engn, Neo Karlovasi 83200, Samos, Greece
[2] Hellen Mediterranean Univ, Elect & Comp Engn Dept, Iraklion 71410, Crete, Greece
基金
欧盟地平线“2020”;
关键词
situational awareness; intrusion detection systems; vulnerability assessment; machine learning; SDN; software defined networking; SECURITY;
D O I
10.3390/s21144939
中图分类号
O65 [分析化学];
学科分类号
070302 ; 081704 ;
摘要
The ever-increasing number of internet-connected devices, along with the continuous evolution of cyber-attacks, in terms of volume and ingenuity, has led to a widened cyber-threat landscape, rendering infrastructures prone to malicious attacks. Towards addressing systems' vulnerabilities and alleviating the impact of these threats, this paper presents a machine learning based situational awareness framework that detects existing and newly introduced network-enabled entities, utilizing the real-time awareness feature provided by the SDN paradigm, assesses them against known vulnerabilities, and assigns them to a connectivity-appropriate network slice. The assessed entities are continuously monitored by an ML-based IDS, which is trained with an enhanced dataset. Our endeavor aims to demonstrate that a neural network, trained with heterogeneous data stemming from the operational environment (common vulnerability enumeration IDs that correlate attacks with existing vulnerabilities), can achieve more accurate prediction rates than a conventional one, thus addressing some aspects of the situational awareness paradigm. The proposed framework was evaluated within a real-life environment and the results revealed an increase of more than 4% in the overall prediction accuracy.
引用
收藏
页数:13
相关论文
共 40 条
  • [1] [Anonymous], 2014, CVE20143120 CVE20143120
  • [2] [Anonymous], 2007, CVE20076750 CVE20076750
  • [3] [Anonymous], 2016, CVE20161209 CVE20161209
  • [4] [Anonymous], 2015, CVE20158249 CVE20158249
  • [5] [Anonymous], 2018, 2018 INNOVATIONS INT
  • [6] [Anonymous], 2019, ARXIV190107949
  • [7] [Anonymous], 2001, CVE20010553 CVE20010553
  • [8] Intrusion detection systems and multisensor data fusion
    Bass, T
    [J]. COMMUNICATIONS OF THE ACM, 2000, 43 (04) : 99 - 105
  • [9] Bass T., 1999, Proceedings of the IRIS National Symposium on Sensor and Data Fusion, P24
  • [10] Brownlee J., 2018, STAT METHODS MACHINE