Rapidly Deployed Artificial Intelligence Module Corresponding to Cyber Security Recognition and Learning

Popularity of Software Defined Network (SDN) technology is spreading rapidly and corporate networks are deploying to take advantages of its features. Control & Data planes are segregated in SDN and simple forwarding devices enabled with OpenFlow protocol is used to forward data planes. The responsibility of control planes are taken by controller into SDN network. The data packets are generated by source host and forwarded to destination host by seeing destination address of such packet without validating source host address. Flow of data packets is controlled by controller setting up required flow entries into flow table of forwarding devices. Initially forwarding devices do not have any security & control and they are not able to forward traffic generated by attached hosts. Data packets of attached hosts are sent to the controller by forwarding devices for generation of control packets and setup necessary flow entries into device flow table. Source IP spoofed attacks may be setup by attacker in this situation and perform different type of attacks. There are some techniques for prevention and mitigation from such attacks. In this study, we offer an analysis of available source address validation techniques for SDN environment. The study discussed various features, limitations and gaps of source address validation solutions and provided various areas in SDN Security for future research.

It is Software defined networking (SDN) is a new network approach which allows separation of the forwarding plane from the control plane in network architecture, that aids in the efficient control of data flow and gives network administrators a software- based method for managing and configuring the networks. In contrast to SDN, which provides a centralized controller, traditional network topologies require the individual configuration of each network device. Due to a centralized control functionality, SDN is increasingly used by businesses, telecom service providers, cloud providers, and many other users, as it encourages flexibility and scalability in the network while also assisting in streamlining operations. There is significant demand of SDN for effective and adaptable networks. SDN adoption has also been rising in the campuses and corporate sectors. This paper provides a concise overview of the Software Defined Networks (SDN) topic, which is essential for comprehending the fundamental principles of SDN in order to conduct research and implement SDN in many sectors. The initial focus is on the discussion of traditional networks, including their limitations, as well as the many issues encountered by industries. The topic of Software Defined Networks is explored, encompassing their necessity, historical background, architectural structure, interfaces, and models. Next, the many applications of Software-Defined Networking (SDN) are examined. Additionally, the various SDN case studies, vendors, setup issues with SDN, and current research fields were elucidated. The discussion focuses on the role of Software-Defined Networking (SDN) in Artificial Intelligence (AI), specifically addressing the issues associated with implementing SDN in AI.

Considering the problem that the SDN controller can not fully resolve the virtual network function during the Software Defined Network (SDN) and Network Function Virtualization (NVF) collaborative deployment in the satellite network, a SDN/NFV coordination based on the three-layer satellite network is designed. The framework extends the SDN controller function and proposes the SDN controller function extension method (SDN-FE) based on LightGBM algorithm. SDN-FE has extended the functions of the original SDN controller in three aspects. One is based on LightGBM to establish a classification model for intelligent forwarding of SDN controller data packets. The second is to learn and predict VNF modification of data packets through logistic regression. The third is to design an idle state monitoring mechanism. The above method effectively enhances the control capability of the SDN controller to the network. In terms of SDN packet forwarding classification, SDN-FE is compared with existing well-known machine learning classification algorithms such as SVM, random forest, LSTM. Simulation experiments show that the SDN packet forwarding classification problem is predictable. The average accuracy of the LightGBM model in multi-classification problems is over 69%, which is better than machine learning models such as SVM and random forest. The next step is to conduct an in-depth study of the packet rule learning algorithm in VNF.

With the Industry 4.0 revolution, modern organizations and their ecosystems are evolving rapidly. The cyberattack surface is growing simultaneously, thus enabling new cyberattacks that cannot be resolved by human intervention alone. Artificial intelligence (AI) has now become an essential tool that provides security as it has the potential to easily analyze billions of data and triangulate an array of possible cyberattacks that can range from active attacks like network exploitation or suspicious behavior such as eavesdropping, traffic analysis. An AI continues to learn from datasets, improve its models based on historic data and use those experiences to better recognize different types of attacks. Artificial intelligence has a great impact on the cyber security industry by predicting and preventing attacks before they even occur. In the Tokyo Olympics 2021, 450 million cyberattacks were attempted during the entirety of the events, but with the help of AI, none of the attacks affected the tournament because AI predicted attacks a week before it happened. AI has been helping with improved cyber security which would not have been achieved by human component alone. A recent survey done in IBM and Capgemini shows that 95% of security breaches arise due to human error alone. Forty-eight % executives in Capgemini use AI for threat detection, 18% say that it is used for response and 34% make use of AI for prediction. In the era of ever-evolving attacks and rapid increase in number of devices, AI and machine learning can aid in keeping track of attacks, help in threat detection automation, provide effective response to data exploitation, conduct network vulnerability surveillance, generate effective incident and response reports, form cyber threat intelligence reports, which are a few applications of AI in cyber security. As with every technology, AI comes with certain limitations too. Though it contributes to a high degree of accuracy and machine performance, there still exist certain levels of risk like producing false positives and negatives while detecting threats in a network. Using adversarial machine learning techniques to exploit the dataset of an AI and train it to mislead the application into believing threat activities are normal data is a possibility.

