Graph-based feature enrichment for online intrusion detection in virtual networks

The increasing number of connected devices to provide the required ubiquitousness of Internet of Things paves the way for distributed network attacks at an unprecedented scale. Graph theory, strengthened by machine learning techniques, improves an automatic discovery of group behavior patterns of network threats often omitted by traditional security systems. Furthermore, Network Function Virtualization is an emergent technology that accelerates the provisioning of on-demand security function chains tailored to an application. Therefore, repeatable compliance tests and performance comparison of such function chains are mandatory. The contributions of this dissertation are divided in two parts. First, we propose an intrusion detection system for online threat detection enriched by a graph-learning analysis. We develop a feature enrichment algorithm that infers metrics from a graph analysis. By using different machine learning techniques, we evaluated our algorithm for three network traffic datasets. We show that the proposed graph-based enrichment improves the threat detection accuracy up to 15.7% and significantly reduces the false positives rate. Second, we aim to evaluate intrusion detection systems deployed as virtual network functions. Therefore, we propose and develop SFCPerf, a framework for an automatic performance evaluation of service function chaining. To demonstrate SFCPerf functionality, we design and implement a prototype of a security service function chain, composed of our intrusion detection system and a firewall. We show the results of a SFCPerf experiment that evaluates the chain prototype on top of the open platform for network function virtualization (OPNFV).O crescente número de dispositivos IoT conectados contribui para a ocorrência de ataques distribuídos de negação de serviço a uma escala sem precedentes. A Teoria de Grafos, reforçada por técnicas de aprendizado de máquina, melhora a descoberta automática de padrões de comportamento de grupos de ameaças de rede, muitas vezes omitidas pelos sistemas tradicionais de segurança. Nesse sentido, a virtualização da função de rede é uma tecnologia emergente que pode acelerar o provisionamento de cadeias de funções de segurança sob demanda para uma aplicação. Portanto, a repetição de testes de conformidade e a comparação de desempenho de tais cadeias de funções são obrigatórios. As contribuições desta dissertação são separadas em duas partes. Primeiro, é proposto um sistema de detecção de intrusão que utiliza um enriquecimento baseado em grafos para aprimorar a detecção de ameaças online. Um algoritmo de enriquecimento de características é desenvolvido e avaliado através de diferentes técnicas de aprendizado de máquina. Os resultados mostram que o enriquecimento baseado em grafos melhora a acurácia da detecção de ameaças até 15,7 % e reduz significativamente o número de falsos positivos. Em seguida, para avaliar sistemas de detecção de intrusões implantados como funções virtuais de rede, este trabalho propõe e desenvolve o SFCPerf, um framework para avaliação automática de desempenho do encadeamento de funções de rede. Para demonstrar a funcionalidade do SFCPerf, ´e implementado e avaliado um protótipo de uma cadeia de funções de rede de segurança, composta por um sistema de detecção de intrusão (IDS) e um firewall sobre a plataforma aberta para virtualização de função de rede (OPNFV)

dynSMAUG: A Dynamic Security Management Framework Driven by Situations

We present a dynamic security management framework where security policies are specified according to situations. A situation allows to logically group dynamic constraints and make policies closer to business. Situations are specified and calculated by using complex events processing techniques and security policies are written in XACMLv3. Finally, the framework is supported by a modular event based deployment infrastructure. The whole framework has been implemented and its performance is evaluated

'Biodynamically cultivated hash, confidentially' : information sharing on the dark web

Introduction. This article analyses the marketing mechanisms of Dark Web drug trade focusing on advertising as information sharing. Key research questions are 1) vendors use to convince the potential customers about the quality and service, 2) what kind of arguments do vendors try to build and how they do it? and 3) what kind of information is shared when illegal goods are advertised.Method. The data were collected from Utopia, which is an archive of the Finnish cryptomarket called Sipulimarket. The sample contained all advertisements from December 6, 2019 to March 19, 2020.Analysis. All the advertisements were analysed by using a qualitative content analysis.Results. Four main elements on which the marketing speech is based are 1) quality and 2) effects of the drugs (which we discuss here together), 3) price and 4) persuasiveness of the vendor. Together with the name of "drug store", they make up the image. These elements are the types of information shared mostly when convincing customers about the products. In advertisements both persuasiveness and informative contents were shared.Conclusions. By understanding the mechanisms used in illicit communication happening in the Dark Web, we get a new perspective on sharing information that requires anonymity.Peer reviewe

SecBot: a Business-Driven Conversational Agent for Cybersecurity Planning and Management

