Artificial Intelligence (AI) techniques provide effective solutions for the detection of many aberrant network traffic patterns and attack flows. However, the validation of these techniques often relies on one training dataset. Recent results show that such training may fail in the face of dynamically-changing cyberattacks. Given the increased sophistication of cyberattacks nowadays, it is imperative to examine and improve the performance of such AI models. This paper proposes a defensive AI engine combined with a twofold feature selection technique and hyperparameter optimization of the AI model. In this work, we utilize the proposed system for binary attack flow identification and the AI models are trained and validated on the CICIDS2017 dataset. The system is then evaluated using synthesized atypical attack flows to mimic real-world scenarios. We demonstrate the effectiveness of the proposed atypical attack flow detection approach using several Deep Learning and Machine Learning models including DNN, Linear-SVC, and Stacked Decision Tree Classifier (S-DTC). Simulation results demonstrate that the proposed defensive AI engine significantly improves the True Positive Rate (TPR) of AI models on multiple atypical attacks.

Agile network security is paramount in our modern world which is currently dominated by internet systems and expanding digital spaces. This rapid digital transformation has created more opportunities for cyberattackers to exploit different vulnerabilities and launch sophisticated and continuously evolving cyberattacks. Increasingly, intrusion detection systems are relying on new methods based on Machine Learning (ML) and Deep Learning (DL) techniques to detect and mitigate such cyberattacks. While such techniques normally can identify known network attack patterns with a reasonable degree of success, their ability to identify complicated atypical, polymorphic, and unknown attacks is shown to be limited. In this paper, we present a comprehensive survey of recent research for detecting unknown, atypical, and polymorphic network attacks using DL techniques. We further highlight and discuss the main challenges in this area and identify the future research directions.

Intrusion Detection Systems (IDS) are essential components in preventing malicious traffic from penetrating networks and systems. Recently, these systems have been enhancing their detection ability using machine learning algorithms. This development also forces attackers to look for new methods for evading these advanced Intrusion Detection Systemss. Polymorphic attacks are among potential candidates that can bypass the pattern matching detection systems. To alleviate the danger of polymorphic attacks, the IDS must be trained with datasets that include these attacks. Generative Adversarial Network (GAN) is a method proven in generating adversarial data in the domain of multimedia processing, text, and voice, and can produce a high volume of test data that is indistinguishable from the original training data. In this paper, we propose a model to generate adversarial attacks using Wasserstein GAN (WGAN). The attack data synthesized using the proposed model can be used to train an IDS. To evaluate the trained IDS, we study several techniques for updating the attack feature profile for the generation of polymorphic data. Our results show that by continuously changing the attack profiles, defensive systems that use incremental learning will still be vulnerable to new attacks; meanwhile, their detection rates improve incrementally until the polymorphic attack exhausts its profile variables.

The problem of resource provisioning and content placement in cloud-based content delivery networks (CCDNs) is studied and a two-stage resource provisioning and cloud assignment is proposed based on dynamic large and small - scale fluctuations of user demand rates as well as considering a constrained minimum lease time for resources. In the first stage, we perform resource provisioning while costs of resources, quality of service (QoS) violation and cloud based root server redirection are included in the optimization, and constraints of QoS and limited-resource of cloud sites are taken into account. In the second stage, cloud site assignment is conducted where for a fixed allocated resources, QoS violation and cloud based root server redirection costs are minimized or reduced using three different proposed schemes. We further show that re-assignment of cloud sites during rising demand rates within a lease time period improves revenue while re-assignment is not very effective for falling demand rates.

AI-based Network Intrusion Detection Systems (NIDS) provide effective mechanisms for cybersecurity analysts to gain insights and thwart several network attacks. Although current IDS can identify known/typical attacks with high accuracy, current research shows that such systems perform poorly when facing atypical and dynamically changing (polymorphic) attacks. In this paper, we focus on improving detection capability of the IDS for atypical and polymorphic network attacks. Our system generates adversarial polymorphic attacks against the IDS to examine its performance and incrementally retrains it to strengthen its detection of new attacks, specifically for minority attack samples in the input data. The employed attack quality analysis ensures that the adversarial atypical/polymorphic attacks generated through our system resemble original network attacks. We showcase the high performance of the IDS that we have proposed by training it using the CICIDS2017 and CICIoT2023 benchmark datasets and evaluating its performance against several atypical/polymorphic attack flows. The results indicate that the proposed technique, through adaptive training, learns the pattern of dynamically changing atypical/polymorphic attacks, identifies such attacks with approximately 90% balanced accuracy for most of the cases, and surpasses various state-of-the-art detection and class balancing techniques.

Virtual Network Embedding (VNE), which provides methods to assign multiple Virtual Networks (VN) to a single physical Substrate Network (SN), is an important task in network virtualization. The main problem in VNE is the efficiency of assigning customers’ virtual network requests to the substrate network. This problem is known to be a Non-deterministic Polynomial-time hard (NP-hard) and heuristic solutions have been developed to solve this kind of problem. The current trend toward Software-Defined Networking (SDN) has allowed new possibilities in virtual network embedding. In this work, we propose a distributed virtual network embedding for SDNs called DVSDNE using multi-agent systems. This framework could be used to run a centralized VNE algorithm in a distributed manner to scale these algorithms with respect to network size. DVSDNE uses agents to spread the load across the substrate network. Our simulation results show the effectiveness of the proposed algorithm. Results show that DVSDNE improves execution time of embedding algorithms in large scale substrate networks, while embedding results such as acceptance ratio, revenue to cost ratio, average latency to controller, and maximum latency to controller remain comparable.