Software defined networks (SDN) remain a hot research field as it provides controllable networking operations. The SDN controller can be treated as the operating system of the SDN model and it holds the responsibility of performing different networking applications. Despite the benefits of SDN, security remains a challenging problem. At the same time, distributed denial of services (DDoS) is a typical attack on SDN owing to centralized architecture, especially at the control layer of the SDN. This article develops a new Cat Swarm Optimization with Fuzzy Rule Base Classification (CSO-FRBCC) model for cybersecurity in SDN. The presented CSO-FRBCC model intends to effectually categorize the occurrence of DDoS attacks in SDN. To achieve this, the CSO-FRBCC model primarily pre-processes the input data to transform it to a uniform format. Besides, the CSO-FRBCC model employs FRBCC classifier for the recognition and classification of intrusions. Moreover, the parameter optimization of the FRBCC classification model is adjusted by the use of cat swarm optimization (CSO) algorithm which results in improved performance. A comprehensive set of simulations were carried out on benchmark dataset and the results highlighted the enhanced outcomes of the CSO-FRBCC model over the other recent approaches.

Cybersecurity is an active and important area of study, practice, and research today. It spans various fields including cyber terrorism, cyber warfare, electronic civil disobedience, governance and security, hacking and hacktivism, information management and security, internet and controls, law enforcement, national security, privacy, protection of society and the rights of the individual, social engineering, terrorism, and more. This book compiles original and innovative findings on issues relating to cybersecurity and threats. This comprehensive reference explores the developments, methods, approaches, and surveys of cyber threats and security in a wide variety of fields and endeavors. It specifically focuses on cyber threats, cyberattacks, cyber techniques, artificial intelligence, cyber threat actors, and other related cyber issues. The book provides researchers, practitioners, academicians, military professionals, government officials, and other industry professionals with an in-depth discussion of the state-of-the-art advances in the field of cybersecurity.

The growing use and innovation in information technology and communication in all domains of life has made the world richer but also fragile and it has led to breach of privacy and increased dependence on the internet. Thus cyber security has become one of the major global concerns a growing nontraditional security issue. We can observe that the cyber security discourse of today emphasizes the increasing set of threats ranging from cybercrime, computer viruses, and cyber espionage. Globally cyber terrorism and cyber war are also becoming major issues that are discussed on global platforms. The complexity of the digital world and increased security risk have led to overemphasis that may violate equality, freedom of speech, and fairness. The study aims to highlight the growing paranoia that comes with the growth of cyberspace through the lens of the theory of realism, understanding that the concept of security dilemma also exists in the cyber domain. Just like traditional conflicts, states are engaged in constant power struggles in cyberspace. The study highlights the major concerns related to cyber security and cyber-warfare with its relationship to foreign policy implications for China and the U.S. The methodology applied in this study includes a comprehensive exploration of the landscape of cyber-security and cyber-warfare in China and the U.S. The chapter seeks to analyze the growing landscape of cyber security and cyber warfare and the changing nature of threats with a focus on the foreign policy implications of China and the U.S. about cyber security and warfare. A detailed comparative analysis of China and the U.S. with an understanding of differences and potentials of collaboration and conflict concerning cyber policies. The chapter will contribute to the promotion of international cooperation in addressing this new emerging global challenge of cyber security and warfare. With deep insights to understand this global threat, this research aspires to have a lasting influence on national security considerations with evidence-based suggestions and recommendations. By identifying potential areas for collaboration and examining diplomatic responses to cyber incidents. This chapter seeks to foster a more collaborative approach to secure cyber security and the implication of the phenomenon on the Foreign Policies of China and the U.S. Recognizing that Cybersecurity is entwined with international relations, the research argues that findings extend beyond the specific context of China and the U.S. The chapter aims to contribute to the vast field of international relations by shedding light on the complex between national interest, diplomatic relations, and Cybersecurity. The key argument in this study is to underscore the rapidly evolving nature of cyber warfare tactics and Cybersecurity threats and emphasize the need for an adaptive policy response to effectively counter emerging challenges in both China and the U.S.

