Leveraging AI for Network Threat Detection—A Conceptual Overview

Abstract

Network forensics is commonly used to identify and analyse evidence of any illegal or unauthorised activity in a given network. The collected information can be used for preventive measures against potential cyber attacks and serve as evidence acceptable in legal proceedings. Several conventional tools and techniques are available to identify and collect such pieces of evidence; however, most of them require expensive commercial resources, longer investigation times, and costly human expertise. Due to modern networks’ diverse and heterogeneous nature, forensic operations through conventional means become a cumbersome and challenging process. This calls for a new look at how network forensics is approached, considering contemporary approaches to network analysis. In this work, we explore artificial intelligence (AI) techniques based on contemporary machine learning (ML) algorithms such as deep learning (DL) to conduct network forensics. We also propose an investigation model based on AI/ML techniques that can analyse network traffic and behavioural patterns to identify any prior or potential cyber attacks. The proposed AI-based network forensics model speeds up the investigation process, boosting network monitoring without human intervention. This also aims to provide timely and accurate information to network administrators for quick and effective decisions, enabling them to avoid and circumvent future cyber attacks.