Multi-Perspective Content Delivery Networks Security Framework Using Optimized Unsupervised Anomaly Detection

Content delivery networks (CDNs) provide efficient content distribution over the Internet. CDNs improve the connectivity and efficiency of global communications, but their caching mechanisms may be breached by cyber-attackers. Among the security mechanisms, effective anomaly detection forms an impor...

Full description

Saved in:
Bibliographic Details
Published in:IEEE eTransactions on network and service management 2022-03, Vol.19 (1), p.686-705
Main Authors: Yang, Li, Moubayed, Abdallah, Shami, Abdallah, Heidari, Parisa, Boukhtouta, Amine, Larabi, Adel, Brunner, Richard, Preda, Stere, Migault, Daniel
Format: Article
Language:English
Subjects:
Anomalies
Anomaly detection
Bayesian optimization
Cache pollution attacks
Content delivery networks
Cybersecurity
Denial of service attacks
DoS attacks
Gaussian mixture model
Image edge detection
Internet
IP (Internet Protocol)
IP networks
Pollution
Probabilistic models
Protocols
Servers
Web content delivery
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Content delivery networks (CDNs) provide efficient content distribution over the Internet. CDNs improve the connectivity and efficiency of global communications, but their caching mechanisms may be breached by cyber-attackers. Among the security mechanisms, effective anomaly detection forms an important part of CDN security enhancement. In this work, we propose a multi-perspective unsupervised learning framework for anomaly detection in CDNs. In the proposed framework, a multi-perspective feature engineering approach, an optimized unsupervised anomaly detection model that utilizes an isolation forest and a Gaussian mixture model, and a multi-perspective validation method, are developed to detect abnormal behaviors in CDNs mainly from the client Internet Protocol (IP) and node perspectives, therefore to identify the denial of service (DoS) and cache pollution attack (CPA) patterns. Experimental results are presented based on the analytics of eight days of real-world CDN log data provided by a major CDN operator. Through experiments, the abnormal contents, compromised nodes, malicious IPs, as well as their corresponding attack types, are identified effectively by the proposed framework and validated by multiple cybersecurity experts. This shows the effectiveness of the proposed method when applied to real-world CDN data.
ISSN:1932-4537
1932-4537
DOI:10.1109/TNSM.2021.3100308