Autonomous security for complex systems

点击翻译按钮获取中文摘要

Information technology-based systems are facing increasingly complex cyber-attacks. To deal with these cyber-attacks, large enterprises are deploying monitoring infrastructures based on Security Operations Centers (SOCs). SOCs integrate various security functions such as intrusion detection systems, firewalls and supervision systems. They are based on a complex organizational structure, generally at three levels, with a first level dedicated to the task of analyzing low-level alerts, the second level in charge of managing incidents and activating countermeasures, and the last level responsible for forensic analysis, monitoring and anticipation. At the first level, analysts manage alerts by applying checklists and best practice rules. Apart from these reflex reaction tasks, other tasks are generally performed manually and rely on human expertise. The consequence of this complex structure is that the deployment of a SOC is expensive in terms of purchase, operation and maintenance. SOCs are therefore security solutions that are difficult for SMEs (Small and Medium-sized Enterprises) to access. In the absence of adapted solutions, SMEs are increasingly vulnerable to cyber-attacks. To address this problem, we propose to develop the concept of Autonomous Cybersecurity Systems (ACS). The aim is to design concrete solutions to further automate security functions, particularly those that are currently performed manually in SOCs. The concept of ACS will improve the global security of companies and especially SMEs by addressing the following points: (1) Reducing the risk of human error by further automating the decision-making process, (2) Ensuring better management of cyber-attacks by reducing response time, (3) Making security solutions more accessible to businesses, particularly SMEs, by reducing operation and maintenance costs. The following topics will be studied in the research program : T1: Automatic generation of attack graphs. This topic aims to define an Artificial Intelligence-based solution that takes as input the textual descriptions of vulnerabilities and generates an ontological description of the graphs of attacks instantiated on the system considered. T2: Classification of attacker profiles and attack attribution. The objectives will be first to construct a classification of attacker profiles and then analyze the attacker typologies and go further into the so-called attribution problem which aims to trace the source of the attack. T3. Security posture evaluation and impact measurement. The suggested approach is based on the definition of metrics and the identification of dependencies between business services, the objective being to develop an expert system to assist the decision making process in the choice of response to cyber-attacks. By developing solutions to deal with cyber attacks and attackers, this program will enhance trust in digital systems and will have transformative impacts for the Canadian society and economy.