Businesses were moving during the past decades to-ward full digital models, which made companies face new threatsand cyberattacks affecting their services and, consequently, theirprofits. To avoid negative impacts, companies’ investments incybersecurity are increasing considerably. However, Small andMedium-sized Enterprises (SMEs) operate on small budgets,minimal technical expertise, and few personnel to address cy-bersecurity threats. In order to address such challenges, it isessential to promote novel approaches that can intuitively presentcybersecurity-related technical information.This paper introduces SecBot, a cybersecurity-driven conver-sational agent (i.e., chatbot) for the support of cybersecurityplanning and management. SecBot applies concepts of neuralnetworks and Natural Language Processing (NLP), to interactand extract information from a conversation. SecBot can(a)identify cyberattacks based on related symptoms,(b)indicatesolutions and configurations according to business demands,and(c)provide insightful information for the decision on cy-bersecurity investments and risks. A formal description hadbeen developed to describe states, transitions, a language, anda Proof-of-Concept (PoC) implementation. A case study and aperformance evaluation were conducted to provide evidence ofthe proposed solution’s feasibility and accurac

Coordinated amplification, coordinated inauthentic behaviour, orchestrated campaigns:A systematic literature review of coordinated inauthentic content on online social networks

The internet and online social networks have resulted in dramatic changes in the information landscape. Pessimistic views fear that networks and algorithms can limit exposure to various content by exposing users to pre-existing beliefs. In this respect, coordinated campaigns can amplify these individuals' voices above the crowd, capable of hijacking conversations, influencing other users and manipulating content dissemination. Through a systematic literature review, this chapter locates and synthesises related research on coordinated activities to (i) describe the state of this field by identifying the patterns and trends in the conceptual and methodological approaches, topics and practices; and (ii) shed light on potentially essential gaps in the field and suggest recommendations for future research. Findings show an evolution of the approaches used to detect coordinated activities. While bot detection was the focus in the early years, more recent research focused on using advanced computational methods based on training datasets or identifying coordinated campaigns by timely and similar content. Due to the data availability, Twitter is the most studied online social network, although studies have shown that coordinated activities can be found on other platforms. We conclude by discussing the implications of current approaches and outlining an agenda for future research

A monitoring and threat detection system using stream processing as a virtual function for big data

The late detection of security threats causes a significant increase in the risk of irreparable damages, disabling any defense attempt. As a consequence, fast realtime threat detection is mandatory for security guarantees. In addition, Network Function Virtualization (NFV) provides new opportunities for efficient and low-cost security solutions. We propose a fast and efficient threat detection system based on stream processing and machine learning algorithms. The main contributions of this work are i) a novel monitoring threat detection system based on stream processing; ii) two datasets, first a dataset of synthetic security data containing both legitimate and malicious traffic, and the second, a week of real traffic of a telecommunications operator in Rio de Janeiro, Brazil; iii) a data pre-processing algorithm, a normalizing algorithm and an algorithm for fast feature selection based on the correlation between variables; iv) a virtualized network function in an open-source platform for providing a real-time threat detection service; v) near-optimal placement of sensors through a proposed heuristic for strategically positioning sensors in the network infrastructure, with a minimum number of sensors; and, finally, vi) a greedy algorithm that allocates on demand a sequence of virtual network functions.A detecção tardia de ameaças de segurança causa um significante aumento no risco de danos irreparáveis, impossibilitando qualquer tentativa de defesa. Como consequência, a detecção rápida de ameaças em tempo real é essencial para a administração de segurança. Além disso, A tecnologia de virtualização de funções de rede (Network Function Virtualization - NFV) oferece novas oportunidades para soluções de segurança eficazes e de baixo custo. Propomos um sistema de detecção de ameaças rápido e eficiente, baseado em algoritmos de processamento de fluxo e de aprendizado de máquina. As principais contribuições deste trabalho são: i) um novo sistema de monitoramento e detecção de ameaças baseado no processamento de fluxo; ii) dois conjuntos de dados, o primeiro ´e um conjunto de dados sintético de segurança contendo tráfego suspeito e malicioso, e o segundo corresponde a uma semana de tráfego real de um operador de telecomunicações no Rio de Janeiro, Brasil; iii) um algoritmo de pré-processamento de dados composto por um algoritmo de normalização e um algoritmo para seleção rápida de características com base na correlação entre variáveis; iv) uma função de rede virtualizada em uma plataforma de código aberto para fornecer um serviço de detecção de ameaças em tempo real; v) posicionamento quase perfeito de sensores através de uma heurística proposta para posicionamento estratégico de sensores na infraestrutura de rede, com um número mínimo de sensores; e, finalmente, vi) um algoritmo guloso que aloca sob demanda uma sequencia de funções de rede virtual

