Intrusion Detection has been heavily studied in both industry and academia, but cybersecurity analysts still desire much more alert accuracy and overall threat analysis in order to secure their systems within cyberspace. Improvements to Intrusion Detection could be achieved by embracing a more comprehensive approach in monitoring security events from many different heterogeneous sources. Correlating security events from heterogeneous sources can grant a more holistic view and greater situational awareness of cyber threats. One problem with this approach is that currently, even a single event source (e.g., network traffic) can experience Big Data challenges when considered alone. Attempts to use more heterogeneous data sources pose an even greater Big Data challenge. Big Data technologies for Intrusion Detection can help solve these Big Heterogeneous Data challenges. In this paper, we review the scope of works considering the problem of heterogeneous data and in particular Big Heterogeneous Data. We discuss the specific issues of Data Fusion, Heterogeneous Intrusion Detection Architectures, and Security Information and Event Management (SIEM) systems, as well as presenting areas where more research opportunities exist. Overall, both cyber threat analysis and cyber intelligence could be enhanced by correlating security events across many diverse heterogeneous sources.

/pdf/intrusion-detection-and-big-heterogeneous-data-a-survey-2bl8prf6ra.pdf

Intrusion detection and Big Heterogeneous Data: a Survey

As networks become ubiquitous in people's lives, users depend on networks a lot for sufficient communication and convenient information access. However, networks suffer from security issues. Network security becomes a challenging topic since numerous new network attacks have appeared increasingly sophisticated and caused vast loss to network resources. Game theoretic approaches have been introduced as a useful tool to handle those tricky network attacks. In this paper, we review the existing game-theory based solutions for network security problems, classifying their application scenarios under two categories, attack-defense analysis and security measurement. Moreover, we present a brief view of the game models in those solutions and summarize them into two categories, cooperative game models and non-cooperative game models with the latter category consisting of subcategories. In addition to the introduction to the state of the art, we discuss the limitations of those game theoretic approaches and propose future research directions.

/pdf/game-theory-for-network-security-4a31e8xmjy.pdf

Game Theory for Network Security

Review: A survey of network flow applications

This paper provides a survey of prediction, and forecasting methods used in cyber security. Four main tasks are discussed first, attack projection and intention recognition, in which there is a need to predict the next move or the intentions of the attacker, intrusion prediction, in which there is a need to predict upcoming cyber attacks, and network security situation forecasting, in which we project cybersecurity situation in the whole network. Methods and approaches for addressing these tasks often share the theoretical background and are often complementary. In this survey, both methods based on discrete models, such as attack graphs, Bayesian networks, and Markov models, and continuous models, such as time series and grey models, are surveyed, compared, and contrasted. We further discuss machine learning and data mining approaches, that have gained a lot of attention recently and appears promising for such a constantly changing environment, which is cyber security. The survey also focuses on the practical usability of the methods and problems related to their evaluation.

/pdf/survey-of-attack-projection-prediction-and-forecasting-in-6flrittvms.pdf

Survey of Attack Projection, Prediction, and Forecasting in Cyber Security

Despite extensive research effort, ordinary anomaly detection systems still suffer from serious drawbacks such as high false alarm rates due to the enormous variety of network traffic. Also, increasingly fast network speeds pose performance problems to systems which base upon deep packet inspection. In this paper, we address these problems by proposing a novel inductive network intrusion detection system. The system operates on lightweight network flows and uses One-Class Support Vector Machines for analysis. In contrast to traditional anomaly detection systems, the system is trained with malicious rather than with benign network data. The system is suited for the load of large-scale networks and is less affected by typical problems of ordinary anomaly detection systems. Evaluations brought satisfying results which indicate that the proposed approach is interesting for further research and perfectly complements traditional signature-based intrusion detection systems.