Introduction: Distributed denial-of-service (DDoS) has become a common attack type in cyber security. Apart from the conventional DDoS attacks, software-defined networks also face some other typical DDoS attacks, such as flow-table attack or controller attack. One of the most recent solutions to detect a DDoS attack is using machine learning algorithms to classify the traffic. Purpose: Analysis of applying machine learning algorithms in order to prevent DDoS attacks in software-defined network. Results: A comparison of six algorithms (random forest, decision tree, naive Bayes, support vector machine, multilayer perceptron, k-nearest neighbors) with accuracy and process time as the criteria has shown that a decision tree and naïve Bayes are the most suitable algorithms for DDoS attack detection. As compared to other algorithms, they have higher accuracy, faster processing time and lower resource consumption. The main features that identify malicious traffic compared to normal one are the number of bytes in a flow, time flow, Ethernet source address, and Ethernet destination address. A flow-table attack can be detected easier than a bandwidth attack, as all the six algorithms can predict this type with a high accuracy. Practical relevance: Important features which play a supporting role in correct data classification facilitate the development of a DDoS protection system with a smaller dataset, focusing only on the necessary data. The algorithms more suitable for machine learning can help us to detect DDoS attacks in software-defined networks more accurately.

Artificial intelligence based load balancing in SDN: A comprehensive survey

Software Defined Networking (SDN) revolutionizes network control by separating the control plane from the data plane. Although the latter improves SDN agility and scalability, it creates a security hole, particularly in a central control plane, leading to SDN environments becoming high-profile targets for advanced cybersecurity threats. Due to static and signature-based point-in-time behavior, traditional security methods are unable to keep up with modern attacks that are an anomaly to SDNs. Artificial Intelligence (AI) with its different applications and techniques, has the capability of detecting SDN cyber threats’ anomalies. This paper presents the results of a literature scoping exercise that used a total of 54 papers that looked at AI-driven anomaly detection in SDN. The findings showed that control theory, activity theory, and anomaly detection theory are three theoretical aspects that contribute to the topic of AI-driven anomaly detection in SDN. Furthermore, different machine learning algorithms give different results. In this regard, Random Forest (RF), Support Vector Machine (SVM), and Multi-Layer Perceptron would help in detecting threats of a familiar nature, while autoencoders and K-means can detect unfamiliar threats. While deep learning architectures such as Long Short-Term Memory (LSTM) networks and Convolutional Neural Networks (CNN) support low-latency anomaly detection while maintaining throughput and network stability. The findings could be the basis of providing a conceptual framework on how an intelligent, adaptive, and resilient SDN with real-time threat defense mechanisms could be designed, developed, and deployed.

Attack-aware Security Function Management

Software Defined Networking (SDN) is developing as a new solution for the development and innovation of the Internet. SDN is expected to be the ideal future for the Internet, since it can provide a controllable, dynamic, and cost-effective network. The emergence of SDN provides a unique opportunity to achieve network security in a more efficient and flexible manner. However, SDN also has original structural vulnerabilities, which are the centralized controller, the control-data interface and the control-application interface. These vulnerabilities can be exploited by intruders to conduct several types of attacks. In this paper, we propose a deep learning (DL) approach for a network intrusion detection system (DeepIDS) in the SDN architecture. Our models are trained and tested with the NSL-KDD dataset and achieved an accuracy of 80.7% and 90% for a Fully Connected Deep Neural Network (DNN) and a Gated Recurrent Neural Network (GRU-RNN), respectively. Through experiments, we confirm that the DL approach has the potential for flow-based anomaly detection in the SDN environment. We also evaluate the performance of our system in terms of throughput, latency, and resource utilization. Our test results show that DeepIDS does not affect the performance of the OpenFlow controller and so is a feasible approach.

With each passing day, the information and communication technologies are evolving with more and more information shared across the globe using the internet superhighway. The threats to information, while connected to the cyber world are getting more targeted, voluminous, and sophisticated requiring new antifragile and resilient network security mechanisms. Whether the information is being processed in the application, in transit within the network or residing in the storage, it is equally susceptible to attack at every level of abstraction and cannot be handled in isolation as the case has been with conventional security mechanisms. The advent of Software-Defined Networks (SDN) has given a new outlook to information protection, where the network can aid in the design of a system that is secure and dependable in case of cyber threats. The nature of SDN, mainly its programmability and centrality of network information and control has led us to think of security in an antifragile perspective. Our networks can now thrive and grow stronger when they are exposed to volatility by overwhelming cyber threats. However, SDN infrastructure itself is susceptible to severe threats that may mutilate the provision of its usability as security provider. Both these perspectives of “Security with SDN” and “Security for SDN” have invited research and innovations, yet both these approaches remain disintegrated, failing to support each other. The contribution of this paper is threefold, with first reviewing the current state of the art work for both perspectives of SDN security. Second, it advocates the necessity and introduces a novel approach of antifragile cyber security within SDN paradigm and finally it proposes a unified model for integrating both approaches of “Security with SDN” and “Security for SDN” to achieve the overall objective of protecting our information from cyber threats in this globally connected internetwork.

