Data-driven software-defined security

点击翻译按钮获取中文摘要

Undoubtedly, businesses and financial institutions are constantly under security threats, which not only costs billions of dollars in damage and recovery, it also detrimentally affects their reputation. A botnet-assisted attack is a widely known threat to these organizations. According to the U.S. Federal Bureau of Investigation, Botnets have caused over $9 billion in losses to U.S. victims and over $110 billion in losses globally. Approximately 500 million computers are infected globally each year, translating into 18 victims per second. Thus, it is imperative to defend these organizations against botnet-assisted attacks.In this project, we aim to devise an adaptive and robust botnet detection and mitigation system that leverages machine learning (ML). We propose novel anomaly-based intrusion detection, employing both host- and network-based detection methods. Each method is strong in detecting some of the essential bot behaviors. Hence, our hybrid detection will leverage the strengths of the underlying methods to build an advanced detection system that bots cannot easily evade. The proposed system will adapt the ML models to network dynamics and adversarial activities, utilizing incremental and adversarial learning, respectively. Upon detection of an intrusion, the system will leverage software-defined networking (SDN) to dynamically adapt the monitoring and surveillance of the network, and instigate root cause analysis. The system will automatically generate mitigation workflows that will be enforced via SDN, to ensure integrity of network and its data.The proposed project will broaden the scope of botnet detection and mitigation, including protection against zero-day threats. Advances made in collaboration with the industry partner, Royal Bank of Canada (RBC), will have a lasting impact on the design principles and practices of cybersecurity for Canadian businesses and financial institutions.