Inductive Intrusion Detection in Flow-Based Network Data Using One-Class Support Vector Machines

Network Security Situation Awareness (NSSA) is a hot research realm in the area of network security, which helps security analysts to solve the challenges they encounter. This paper mainly focuses on a NSSA which is based on heterogeneous multi-sensor data fusion using neural network. We designed a NSSA model and discussed it in detail. We adopted Snort and NetFlow as sensors to gather real network traffic and fused them using a multi-layer feed-forward neural network that can solve a multi-class problem. We presented an effective and simple feature reduction approach to decrease the input vector and improve the real-time characteristic of fusion engine. In addition, we described a situation generation mechanism in order to provide the real security situation of the monitored networks. Our model is proved to be feasible and effective through a series of experiments, using real network traffic.

Network security situation awareness based on heterogeneous multi-sensor data fusion and neural network

The accurate and real-time prediction of network security situation is the premise and basis of preventing intrusions and attacks in a large-scale network. In order to predict the security situation more accurately, a quantitative prediction method of network security situation based on Wavelet Neural Network with Genetic Algorithm (GAWNN) is proposed. After analyzing the past and the current network security situation in detail, we build a network security situation prediction model based on wavelet neural network that is optimized by the improved genetic algorithm and then adopt GAWNN to predict the non-linear time series of network security situation. Simulation experiments prove that the proposed method has advantages over Wavelet Neural Network (WNN) method and Back Propagation Neural Network (BPNN) method with the same architecture in convergence speed, functional approximation and prediction accuracy. What is more, system security tendency and laws by which security analyzers and administrators can adjust security policies in near real-time are revealed from the prediction results as early as possible.

WNN-based network security situation quantitative prediction method and its optimization

The proposal of network security situational awareness (NSSA) research means a breakthrough and an innovation to the traditional network security technologies, and it has become a new hot research topic in network security field. Combined with evolutionary strategy and neural network, a quantitative method of network security situational awareness is proposed in this paper. Evolutionary strategy is used to optimize the parameters of neural network, and then the evolutionary neural network model is established to extract the network security situational factors, so the quantification of network security situation is achieved. Finally simulated experiment is done to validate that the evolutionary neural network model can extract situational factors and the model has better generalization ability, which supports the network security technical technologies greatly.

Quantification of Network Security Situational Awareness Based on Evolutionary Neural Network

Network security situation awareness (NSSA) is an emerging technique in the field of network security and helps administrators to monitor the actual security situation of their networks. This paper mainly focuses on NSSA based on heterogeneous multisensor data fusion. We presented a model which adopted Snort and NetFlow as sensors to gather data from real network traffic. We employed Support Vector Machines as the fusion engine of our model and used efficient feature reduction approach to fuse the gathered data from heterogeneous sensors. Furthermore, we discussed the alert aggregation and security awareness generation techniques detailedly. Our model is proved to be feasible and effective through a series of experiments.

Multiclass Support Vector Machines Theory and Its Data Fusion Application in Network Security Situation Awareness

Network security situation awareness (NSSA) is an emerging technique in the Held of network security and it helps security analysts to be aware of the actual security situation of their networks. In this paper we presented a novel NSSA model based on multi-sensor data fusion and multi-class support vector machines. In our model, we adopted Snort and NetFlow as two sensors to gather data from network traffic. We employed multi-class support vector machines as fusion engine of our model in combination with an efficient feature reduction approach to fuse the gathered data from heterogeneous sensors. Furthermore, we discussed the alert aggregation algorithm and the security situation awareness generation techniques detailedly. Our model is proved to be feasible and effective through a series of experiments.

Ying Liang

Papers

Network security situation awareness based on heterogeneous multi-sensor data fusion and neural network

WNN-based network security situation quantitative prediction method and its optimization

Quantification of Network Security Situational Awareness Based on Evolutionary Neural Network

Multiclass Support Vector Machines Theory and Its Data Fusion Application in Network Security Situation Awareness

Network security situation awareness model based on heterogeneous multi-sensor data fusion