Enhancing Network Intrusion Protection Systems with predictive capability for stopping unknown malicious attacks

·我们的愿景许多真实的时间检测和预测解决方案不能无缝地协同工作，预测潜力有限。我们提出了一个双系统，能够预测网络攻击发生之前。它将基于特征的网络入侵检测（NIDS）与基于异常的分析相结合，并通过对其事件时间线进行额外的相关性分析来集成它们。·主要项目目标1.利用伦敦网络安全研究中心的经验，并将其引入行业2。支持伦敦大学的研究人员和毕业生创业3。协助专门管理服务提供商的中小企业在其业务上提供额外的安全分析服务4。与网络分析仪供应商建立合作伙伴关系，通过整合智能代理来增强其产品·主要关注领域1。网络流量数据的实时分析-时间序列的相关方法2.云应用程序容器化3.云服务工作流管理4.·创新首先，我们通过关联不同层上的网络通信，为网络分析器添加智能。这将提高检测率。其次，我们正在将分析引擎容器化。这将实现工作流程自动化，并为管理服务提供商提供额外的分析能力。

• Our visionMany real time detection and predictive solutions are not working seamlessly together and have limited predictive potential. We propose a dual system capable of forecasting network attacks just before they happen. It combines a signature-based network intrusion detection (NIDS) with an anomaly-based analytics and integrates them through additional correlation analysis of their event timelines.• Key project objectives1. Utilizing the experience of Londonmet Cyber Security Research Centre and bringing it to industry2. Supporting the researchers and graduates of Londonmet for creating their own businesses3. Assisting SMEs specialized in managing service providers for offering additional security analytics services on their premises4. Establishing partnerships with vendors of network analysers for enhancing their products by incorporating intelligent agents• Main areas of focus1. Network Traffic Data Analysis in Real-time- Correlation Methods for Time Series2. Cloud Applications Containerization3. Cloud Service Workflows Management4. Managed Service Provider Policies• InnovationFirstly, we are adding intelligence to network analysers by correlating the network communications on different layers. This would improve the detection rate. Secondly, we are containerizing the analytics engines. This will enable workflow automation and will provide additional analytical capabilities for managed service providers.