Securing Future Networked Infrastructures through Dynamic Normal Behaviour Profiling

对在线服务的定期攻击正成为一个无处不在的现实。黑客试图破坏组织的安全，危害用户并获取机密信息，或者拒绝他人访问互联网商店和服务，以造成经济损失。系统管理员和安全研究人员与这些对手进行了无休止的猫捉老鼠游戏，通常只能在事后对攻击和安全漏洞做出反应。需要更主动、更自动化的方法来识别潜在的有害或破坏性流量。该研究的目的是探索可编程网络机制（例如，软件定义网络和网络功能虚拟化）的最新进展，以及尖端的机器学习技术，以开发分布式，实时机器分析和处理异常流量，作为偏离正常行为概况的异常流量，将在适当的时候基于网络流量的不断发展的行为构建。虽然这项工作的组成部分被很好地理解，但这项研究的新颖性源于我们对机器学习驱动的网络分析和可编程网络如何在日常网络管理、威胁检测和威胁控制中相互作用的预期探索。鉴于网络攻击对现代企业和政府构成威胁的现实，这项工作尤为及时。更先进、更有能力的网络系统、统计模型及其交叉的发展将产生广泛的影响，并有望通过提高英国企业、大学和研究机构抵御常见和不常见对手的能力，从而潜在地受益。这项工作直接符合EPSRC繁荣成果的以下目标- R3：“为网络，国防，金融和健康等严重威胁制定更好的解决方案”（弹性国家）；C1：“建立有竞争力的、数据驱动的经济”；C3：“提供智能技术和系统”；C4：“确保一个安全可靠的网络社会”（Connected Nation）。此外，它与EPSRC增长领域“统计与应用概率”、维护领域“人工智能技术”和“信息通信技术网络和分布式系统”直接相关。

Regular attacks on online services are becoming an ever-present reality. Hackers seek to breach the security of organisations to compromise users and gain confidential information, or deny others access to internet shops and services to inflict monetary harm. System administrators and security researchers are engaged in an unending game of cat-and-mouse with these adversaries, and can often only react to attacks and security holes after the fact. More proactive, automated methods are needed to identify potentially harmful or disruptive traffic as it presents itself.The objective of the research is to explore recent advances in programmable network mechanisms (such as, e.g., Software-Defined Networking and Network Function Virtualisation) together with cutting-edge machine learning techniques to develop distributed, on-the-fly machine analysis and handling of anomalous traffic as deviations from a normal behaviour profile that will be constructed based on the evolving behaviour of network traffic in due course.While the constituent parts of this work are well-understood, the novelty in this research arises from our intended exploration of how machine learning-driven network analysis and programmable networks will interact for the purposes of everyday network management, threat detection and threat control.Given the reality of the threat that cyber attacks pose to modern business and government, this work is particularly timely.The development of more advanced and capable networking systems, statistical models and their intersection will have wide impact, and is expected to potentially benefit UK businesses, universities and institutes by increasing their resilience against common and uncommon adversaries.This work directly aligns with the following ambitions from the EPSRC's prosperity outcomes - R3: "Develop better solutions to acute threats: cyber, defence, financial and health" (Resilient Nation); C1: "Enable a competitive, data driven economy"; C3: "Deliver intelligent technologies and systems"; and C4: "Ensure a safe and trusted cyber society" (Connected Nation).Furthermore, it is directly relevant to the EPSRC growth area "Statistics and applied probability", the maintenance area "Artificial intelligence technologies", and "ICT networks and distributed systems".