Explainable and Robust AI-powered Intrusion Detection Management

最近，网络攻击有所增加，81%的英国组织在2021年遭受某种形式的网络攻击。在英国，每起事故的成本高达108万美元，而缺乏专业的劳动力是最大的挑战。包括中小企业、大型组织和公共部门在内的公司预计将继续扩大其在线业务。特别是当涉及关键部门时（例如电力、石油和天然气、国防、卫生），这种在线存在为潜在的攻击带来了更大的空间，越来越多的私人和受保护的信息受到威胁。因此，对网络安全解决方案的需求增加，现在比以往任何时候都更加重要。在英国和全球范围内进行了大量研究，以开发更安全的硬件和软件解决方案，以满足这一日益增长的需求。旨在实现网络安全工作自动化的方向之一是入侵检测和管理（IDM）和入侵防御系统（IPS）。IDM和IPS将成为任何处理和存储敏感信息（例如GDPR保护的信息，关键基础设施，运营管理等）的组织所必需的。然而，由于许多现代解决方案在很大程度上依赖于人工智能（AI）的使用，它们要求用户在网络安全和AI方面都高度专业化。这反过来又为关键领域的组织引入了专门的信任问题。创新人工智能方法的主要挑战是，它们要么专注于在大量网络流量监控数据中进行基于签名或异常的检测。在这两个类别中，人工智能已经得到应用，但工业用产品仍然缺乏可解释的，强大的和透明的解决方案。此外，有限的公开数据集允许模型在已知的有限模式上进行训练。模型通常在已知的数据集中训练，无法识别或响应更复杂的攻击。这是目前广泛使用的一个障碍。我们建议通过开发符合道德AI情报战略的解决方案，遵循立法和法律的框架来解决这个障碍。这意味着人工智能方法将是透明的，可靠的和负责任的，确保人工智能模型的设计和开发具有更高的可解释性和可靠性，从而减少公司和组织的培训开销。该项目的目标是扩展我们针对IDM用例的解决方案，并通过压力测试来评估来自单个和多个来源的精心策划的攻击下的可解释性和鲁棒性。

Recently there has been a rise in cyber attacks with 81% of UK organizations suffering some form of cyberattack in 2021\. In the UK the cost amounts to $1.08 million per incident while the lack of a specialised workforce is the largest challenge. Companies including SMEs, large organisations, and the public sector are expected to continue expanding their online presence. Especially when critical sectors are concerned (e.g. power, oil and gas, defence, health) this online presence introduces a larger surface for potential attacks with more and more private and protected information being threatened. As a result, there is a rise in the demand for cybersecurity solutions which are now more relevant than ever. Much research is undertaken in the UK and globally in developing more secure hardware and software solutions to address this increasing need. One of the directions that aim to automate cybersecurity efforts is Intrusion Detection and Management (IDM) and Intrusion Prevention Systems (IPS).IDM and IPS will become necessary for any organisation that handles and stores sensitive information (e.g. GDPR protected information, critical infrastructure, operations management etc.). However, as many modern solutions depend heavily on the use of Artificial Intelligence (AI) they demand that their users are highly specialised both in cybersecurity and AI. This in turn introduces issues of trust specifically for organisations in the critical domains. The main challenge for innovative AI approaches is that they either focus on signature or anomaly-based detection in large volumes of network traffic monitoring data. In both categories, AI has been applied but industrially used products still lack in explainable, robust, and transparent solutions. Also, there are limited publicly available datasets that allow models to train over known limited patterns. Models are usually trained in well-known datasets and cannot identify or respond to more sophisticated attacks. This is a barrier to their widespread use at present.We propose to address this barrier by developing solutions compliant with Ethical AI intelligence strategy, following legislation, and legal frameworks. This ascertains that the AI approach will be Transparent, Reliable, and Accountable ensuring that AI models will be designed and developed with an increased level of explainability, and reliability thus reducing the training overhead for companies and organisations. This project's objectives are to expand our solutions for the IDM use case and evaluate the explainability and robustness through stress testing under orchestrated attacks from single and multiple sources.