GRAPH4: A Security Monitoring Architecture Based on Data Plane Anomaly Detection Metrics Calculated over Attack Graphs

The correct and efficient measurement of security properties is key to the deployment of effective cyberspace protection strategies. In this work, we propose GRAPH4, which is a system that combines different security metrics to design an attack detection approach that leverages the advantages of mod...

Full description

Saved in:
Bibliographic Details
Published in:Future internet 2023-11, Vol.15 (11), p.368
Main Authors: Gori, Giacomo, Rinieri, Lorenzo, Al Sadi, Amir, Melis, Andrea, Callegati, Franco, Prandini, Marco
Format: Article
Language:English
Subjects:
Anomalies
anomaly detection
attack graphs
Automation
Cybersecurity
Data security
Denial of service attacks
entropy
Graphs
Internet
Malware
Monitoring
Programming languages
Resource allocation
Security
security metrics
Software
Taxonomy
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The correct and efficient measurement of security properties is key to the deployment of effective cyberspace protection strategies. In this work, we propose GRAPH4, which is a system that combines different security metrics to design an attack detection approach that leverages the advantages of modern network architectures. GRAPH4 makes use of attack graphs that are generated by the control plane to extract a view of the network components requiring monitoring, which is based on the specific attack that must be detected and on the knowledge of the complete network layout. It enables an efficient distribution of security metrics tasks between the control plane and the data plane. The attack graph is translated into network rules that are subsequently installed in programmable nodes in order to enable alerting and detecting network anomalies at a line rate. By leveraging data plane programmability and security metric scores, GRAPH4 enables timely responses to unforeseen conditions while optimizing resource allocation and enhancing proactive defense. This paper details the architecture of GRAPH4, and it provides an evaluation of the performance gains it can achieve.
ISSN:1999-5903
1999-5903
DOI:10.3390/fi15110368