Dynamic Security Orchestration System Leveraging Machine Learning

Software Defined Networking;Content Delivery Networks;Network Function Virtualization;Machine Learning;Anomaly Detection;Deep Learning

Jalalpour, Elahehadvisor:Boutaba, Raouf ; affiliation1:Faculty of Mathematics ; Boutaba, Raouf ; Boutaba, Raouf ;

University of Waterloo

关键词: Anomaly Detection;    Master Thesis;    Content Delivery Networks;    Network Function Virtualization;    Software Defined Networking;    Machine Learning;    Deep Learning;   

Others  :  https://uwspace.uwaterloo.ca/bitstream/10012/13869/3/Jalalpour_Elaheh.pdf

瑞士|英语

来源: UWSPACE Waterloo Institutional Repository

【 摘 要 】

A Content Delivery Network (CDN) employs edge-servers caching content close to end-users to provide high Quality of Service (QoS) in serving digital content. Attacks against edge-servers are known to cause QoS degradation and disruption in serving end-users. Attacks are becoming more sophisticated, and new attacks are being introduced. Protecting edge-servers in the face of these attacks is vital but represents a complex task. Not only must the attack mitigation be immediately effective, but the corresponding overhead should also not negatively affect the QoS of legitimate users.We propose a software-based security system for CDN edge-servers to detect and mitigate various attacks. The approach is to detect threats and automatically react by deploying and managing security services. The desired system behavior is governed by high-level security policies dictated by a network operator. Leveraging advanced machine learning techniques, our system can detect new and sophisticated attacks and generate alerts that trigger policies.Policy enforcement can result in the deployment of mitigation services realized using virtualized security function chains created, configured, and removed dynamically. We demonstrate how our system can be programmed using these policies to automatically handle real-world attacks. Our evaluation shows that our system not only detects known sophisticated attacks accurately but is capable of detecting new attacks. Moreover, the results show that our system is low-overhead, immediately responds to threats, and quickly recovers legitimate traffic throughput.