Detecting and mitigating cyberattacks using software defined networks for integrated clinical environments

Celdrán, Alberto Huertas; Karmakar, Kallol Krishna; Mármol, Félix Gómez; Varadharajan, Vijay

doi:10.1007/s12083-021-01082-w

Cited by 6 publications

(1 citation statement)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [39], the authors used an SDN for detecting and mitigating cyberattacks in integrated clinical environments. They proposed a novel SDN-based architecture to detect and mitigate various cyberattacks, such as DDoS attacks, malicious code injection, or unauthorized access.…”

Section: B Previous Workmentioning

confidence: 99%

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

Halman

Alenazi

2023

IEEE Access

View full text Add to dashboard Cite

The healthcare sector deals with sensitive and significant data that must be protected against illegitimate users. Software-defined networks (SDNs) are widely used in healthcare systems to ensure efficient resource utilization, security, optimal network control, and management. Despite such advantages, SDNs suffer from a major issue posed by a wide range of cyberattacks, due to the sensitivity of patients' data. These attacks diminish the overall network performance, and can cause a network failure that might threaten human lives. Therefore, the main goal of our work is to propose a machine learning-based cyberattack detector (MCAD) for healthcare systems, by adapting a layer three (L3) learning switch application to collect normal and abnormal traffic, and then deploy MCAD on the Ryu controller. Our findings are beneficial for enhancing the security of healthcare applications by mitigating the impact of cyberattacks. This work covers the testing of MCAD using a wide spectrum of both ML algorithms and attacks, and provides a performance comparison for every pair of ML algorithms/attacks to illustrate the strengths and weaknesses of different algorithms against a specific attack. The MCAD shows impressive performance, achieving an F1-score of 0.9998 and of 0.9882 on normal and attack classes, respectively, which implies a high level of reliability. MCAD also achieved 5,709,692 samples per second on throughput, which reflects a high-performance real-time system with respect to complexity. Additionally, it showed a positive impact on the network KPIs by increasing the throughput by 609%, and decreasing delay and jitter by 77% and 23%, respectively, compared to attack results.

show abstract

Section: B Previous Workmentioning

confidence: 99%

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

Halman

Alenazi

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

Intelligent Decision Support for Cybersecurity Incident Response Teams: Autonomic Architecture and Mitigation Search

Correa

Robin

Mazo

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Critical infrastructures must be able to mitigate, at runtime, suspected ongoing cyberattacks that have eluded preventive security measures. To tackle this issue, we first propose an autonomic computing architecture for a Cyber-Security Incident Response Team Intelligent Decision Support System (CSIRT-IDSS) with a precise set of technologies for each of its components. We then zoom in on the component responsible for proposing to the CSIRT, automatically ranked sets of runtime actions to mitigate suspected ongoing cyber-attacks. We formalize its task as a Constraint Optimization Problem (COP). We then propose to implement it by a Constraint Object-Oriented Logic Program (COOLP) deployed as a containerized web service through the integration of three orthogonal extensions of Logic Programming (LP): Web Service Oriented LP (WSOLP) [34] Constraint LP (CLP) [10] and Object-Oriented LP (OOLP) [23]. This integration supports seamlessly reusing platform and task independent cybersecurity ontological knowledge to dynamically build a mitigation action search COP that is customized to an input suspected cyberattack action set. This customization then allows the COP, to be solved by a generic CLP engine efficiently enough to propose mitigation actions to the CSIRT team while they can still be effective. To validate this approach, we implemented a prototype called CARMAS (Cyber Attack Runtime Mitigation Action Search) and ran scalability tests on simulated attacks with various COP construction strategies.

show abstract

Enhancing the Security of Software-Defined Networking through Forensic Memory Analysis

da Luz Lemos,

dos Santos Cavali,

Fonseca

et al. 2024

J Netw Syst Manage

View full text Add to dashboard Cite

Detecting and mitigating cyberattacks using software defined networks for integrated clinical environments

Cited by 6 publications

References 21 publications

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

MCAD: A Machine Learning Based Cyberattacks Detector in Software-Defined Networking (SDN) for Healthcare Systems

Intelligent Decision Support for Cybersecurity Incident Response Teams: Autonomic Architecture and Mitigation Search

Enhancing the Security of Software-Defined Networking through Forensic Memory Analysis

Contact Info

Product

Resources

About