Towards a Machine Learning Based Situational Awareness Framework for Cybersecurity: An SDN Implementation

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• The expanding cyber-threat landscape poses significant risks to internet-connected infrastructures.
• Increasingly sophisticated cyber-attacks necessitate advanced defense mechanisms.

Purpose of the Study:

• To develop a machine learning-based situational awareness framework for enhanced network security.
• To improve the detection of network-enabled entities and assess their vulnerabilities in real-time.

Main Methods:

• Utilizing Software-Defined Networking (SDN) for real-time network awareness.
• Implementing a machine learning-based Intrusion Detection System (IDS) trained on heterogeneous data, including Common Vulnerability Enumeration (CVE) IDs.
• Assessing network entities against known vulnerabilities and assigning them to appropriate network slices.

Main Results:

• The proposed framework demonstrated improved prediction accuracy for threat detection.
• A neural network trained with operational environment data achieved higher accuracy than conventional models.
• Real-life evaluation showed an increase of over 4% in overall prediction accuracy.

Conclusions:

• Machine learning, particularly neural networks trained on heterogeneous data, significantly enhances cybersecurity situational awareness.
• The framework effectively addresses system vulnerabilities and mitigates the impact of cyber threats.
• The integration of SDN and ML-based IDS offers a robust solution for modern network security challenges.