Enhancing Network Intrusion Protection Systems with predictive capability for stopping unknown malicious attacks

点击翻译按钮获取中文摘要

• Our visionMany real time detection and predictive solutions are not working seamlessly together and have limited predictive potential. We propose a dual system capable of forecasting network attacks just before they happen. It combines a signature-based network intrusion detection (NIDS) with an anomaly-based analytics and integrates them through additional correlation analysis of their event timelines.• Key project objectives1. Utilizing the experience of Londonmet Cyber Security Research Centre and bringing it to industry2. Supporting the researchers and graduates of Londonmet for creating their own businesses3. Assisting SMEs specialized in managing service providers for offering additional security analytics services on their premises4. Establishing partnerships with vendors of network analysers for enhancing their products by incorporating intelligent agents• Main areas of focus1. Network Traffic Data Analysis in Real-time- Correlation Methods for Time Series2. Cloud Applications Containerization3. Cloud Service Workflows Management4. Managed Service Provider Policies• InnovationFirstly, we are adding intelligence to network analysers by correlating the network communications on different layers. This would improve the detection rate. Secondly, we are containerizing the analytics engines. This will enable workflow automation and will provide additional analytical capabilities for managed service providers.