 |
For as long as there have been hackers, cybersecurity scientists and engineers have been proposing solutions to defend against potential attacks. Most traditional approaches use rule-based detection methods. It monitors the content of network packets in real time, and then identify information such as suspicious strings in the payload. However, if hackers transmit malicious commands in encrypted packets, traditional methods cannot withstand such attacks. Another problem is that the number of network packets increases with the complexity of the network environment. They consume enormous resources when compared with the rules.
To solve the shortcomings of traditional methods, Cisco developed Netflow. It reduces consumption of storage spaceby aggregating packet information and discarding nonessential information, such as payload, then replacing original packet information with network traffic behaviour.
With the help of Netflow data, many have trained Artificial Intelligent with NetFlow data to build models of abnormal network behaviour for detecting anomalies. By learning network traffic behaviour, AI can not only effectively identify known malicious threats, but also detect their variations.
While AI can give us answers, it is also important to know why and how AI has made a specific decision. This is where the explainable AI comes to the rescue. This paper presents an explainable flow-data AI model to identify malicious behaviours and explain how these behaviours were classified.
|
IEEE/ICACT20220024 Slide.02
[Big Slide]