Security Analytics Framework Sample Clauses

Security Analytics Framework. ‌ Problem and challenges The rapid advancements of digital technologies have resulted in considerable increase of new technologies, such as SDN/NFV, network slicing, multi-tenancy, edge and cloud computing. These advancements have also led to an increased attack surface that constitutes a rich source of vulnerabilities that can be exploited by malicious threat actors. Anomaly detection is a significant branch of network security that detects abnormal traffic flows in the presence of an attack in a network. It relies on the assumption that normal data follow a particular and unknown distribution, whereas anomalies originate from different (also unknown) distributions. In traditional security management, intrusion detection takes place after several weeks that the incident was initiated, causing severe damages in the meantime. ML is a promising technique that can address some of the challenges concerning the analysis of encrypted traffic and detection of unknown attacks (e.g., zero-day attacks and advanced persistent threats). ML can help to automatically and efficiently detect anomalies that are not detected by traditional intrusion detection techniques (e.g., Deep Packet Inspection and signature-based techniques). State of the art analysis Deep Learning (DL) is a XX xxxxxx that relies on neural networks that can be used for detecting such anomalies. This section provides an insight on the current State-of-the-Art. Neural networks have been used successfully in several fields, such as computer vision, medical diagnosis, fraud detection and network intrusion detection. Neural networks are composed of an input layer, multiple hidden layers and an output layer. Neural networks can have different structures of their hidden layers, such as fully connected layers, convolutional layers, pooled layers and many others. Use of these different components give rise to different neural networks architectures, such as MLP, Convolutional Neural Networks (CNN) and Long- Short-Term Memory (LSTM) networks. In the literature, all these methods have been applied successfully in network intrusion detection management, but they are applied to solve very specific problems and rely on public datasets for training and tests. Important challenges remain to be able to obtain a more generic solution and deal with real network traffic that is constantly changing (i.e., less predictable). In an article published in 2018 [28], the authors describe the use of sequential LSTM autoencoders ...