Anomalies in cyber security: detection, prevention and simulation approaches

With themassive adoption of the Internet both our private andworking life has drastically\nchanged. The Internet has introduced new ways to communicate and complete\nevery day tasks. Organisations of any kind have taken their activities online to\nachieve many advantages, e.g. commercial organisations can reach more customers\nwith proper marketing. However, the Internet has also brought various drawbacks\nand one of these concerns cyber security issues. Whenever an entity (e.g. a person or\ncompany) connects to the Internet it immediately becomes a potential target of cyber\nthreats, i.e. malicious activities that take place in cyberspace. Examples of cyber\nthreats are theft of intellectual property and denial of service attacks. Many efforts\nhave been spent to make the Internet perhaps the most revolutionary communication\ntool ever created, but unfortunately little has been done to design it in a secure\nfashion. Since the massive adoption of the Internet we have witnessed a huge number\nof threats, perpetrated by many different actors such as criminal organisations,\ndisgruntled workers and even people with little expertise, thanks to the existence of\nattack toolkits. On top of that, cyber threats are constantly going through a steady\nevolution process and, as a consequence, they are getting more and more sophisticated.\nNowadays, the cyber security landscape is in a critical condition. It is of\nutmost importance to keep up with the evolution of cyber threats in order to improve\nthe state of cyber security. We need to adapt existing security solutions to the\never-changing security landscape and devise new ones when needed. The research\nactivities presented in this thesis find their place in this complex scenario. We investigated\nsignificant cyber security problems, related to data analysis and anomaly\ndetection, in different areas of research, which are: Hybrid Anomaly Detection Systems;\nIntrusion Detection Systems; Access Control Systems and Internet of Things.\nAnomaly detection approaches are very relevant in the field of cyber security.\nFraud and intrusion detection arewell-known research areaswhere such approaches\nare very important. A lot of techniques have been devised, which can be categorised\nin anomaly and signature based detection techniques. Researchers have also spent\nmuch effort on a third category of detection techniques, i.e. hybrid anomaly detection,\nwhich combine the two former approaches in order to obtain better detection\nperformances. Towards this direction, we designed a generic framework, called\nHALF, whose goal is to accommodate multiple mining algorithms of a specific domain\nand provide a flexible and more effective detection capability. HALF can be\neasily employed in different application domains such as intrusion detection and\nsteganalysis due to its generality and the support provided for the data analysis\nprocess. We analysed two case studies in order to show how HALF can be exploited\nin practice to implement a Network Intrusion Detection System and a Steganalysis\ntool.\nThe concept of anomaly is a core element of the research activity conducted in\nthe context of intrusion detection, where an intrusion can be seen as an anomalous\nactivity that might represent a threat to a network or system. Intrusion detection\nsystems constitute a very important class of security tools which have become an\ninvaluable defence wall against cyber threats. In this thesis we present two research results that stemfromissues related to IDSs that resort to the n-grams technique. The\nstarting point of our first contribution is the threat posed by content-based attacks.\nTheir goal is to deliver malicious content to a service in order to exploit its vulnerabilities.\nThis type of attacks has been causing serious damages to both people and\norganisations over these years. Some of these attacks may exploit web application\nvulnerabilities to achieve goals such as data theft and privilege escalation, which\nmay lead to enormous financial loss for the victim. IDSs that exploit the n-gram\ntechnique have proven to be very effective against this category of cyber threats.\nHowever, n-grams may not be sufficient to build reliable models that describe normal\nand/or malicious traffic. In addition, the presence of an adversarial attacker is\nnot properly addressed by the existing solutions. We devised a novel anomaly-based\nintrusion detection technique, called PCkAD to detect content-based attacks threatening\napplication level protocols. PCkAD models legitimate traffic on the basis of\nthe spatial distribution of the n−grams occurring in the relevant content of normal\ntraffic and has been designed to be resistant to blending evasion techniques. Indeed,\nwe demonstrate that evading is an intrinsically difficult problem. The experiments\nconducted to evaluate PCkAD show that it achieves state of the art performances in\nreal attack scenarios and that it performs well against blending attacks. The second\ncontribution concerning intrusion detection investigates issues that may be brought\nby the employment of the n-gram technique. Many approaches using n-grams have\nbeen proposed in literature which typically exploit high order n-grams to achieve\ngood performance. However, because the n-gram domain grows exponentially with\nrespect to the n-gram size, significant issues may arise, from the generation of huge\nmodels to overfitting. We present an approach aimed to reduce the size of n-grambased\nmodels, which is able build models that contain only a fraction of the original\nn-grams with little impact on the detection accuracy. The reported experiments, conducted\non a real word dataset, show promising results.\nThe research concerning access control systems focused on anomalies that represent\nattempts of exceeding or misusing access controls to negatively affect the confidentiality,\nintegrity or availability of a target information system. Access control\nsystems are nowadays the first line of defence of modern computing systems. However,\ntheir intrinsic static nature hinders autonomously refinement of access rules\nand adaptation to emerging needs. Advanced attributed-based systems still rely\non mainly manual administration approaches and are not effective on preventing\ninsider threat exploiting granted access rights. We introduce a machine learning approach\nto refine attribute-based access control policies based on behavioural patterns\nof users’ access to resources. The designed system tailors a learning algorithm upon\nthe decision tree solutions. We analysed a case study and conducted an experiment\nto show the effectiveness of the system.\nIoT is the last topic of interest in the present thesis. IoT is showing the potential\nfor impacting several domains, ranging from personal to enterprise environments.\nIoT applications are designed to improve most aspects of both business and citizens’\nlives, however such emerging technology has become an attractive target for\ncybercriminals. A worrying security problem concerns the presence of many smart\ndevices that have security holes. Researchers are investing their efforts in the evaluation\nof security properties. Following this direction, we show that it is possible to\neffectively assess cyber security scenarios involving IoT settings by combining novel\nvirtual environments, agent-based simulation and real devices and then achieving a\nmeans that helps prevent anomalous actions fromtaking advantage of security holes\nfor malicious purposes. We demonstrate the effectiveness of the approach through\na case study regarding a typical smart home setting.