Software Defined Networking (SDN) is a new type of network architecture, which provides an important way to implement automated network deployment and flexible management. However, security problems in SDN are also inevitable. DDoS attack belongs to one of the most serious attack types, which is fairly common for today’s Internet. In SDN security fields, DDoS attack detection research has been received more and more attention. In this paper, a DDoS attack detection method based on one-class SVM in SDN is proposed, which provides a better detection accuracy. Furthermore, two new feature vectors, including middle value of flow table item’s duration and protocol data traffic percentage, are extracted to integrate into the item of 11 feature vectors. Additionally, basing on selection and construction method of the 11 feature vectors, a DDoS attack behavior model is established by using one-class SVM algorithm, and the self-adaptation genetic algorithm is designed to optimize the corresponding parameters of the Gaussian kernel of one-class SVM. The experimental results in SDN show that, the proposed new feature vectors are shown to more better detection accuracy, and the proposed method is more feasible by comparing with the BP neural network and RBF neural network algorithms under the same 11 features vectors.

Editorial: "Cyber Security Prevention, Defenses Driven by AI and Mathematical Modelling and Simulation Tools". The rise of the Smart Computation driven by the Artificial Intelligence with the ubiquitous access to Data Computer Communication Technologies and Internet by anyone, from anywhere at any time, has become a working, learning and socializing platform for people worldwide and if often known as Cyberspace. The past century technological advancements in the Data Communications Technologies , Semiconductor Industry (SI) and a Very Large Scale Integration (VLSI) contributed to significant increase of computer systems performance and computational capacity of small portable computers and cell phones that have become available at low cost for people anywhere in the world. Due to relatively low cost, anyone and anywhere in the world may purchase a PC, Laptop, Smart Phone, or Tablet. These smart-computational devices are capable of powerful computation and connecting almost any computer system in the world via Internet 24/7. Given the current unstable geopolitical ecosystem in conjunction with the dynamic development in the artificial intelligence (AI), smart computation and fast Internet with the ubiquitous access to Internet 24/7, the reliable and secure provision of confidentiality, integrity and accessibility of data available via Internet, has become essential for government, business, the industry and individual worldwide. The fast developments in the field of AI gave rise to a new era of smart computation that can easily be utilized by the governments, special groups or very well trained and skilled individual with malicious intend due to their political , economic or personal motivation. Given the rise of next generation of smart cyberattacks, the use of AI and Mathematical Modeling and Simulations Tools has become essential part of cybersecurity tool kit, to make sure that contra cyber measures are most effective and reliable in real-time 24/7. The Research Topic was received with great interest in the scholastic and professional community worldwide. The paper selection was very competitive based on rigorous reviews presenting seven papers. The Research Topic presents a collection of selected peer reviewed papers presenting most recent advances and the state-of-the-art in the field of. Applied AI and Mathematical Modelling in Cyber Security. The papers show evidence that cyberattacks are becoming much more sophisticated, computationally complex, and challenging for the current cyber security mechanisms, which drives the research, innovation, and development of the next generation of AI assisted Cyber Security imbedded with the Mathematical Modelling and Simulations tools. The first paper presents practical application of eXplainable AI (XAI) in cybersecurity while enabling a machine-human interaction. The second paper discusses effective use of AI applied in the cyberattacks prevention utilizing Intrusion Detection and Prevention Systems (IDPS). The third paper presents use of deep learning and machine learning algorithms to identify the malicious malware. The fourth paper discusses the use of encryption and cryptographic algorithms in creating an effective cyber defenses in the Internet of Thing Cyber Infrastructures. The fifth paper presents effective methods to identify possible cyberattacks utilizing the noisy audio evidence. The sixth paper illustrates utilization of simulation based on the dropout mechanisms to identify obfuscated malicious traffic. The seventh paper presents effective applications of Generative AI Influenced Spread, Extended Models and Awareness Spread Models to analyze fake news propagation and enable the intervention strategy assessment. The Research Topic brings to light most recent developments in the field of applied AI and Mathematical Modeling and Simulations in Cyber Security, while presenting current and future challenges presented by ongoing challenges in the field of studies. Given the current dynamic advancements in the field of AI, Smart Computation and AI, we are yet at the very beginning of new era of new generation of ultra-smart and most sophisticated cyberattacks that will require a new ultra-smart cyber defenses to make sure that the future cyberspace will be safe, reliable and beneficial to the betterment of mankind for future generations for many years to come. The Research Topic promotes creation of the AI Inspired Cyber Security Center, bringing together multidisciplinary research teams working together while seeking best solutions and mechanism to make the current and future cyberspace safe, secure and reliable 27/7 in the nation and worldwide. The Topic Editors would like to use this opportunity to express most sincere gratitude to contributors, reviewers, to Dr. Enrique Morillas, Dr. Nicola Zannone, Mr Sean O'Reilly Ms Alice Gooch, and Colleagues at Frontiers in Computer Science for their strong support, kind guidance and good counsel provided during the course of the project.