 ICACT20260037 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Good morning, everyone. My presentation today is on our research:
the Rapidly Deployed Artificial Intelligence Module Corresponding to Cyber Security Recognition and Learning.
|
| ICACT20260037 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
In this presentation, we will introduce the background, the problem, our method, technical details, the system flow, our experiment results, and future applications.
|
| ICACT20260037 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
With introduction
The challenge we face is the constantly evolving nature of cyber-attacks—such as phishing, ransomware, and SQL injection—which are diverse and growing. Attackers often use obfuscation, mixing malicious commands with benign traffic. Traditional systems rely on static signatures, making it difficult to identify new, unknown, or "zero-day" threats.
|
| ICACT20260037 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
This leads to a research gap:
Traditional AI models are static.
When a new threat appears, there is a significant delay, including:
Data Collection
Model Retraining
System-wide Redeployment.
We seek to deploy a specialized AI module the moment an unknown attack is suspected,
handling multiple parallel attacks with elasticity.
|
| ICACT20260037 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
Our core solution has around three main contributions:
Record and Train: We use a container-based bait system to record malicious data,
creating a rich dataset for continuous learning.
Parallel Analysis: We deploy parallel AI modules to identify and classify attack styles,
ignoring confusing "false" instructions.
Voting & Discovery: We use a "voting mechanism" to classify known attacks and flag new, potential threats for analysis.
Next is our related work
|
| ICACT20260037 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
Related Work
|
| ICACT20260037 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
Our work integrates several key technologies:
First, Network Intrusion Detection, we chose Snort to detect the command, because it’s popular and is open-source.
To know threats based on defined rules as IDS/IPS.
But it has the limitation, struggles with encrypted traffic and novel (zero-day) attacks. It is rule-based, not learning-based
Second, Software-Defined Networking (SDN) provides programmatic control to redirect suspicious flows.
|
| ICACT20260037 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
In terms of AI
In cybersecurity, machine learning is widely used to detect anomalies.
But many models work like black boxes and are vulnerable to adversarial manipulation.
That’s why distributed AI with parallel processing is becoming a promising solution.
And about the bait system
We use the concept of Honeypots/Baits to safely collect data on attacker behavior.
|
| ICACT20260037 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
Now we’re going to talk about proposed system
|
| ICACT20260037 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
The proposed system features include five key components :
the SDN as the "traffic cop", the Classification and Recognition AI modules, a Database, and the Bait System.
|
| ICACT20260037 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
Let`s start the process with Recognition AI.
We convert Raw Log Data into numerical features using two techniques:
|
| ICACT20260037 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
TF-IDF (Term Frequency-Inverse Document Frequency):
This scores the importance of a word in a log entry. A high score flags anomalies.
|
| ICACT20260037 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
PCA (Principal Component Analysis):
This is a dimensionality reduction technique used after TF-IDF to combine many features into a few "Principal Components. “
making the classification step faster
|
| ICACT20260037 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
Next, the Classification AI uses a parallel framework of specialist models:
K-Means / DBSCAN: Excellent for finding new groups of behavior and identifying outliers.
SVM / CNN-LSTM: Effective for supervised classification and finding temporal attack sequences.
|
| ICACT20260037 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
And the Voting Mechanism collects results from all parallel AI modules.
If a classification is above a certain confidence Threshold (alpha), it is counted.
The mode with the highest vote number wins, ensuring a confident decision.
|
| ICACT20260037 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
When the Voting Mechanism confirms a "Malicious" connection, the SDN redirects the attacker to the Bait System.
This container looks and feels like the real service, allowing us to safely record all commands,
which is then fed back to the Recognition AI, closing the learning loop
|
| ICACT20260037 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
In addition, this framework is elastic because all AI modules are developed and stored as Docker containers.
They are modular and lightweight, enabling deployment in seconds, similar to "Security as a Service."
|
| ICACT20260037 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
And here are the Simulation Results
|
| ICACT20260037 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
Our simulation verified the feature recognition in：
TF-IDF: Correctly assigned a very high score of $0.6014$ to the rare attack term "issue_deauth".
PCA: Successfully converted logs into 2-dimensional coordinates
|
| ICACT20260037 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
The classification modules clustered the data successfully:
With K-Means: Clustered the data into three distinct groups,
demonstrating the ability to automatically find and separate different types of behavior.
|
| ICACT20260037 Slide.21
[Big Slide]
|
Chrome Click!! |
 |
DBSCAN: Identified two main groups and also classified points as "noise. “
highlighting the necessity of the Voting Mechanism due to different model strengths.
|
| ICACT20260037 Slide.22
[Big Slide]
|
Chrome Click!! |
 |
SVM: Was able to draw clear "decision boundaries," confirming the data is separable for successful, real-time classification.
|
| ICACT20260037 Slide.23
[Big Slide]
|
Chrome Click!! |
 |
Finally, here is our Conclusion & Future Work
|
| ICACT20260037 Slide.24
[Big Slide]
|
Chrome Click!! |
 |
In conclusion, this framework successfully combines SDN, Docker, and parallel AI modules.
It creates a system that is both elastic and intelligent, capable of learning from new attacks.
The Voting Mechanism is critical for ensuring high-confidence decisions by leveraging the strengths of multiple AI models.
For future work, we plan to:
Expand the library of AI modules (e.g., add Generative AI for attack simulation).
Automate the full feedback loop with zero human intervention.
Test the framework at a larger, national-scale network.
|
| ICACT20260037 Slide.25
[Big Slide]
|
Chrome Click!! |
 |
thanks for your lsitening |
