Root Cause Analysis for Autonomous Optical Networks: A Physical Layer Security Use Case

Natalino, Carlos; Giglio, Andrea Di; Schiano, M.; Furdek, Marija

doi:10.1109/ecoc48923.2020.9333141

Cited by 8 publications

(8 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Then, we propose an Unsupervised Learning (UL)-based RCA algorithm named DB-RCA that does not require prior knowledge on the anomalies caused by physical-layer attacks. The algorithm, which extends our preliminary study in [12], is validated on an experimental physical-layer security dataset. Our performance assessment includes the RCA outputs of eXtreme Gradient Boosting (XGBoost), a known SL model that enables RCA, in addition to our proposed DB-RCA.…”

Section: Introductionmentioning

confidence: 87%

“…• We investigate RCA approaches and establish an RCA framework applicable to the security assessment task. • We propose a UL-based DB-RCA algorithm, extending the initial study in [12]. • We validate its applicability to autonomous optical network security management using an experimental physical-layer security dataset.…”

Section: Introductionmentioning

confidence: 95%

“…By analyzing the output of the SL-and UL-based algorithms we can assert that, although significantly different, the outputs of both approaches can provide meaningful insight when investigating the root cause of an attack. The contributions of this paper, and extensions with respect to [12] and [9], can be summarized as follows:…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Root Cause Analysis for Autonomous Optical Network Security Management

Natalino

Schiano

Giglio

et al. 2022

IEEE Trans. Netw. Serv. Manage.

Self Cite

View full text Add to dashboard Cite

The ongoing evolution of optical networks towards autonomous systems supporting high-performance services beyond 5G requires advanced functionalities for automated security management. These functionalities need to support risk reduction, security diagnostics and incident remediation strategies. To cope with evolving security threat scenarios, security diagnostic approaches should be able to detect and identify the nature not only of existing attack techniques, but also those hitherto unknown or insufficiently represented. Machine Learning (ML)-based algorithms have been shown to perform well when identifying known attack types, but cannot guarantee precise identification of unknown attacks. This makes Root Cause Analysis (RCA) a crucial tool to enable timely attack response when human intervention is unavoidable.We address these challenges by establishing an ML-based framework for security assessment and analyzing RCA alternatives for physical-layer attacks. We first scrutinize different Network Management System (NMS) architectures and the corresponding ML-based security assessment functionalities. We then investigate the applicability of supervised and unsupervised learning (SL and UL) approaches for RCA and propose a novel UL-based RCA algorithm called Distance-Based Root Cause Analysis (DB-RCA). Extensive validation of the framework's applicability and performance in the context of autonomous optical network security management is carried out using an experimental physical-layer security dataset, evaluating the benefits and drawbacks of the SL-and UL-based RCA techniques. Besides confirming that SL-based approaches can be trained to provide precise RCA output for known attack types, the study shows that the proposed UL-based RCA approach offers meaningful insights into the properties of anomalies caused by novel attack types, thus supporting the human security officers in advancing the physical-layer security diagnostics.

show abstract

Section: Introductionmentioning

confidence: 87%

Section: Introductionmentioning

confidence: 95%

See 1 more Smart Citation

Root Cause Analysis for Autonomous Optical Network Security Management

Natalino

Schiano

Giglio

et al. 2022

IEEE Trans. Netw. Serv. Manage.

Self Cite

View full text Add to dashboard Cite

show abstract

“…This would allow the security managers to understand why an ML model attributes a particular setting to an attack and which trends in various OPM parameters triggered such a response. To this end, a Root Cause Analysis (RCA) framework was proposed that analyzes the clusters of OPM data constructed by a UL algorithm [10]. When an anomaly is detected, the framework computes the difference between the average value of each feature in the anomalous samples and the average value of the same feature in the closest normal cluster.…”

Section: Achieving Interpretability Of ML Models' Outputsmentioning

confidence: 99%

Autonomous Security Management in Optical Networks

Natalino

Giglio

Schiano

et al. 2021

Optical Fiber Communication Conference (OFC) 2021

Self Cite

View full text Add to dashboard Cite

show abstract

Section: Introductionmentioning

confidence: 99%

Root Cause Analysis for Autonomous Optical Network Security Management

Natalino¹,

Schiano²,

Giglio³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

<div>The ongoing evolution of optical networks towards autonomous systems supporting high-performance services be-yond 5G requires advanced functionalities for automated security management. These functionalities need to support risk reduction, security diagnostics and incident remediation strategies. To cope with evolving security threat scenarios, security diagnostic approaches should be able to detect and identify the nature not only of existing attack techniques, but also those hitherto unknown or insufficiently represented. Machine Learning (ML)-based algorithms have been shown to perform well when identifying known attack types, but cannot guarantee precise identification of unknown attacks. This makes Root Cause Analysis (RCA) a crucial tool to enable timely attack response when human intervention is unavoidable.</div><div>We address these challenges by establishing an ML-based framework for security assessment and analyzing RCA alter-natives for physical-layer attacks. We first scrutinize different Network Management System (NMS) architectures and the corresponding ML-based security assessment functionalities. We then investigate the applicability of supervised and unsupervised learning (SL and UL) approaches for RCA and propose a novel UL-based RCA algorithm called Distance-Based Root Cause Analysis (DB-RCA). Extensive validation of the framework’s applicability and performance in the context of autonomous optical network security management is carried out using an experimental physical-layer security dataset, evaluating the benefits and drawbacks of the SL- and UL-based RCA techniques. Besides confirming that SL-based approaches can be trained to provide precise RCA output for known attack types, the study shows that the proposed UL-based RCA approach offers meaningful insights into the properties of anomalies caused by novel attack types, thus supporting the human security officers in advancing the physical-layer security diagnostics.</div>

show abstract

Root Cause Analysis for Autonomous Optical Networks: A Physical Layer Security Use Case

Cited by 8 publications

References 6 publications

Root Cause Analysis for Autonomous Optical Network Security Management

Root Cause Analysis for Autonomous Optical Network Security Management

Autonomous Security Management in Optical Networks

Root Cause Analysis for Autonomous Optical Network Security Management

Contact Info

Product

Resources

About