Securing Future Networked Infrastructures through Dynamic Normal Behaviour Profiling

对在线服务的定期攻击正在成为一个永远存在的现实。黑客试图破坏组织的安全性，以危害用户并获取机密信息，或拒绝他人访问互联网商店和服务，以造成金钱损失。系统管理员和安全研究人员与这些对手进行无休止的猫捉老鼠游戏，并且通常只能在事后对攻击和安全漏洞做出反应。需要更主动、自动化的方法来识别潜在的有害或破坏性流量。研究的目的是探索可编程网络机制的最新进展（例如，软件定义网络和网络功能虚拟化）以及尖端的机器学习技术，以开发分布式、动态的机器分析和异常流量处理，作为对正常行为配置文件的偏离，该配置文件将在适当的时候基于网络流量的演变行为构建。虽然这项工作的组成部分已经很好地理解，这项研究的新奇来自于我们对机器学习驱动的网络分析和可编程网络如何相互作用以实现日常网络管理、威胁检测和威胁控制的预期探索。鉴于网络攻击对现代企业和政府构成的威胁的现实，这项工作非常及时。开发更先进、更强大的网络系统、统计模型及其交叉点将产生广泛的影响，预计将通过提高英国企业、大学和研究机构对常见和罕见对手的抵御能力，使其受益。这项工作直接符合EPSRC繁荣成果R3的以下雄心：“开发更好的解决方案，以应对严重威胁：网络、国防、金融和健康”（弹性国家）; C1：“实现有竞争力的数据驱动型经济”; C3：“提供智能技术和系统”; C4：“确保一个安全和可信的网络社会”此外，它直接关系到EPSRC的增长领域“统计和应用概率”，维护领域“人工智能技术”，和“信通技术网络和分布式系统”。

Regular attacks on online services are becoming an ever-present reality. Hackers seek to breach the security of organisations to compromise users and gain confidential information, or deny others access to internet shops and services to inflict monetary harm. System administrators and security researchers are engaged in an unending game of cat-and-mouse with these adversaries, and can often only react to attacks and security holes after the fact. More proactive, automated methods are needed to identify potentially harmful or disruptive traffic as it presents itself.The objective of the research is to explore recent advances in programmable network mechanisms (such as, e.g., Software-Defined Networking and Network Function Virtualisation) together with cutting-edge machine learning techniques to develop distributed, on-the-fly machine analysis and handling of anomalous traffic as deviations from a normal behaviour profile that will be constructed based on the evolving behaviour of network traffic in due course.While the constituent parts of this work are well-understood, the novelty in this research arises from our intended exploration of how machine learning-driven network analysis and programmable networks will interact for the purposes of everyday network management, threat detection and threat control.Given the reality of the threat that cyber attacks pose to modern business and government, this work is particularly timely.The development of more advanced and capable networking systems, statistical models and their intersection will have wide impact, and is expected to potentially benefit UK businesses, universities and institutes by increasing their resilience against common and uncommon adversaries.This work directly aligns with the following ambitions from the EPSRC's prosperity outcomes - R3: "Develop better solutions to acute threats: cyber, defence, financial and health" (Resilient Nation); C1: "Enable a competitive, data driven economy"; C3: "Deliver intelligent technologies and systems"; and C4: "Ensure a safe and trusted cyber society" (Connected Nation).Furthermore, it is directly relevant to the EPSRC growth area "Statistics and applied probability", the maintenance area "Artificial intelligence technologies", and "ICT networks and distributed systems".