No abstract

No abstract

The EU-funded PALANTIR project proposes a cybersecurity framework combining privacy assurance, data protection, incident detection and recovery aspects under the same platform. The project main focus is on cyber-resilience of SMEs and compliance with the relevant data privacy and protection regulations. The outcomes of the project will be validated in diverse application areas (eHealth, eCommerce, 5G-MEC) and will provide enterprises with security tools that will boost their resilience at a reasonable cost to protect their assets in the ever evolving cyber threat range.

The rapid growth of the Internet of Things and the proliferation of easily compromisable IoT devices has led to a drastic increase in the occurrence of IoT-based botnet attacks. Hackers are keen on exploiting the vulnerabilities of smart devices, which are seen as easy targets often lacking robust security mechanisms. Identifying botnet activity is an active research topic and remains a challenging task due to the continuous evolution of botnet families that employ a large number of attack vectors. Traditional rule-based approaches which rely on signature matching, heuristics and behavioral profiling are always lagging one step behind the attacker, leading researchers to the development of machine and deep learning methods for the detection of compromised IoT device behaviour. In this paper, we model botnet traffic identification as an anomaly detection task, aiming at establishing a baseline of benign traffic, in order to detect unusual behavior using Netflow data. We propose a feature engineering and deep learning-based detection framework based on two Autoencoder architectures: (i) a vanilla implementation of a deep Autoencoder and (ii) GANomaly which has never been used in the context of network traffic analysis before. We validate the performance of the proposed methodology on the CICIDS2017 dataset which has been widely used for cybersecurity benchmarks and show that it is possible to induce highly accurate unsupervised learning models to detect previously unseen botnet behaviour.