Securing configuration, management and migration of virtual network functions using blockchain

The current technologies of network functions virtualization and network service function chaining increase service provision agility and add intelligence at the core of the network. However, the network core programmability and the provision of services by multiple providers brings new vulnerabilities to this scenario. The need for secure provisioning of virtual network service functions (VNFs) becomes even more critical, since simple modifications at the network core can affect multiple network users. This work proposes a blockchain-based architecture for secure management, configuration and migration of VNFs. This architecture ensures the immutability, non-repudiation, and auditability of VNF configuration and the management histories. In addition, the proposed architecture preserves the anonymity of VNFs, tenants, and configuration information, to mitigate the possibilities of targeted attack. A prototype designed for the OPNFV (Open Platform for NFV) platform was developed, and the proposed architecture performance was evaluated in terms of parameters trade-offs and bottlenecks.As tecnologias de virtualização de funções de rede e de encadeamento de funções de serviço de rede aumentam a agilidade na provisão de serviços e acrescentam inteligência no núcleo da rede. No entanto, a programabilidade do n´núcleo da rede e a oferta de serviços por múltiplos fornecedores provocam novas vulnerabilidades neste ambiente. A necessidade de provisão de funções virtuais de serviço de rede (VNFs) seguras torna-se ainda mais crítica, uma vez que uma simples modificação no núcleo da rede pode afetar múltiplos usuários. Este trabalho propõe uma arquitetura baseada em correntes de blocos para gerenciamento seguro, configuração emigração de VNFs. Esta arquitetura garante a imutabilidade, não repúdio e auditabilidade da configuração de VNF e do histórico de gerenciamento de VNFs. Além disso, a arquitetura proposta preserva o anonimato das VNFs, dos inquilinos e das informações de configuração, a fim de evitar que estes se tornem alvos de ataques. Foi desenvolvido um protótipo concebido para a plataforma OPNFV (Open Platform for NFV) e foi avaliado o desempenho em relação ao custo benefício de parâmetros e aos gargalos da arquitetura proposta

'Biodynamically cultivated hash, confidentially' : information sharing on the dark web

publishedVersionPeer reviewe

BotGM: Unsupervised Graph Mining to Detect Botnets in Traffic Flows

International audienceBotnets are one of the most dangerous and serious cybersecurity threats since they are a major vector of large-scale attack campaigns such as phishing, distributed denial-of-service (DDoS) attacks, trojans, spams, etc. A large body of research has been accomplished on botnet detection, but recent security incidents show that there are still several challenges remaining to be addressed, such as the ability to develop detectors which can cope with new types of botnets. In this paper, we propose BotGM, a new approach to detect botnet activities based on behavioral analysis of network traffic flow. BotGM identifies network traffic behavior using graph-based mining techniques to detect botnets behaviors and model the dependencies among flows to trace-back the root causes then. We applied BotGM on a publicly available large dataset of Botnet network flows, where it detects various botnet behaviors with a high accuracy without any prior knowledge of them

Protectbot: A Chatbot to Protect Children on Gaming Platforms

Online gaming no longer has limited access, as it has become available to a high percentage of children in recent years. Consequently, children are exposed to multifaceted threats, such as cyberbullying, grooming, and sexting. The online gaming industry is taking concerted measures to create a safe environment for children to play and interact with, such efforts remain inadequate and fragmented. Different approaches utilizing machine learning (ML) techniques to detect child predatory behavior have been designed to provide potential detection and protection in this context. After analyzing the available AI tools and solutions it was observed that the available solutions are limited to the identification of predatory behavior in chat logs which is not enough to avert the multifaceted threats. In this thesis, we developed a chatbot Protectbot to interact with the suspect on the gaming platform. Protectbot leveraged the dialogue generative pre-trained transformer (DialoGPT) model which is based on Generative Pre-trained Transformer 2 (GPT-2). To analyze the suspect\u27s behavior, we developed a text classifier based on natural language processing that can classify the chats as predatory and non-predatory. The developed classifier is trained and tested on Pan 12 dataset. To convert the text into numerical vectors we utilized fastText. The best results are obtained by using non-linear SVM on sentence vectors obtained from fastText. We got a recall of 0.99 and an F_0.5-score of 0.99 which is better than the state-of-the-art methods. We also built a new dataset containing 71 predatory full chats retrieved from Perverted Justice. Using sentence vectors generated by fastText and KNN classifier, 66 chats out of 71 were correctly classified as predatory chats