The Internet of Things (IoT) encompasses multiple fast-emerging technologies controlling and connecting millions of new devices every day in several application domains. The increased number of interconnected IoT devices, their limited computational power, and the evolving sophistication of cyber security threats, results in increased security challenges for the IoT ecosystem. The diversity of IoT devices, and the variety of QoS requirements among several domains of IoT application, impose considerable challenges in designing and implementing a robust IoT security solution. The aim of this paper is to present an efficient, robust, and easy-to-use system, for IoT cyber security operators. Following a by-design security approach, the proposed system is a platform comprising four distinct yet cooperating components; a distributed AI-enhanced detection of potential threats and anomalies mechanisms, an AI-based generation of effective mitigation strategies according to the severity of detected threats, a system for the verification of SDN routing decisions along with network- and resource-related policies, and a comprehensive and intuitive security status visualization and analysis. The distributed anomaly detection scheme implementing multiple AI-powered agents is deployed across the IoT network nodes aiming to efficiently monitor the entire network infrastructure. Network traffic data are fed to the AI agents, which process consecutive traffic samples from the network in a time series analysis manner, where consecutive time windows framing the traffic of the surrounding nodes are processed by a graph neural network algorithm. Any detected anomalies are handled by a mitigation engine employing a distributed neural network algorithm, which exploits the recorded anomalous events and deploys appropriate responses for optimal threat mitigation. The implemented platform also includes the hypothesis testing module, and a multi-objective optimization tool for the quick verification of routing decisions. The system incorporates visualization and analytics functionality and a customizable user interface.

Border gateway protocol (BGP) is the main protocol used on the Internet today, for the exchange of routing information between different networks. The lack of authentication mechanisms in BGP, render it vulnerable to prefix hijacking attacks, which raise serious security concerns regarding both service availability and data privacy. To address these issues, this study presents BGPGraph, a scheme for detecting and visualising Internet routing anomalies. In particular, BGPGraph introduces a novel BGP anomaly metric that quantifies the degree of anomaly on the BGP activity, and enables the analyst to obtain an overview of the BGP status. The analyst, is afterwards able to focus on significant time windows for further analysis, by using a hierarchical graph visualisation scheme. Furthermore, BGPGraph uses a novel method for the quantification of information visualisation that allows for the evaluation, and optimal selection of parameters, in case of the corresponding visual analytics algorithms. As a result, by utilising the proposed approach, four new BGP anomalies were able to be identified. Experimental demonstration in known BGP events, illustrates the significant analytics potential of the proposed approach in terms of identifying prefix hijacks and performing root cause analysis.

The analysis of the network traffic in 5G networks is of high significance to the network security administrator, since it could allow for the identification of different behavioural groups and the distinction of anomalous from normal activity. The problem is the multi-dimensional nature of the data, e.g. SMS, call, Internet, services etc. that makes it difficult to analyse. This is even more challenging in 5G networks, compared to previous generation networks, since one more dimension is added to the traffic, representing different network slices. In this respect, activity that is normal in one slice can be anomalous in another. This paper presents a graph-based method for network mining and visualization of user activities in a mobile network. The raw multi- dimensional network traffic data are used for the construction of multiple multi-dimensional graph- based features that capture specific behavioural aspects for each user. Within each feature, graph matching techniques are applied in order to identify groups of users with similar behaviour. The dissimilarity results for each feature are combined using a multi-objective visualization method. The outcome is a data visualization in which users with similar behaviour are depicted as points close to each other. The network analyst is able to select the desired trade-off among the multiple features, and visually detect groups of users with similar behaviours, as well as possible anomalous clusters or outliers. Experimental evaluation of the proposed approach in several application scenarios verify its efficiency.