The correct and efficient measurement of security properties is key to the deployment of effective cyberspace protection strategies. In this work, we propose GRAPH4, which is a system that combines different security metrics to design an attack detection approach that leverages the advantages of modern network architectures. GRAPH4 makes use of attack graphs that are generated by the control plane to extract a view of the network components requiring monitoring, which is based on the specific attack that must be detected and on the knowledge of the complete network layout. It enables an efficient distribution of security metrics tasks between the control plane and the data plane. The attack graph is translated into network rules that are subsequently installed in programmable nodes in order to enable alerting and detecting network anomalies at a line rate. By leveraging data plane programmability and security metric scores, GRAPH4 enables timely responses to unforeseen conditions while optimizing resource allocation and enhancing proactive defense. This paper details the architecture of GRAPH4, and it provides an evaluation of the performance gains it can achieve.

GRAPH4: A Security Monitoring Architecture Based on Data Plane Anomaly Detection Metrics Calculated over Attack Graphs / Gori, Giacomo; Rinieri, Lorenzo; Al Sadi, Amir; Melis, Andrea; Callegati, Franco; Prandini, Marco. - In: FUTURE INTERNET. - ISSN 1999-5903. - ELETTRONICO. - 15:11(2023), pp. 368.1-368.19. [10.3390/fi15110368]

GRAPH4: A Security Monitoring Architecture Based on Data Plane Anomaly Detection Metrics Calculated over Attack Graphs

Gori, Giacomo
Membro del Collaboration Group
;
Rinieri, Lorenzo
Membro del Collaboration Group
;
Al Sadi, Amir
Membro del Collaboration Group
;
Melis, Andrea
Writing – Review & Editing
;
Callegati, Franco
Writing – Review & Editing
;
Prandini, Marco
Writing – Review & Editing
2023

Abstract

The correct and efficient measurement of security properties is key to the deployment of effective cyberspace protection strategies. In this work, we propose GRAPH4, which is a system that combines different security metrics to design an attack detection approach that leverages the advantages of modern network architectures. GRAPH4 makes use of attack graphs that are generated by the control plane to extract a view of the network components requiring monitoring, which is based on the specific attack that must be detected and on the knowledge of the complete network layout. It enables an efficient distribution of security metrics tasks between the control plane and the data plane. The attack graph is translated into network rules that are subsequently installed in programmable nodes in order to enable alerting and detecting network anomalies at a line rate. By leveraging data plane programmability and security metric scores, GRAPH4 enables timely responses to unforeseen conditions while optimizing resource allocation and enhancing proactive defense. This paper details the architecture of GRAPH4, and it provides an evaluation of the performance gains it can achieve.
2023
GRAPH4: A Security Monitoring Architecture Based on Data Plane Anomaly Detection Metrics Calculated over Attack Graphs / Gori, Giacomo; Rinieri, Lorenzo; Al Sadi, Amir; Melis, Andrea; Callegati, Franco; Prandini, Marco. - In: FUTURE INTERNET. - ISSN 1999-5903. - ELETTRONICO. - 15:11(2023), pp. 368.1-368.19. [10.3390/fi15110368]
Gori, Giacomo; Rinieri, Lorenzo; Al Sadi, Amir; Melis, Andrea; Callegati, Franco; Prandini, Marco
File in questo prodotto:
File Dimensione Formato  
futureinternet-15-00368.pdf

accesso aperto

Tipo: Versione (PDF) editoriale
Licenza: Licenza per Accesso Aperto. Creative Commons Attribuzione (CCBY)
Dimensione 1.71 MB
Formato Adobe PDF
1.71 MB Adobe PDF Visualizza/Apri

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11585/949113
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 1
  • ???jsp.display-item.citation.isi??? 1
social impact