Experimental Cyber Attack Detection Framework

Abstract

Digital security plays an ever-increasing, crucial role in today’s information-based society. The variety of threats and attack patterns has dramatically increased with the advent of digital transformation in our lives. Researchers in both public and private sectors have tried to identify new means to counteract these threats, seeking out-of-the-box ideas and novel approaches. Amongst these, data analytics and artificial intelligence/machine learning tools seem to gain new ground in digital defence. However, such instruments are used mainly offline with the purpose of auditing existing IDS/IDPS solutions. We submit a novel concept for integrating machine learning and analytical tools into a live intrusion detection and prevention solution. This approach is named the Experimental Cyber Attack Detection Framework (ECAD). The purpose of this framework is to facilitate research of on-the-fly security applications. By integrating offline results in real-time traffic analysis, we could determine the type of network access as a legitimate or attack pattern, and discard/drop the latter. The results are promising and show the benefits of such a tool in the early prevention stages of both known and unknown cyber-attack patterns.

Application of Association Rule Mining in Preventing Cyberattacks

“…The actual website was delivered using the popular WordPress CMS version 5.7. The web server also hosted the ECAD monitoring agents (Mironeanu et al, 2021;Mironeanu, 2021) responsible for real-time network traffic capture and for implementing the decisions issued by the underlying layers. Normal access patterns have been both simulated using httrack on three different workstations and human client interaction.…”

“…The present study is a fork of the research conducted while developing the ECAD framework -previously published in (Mironeanu et al, 2021). For this present study, we have focused on the analytical modules included in ECAD.…”

“…While the actions included in the Reconnaissance phase may not be incriminating, we argue that they provide valuable data. A thorough analysis of these data could prove to be a valuable asset in preventing cyberattacks (Mironeanu et al, 2021;Mironeanu, 2021). The solution we present in this paper is one such example of proactive prevention.…”

Exploiting the Outcome of Outlier Detection for Novel Attack Pattern Recognition on Streaming Data

“…In preliminary measurements, we introduced a certain confidence level that steers the interspersion of FPs and FNs with a certain probability. From the binary classification result providing the amount of TPs, TNs, FPs, and FNs, we can derive the socalled F1-score as the harmonic mean of precision and sensitivity by F1 = TP TP+ 1 2 ×(FP+FN)…”

“…Misuse-based systems, also denoted as signature-based or knowledge-based, detect attacks based on already known patterns (signatures). Being quite fast and reliable in terms of detecting known attacks, they are not designed to uncover novel ones whose signatures are not available; thus, misuse-based detection is no longer enough [1]. The growth of Machine Learning (ML) has led to a boost in anomaly-based detection methods that create a model of trusted activity from a set of collected data samples and identify malicious activity by analyzing behavior deviations.…”