An Integral Cybersecurity Approach Using a Many-Objective Optimization Strategy

Abstract

Data networks and computing devices have experienced exponential growth. Within a short span of time, they have opened new digital frontiers while also bringing forth new threats. These threats have the potential to increase costs and disrupt regular operations. Choosing a cybersecurity plan to address these threats requires balancing direct and indirect costs against the benefits of implementation and subsequent operation. In this study, we propose an efficient strategy for designing networking topologies by incorporating a Security Information and Event Management System. This system consists of a central server and Network Intrusion Detection Sensors, which gather data and promptly transmit information regarding suspicious activities to the server. The server then takes immediate action in case of incidents. To determine the optimal number and placement of sensors, a many-objective optimization approach is employed. The problem is mathematically modeled using linear programming. To solve the optimization problem, swarm intelligence techniques such as the particle swarm optimizer, the bat algorithm, and the black hole method are utilized. Various test scenarios were created by presenting low, medium, and complex instances of conventional networks. The results obtained using the black hole bio-inspired algorithm were particularly satisfying, surpassing the performance and resolution of the other methods.

Enhancing the Efficiency of a Cybersecurity Operations Center Using Biomimetic Algorithms Empowered by Deep Q-Learning

“…In the sphere of cyber-risk management, particularly from the perspective of the Cyber SOC and SIEM, research efforts focus on strategic optimization, automated responses, and adaptive methodologies to navigate the dynamic cyber-threat landscape. Works such as [ 12 , 24 ] explore efficient strategies for designing network topologies and optimizing cybersecurity incident responses within SIEM systems. These studies leverage multi-objective optimization approaches and advanced machine learning models, like Deep Q neural networks, to enhance decision-making processes, showcasing significant advancements in the automation and efficiency of cybersecurity responses.…”

“…NIDS sensors, often based on cost-effective Raspberry Pi units, serve as adaptable and scalable modules for network security, requiring dual Ethernet ports for effective integration into the SIEM ecosystem [ 67 ]. This study aims to enhance the assignment and management of NIDS sensors within a centralized network via SIEM, improving the optimization of sensor deployment through the application of Deep Q-Learning to metaheuristics, advancing upon previous work [ 12 ].…”

“…This streamlined approach extends the model to larger networks and emphasizes the importance of regular updates and expert collaboration to improve cybersecurity outcomes [ 12 , 71 ].…”

“…Expanding on research [ 12 ] which optimized NIDS sensor allocation in medium-sized networks, this study extends the approach to larger networks. By analyzing a case study, this research first tackled instance zero with ten VLANs, assigning qualitative variables to each based on operational importance and failure susceptibility for strategic NIDS sensor placement.…”

“…Enhancing the methodology outlined in [ 12 ], this paper extends the integration of bio-inspired algorithms with Deep Q-Learning to optimize the implementation of Cybersecurity Operations Centers (Cyber SOCs). It focuses on a comprehensive risk and requirement evaluation, the establishment of clear objectives, and the creation of a robust technological infrastructure, featuring key tools such as Security Information and Event Management (SIEM) and Network Intrusion Detection Systems (NIDSs) for effective real-time monitoring and threat mitigation [ 13 , 14 ].…”