The evolution of Internet of Things is expected to have a major impact on the lives of citizens as new services can be developed by the integration of the physical and digital worlds. Smart devices and networks with improved capabilities can produce a considerable impact on the users’ well-being with the emergence of new “systems-of-systems” (SoS). On the way towards such IoT-based SoS, this added richness and connectivity also poses a significant risk: increased malware targeting both the networking layer, in an attempt to extract sensitive information through advanced network attacks, and the edge devices themselves in order to alter or disrupt the device’s behavior that can, in turn, lead to alternation of the data originating from these types of devices (impact on data trustworthiness). Famous cases such as the Maersk 2016 ransomware attack that cost close to 2 billion DKK, the IoT thermometer used to access casino high-roller information, compromised baby monitors and more stand as recent examples of the immediate threat these attackers pose to the world. Considering that one of the core advantages is the unprecedented amount of data available for safety-critical decision making, we must be able to control those risks: key security enablers geared towards this direction is the investigation of advanced intrusion detection, based on the use of machine/deep-learning algorithms, capable of achieving enhanced security awareness.
The goal of this research project is to engage artificial intelligence and data science technologies towards developing a unified adversarial classification framework for identifying complex cyber-security threats in the Internet (e.g., malicious domains) and other cloud-based networking paradigms; taking into account uncertainty of data provenance, used for the classification, while handling the necessary belief inference and propagation modelling.
Towards this direction, the use of machine- and deep-learning has become ubiquitous – especially considering the advancements in computational efficiency and the maturity of large datasets available in modern day context. Their predictions are used to make decisions about a number of critical applications including (amongst others) security in identifying complex cyber-security threats in the context of the Internet (e.g., malicious domains) and other networking environments. Concretely, this project will be taking a discourse from the standpoint of malicious Domain Name Server (DNS) detection. DNS is a critical Internet service resolving IP addresses into hostnames that is crucial for the day-to-day operations of most safety-critical systems. DNS, however, is susceptible to a wide range of attacks ranging from Domain Hijacking, DNS Flooding and Distributed Reflection Denial of Service (DRDoS) to Cache Poisoning, DNS Hijacking, DNS Spoofing, DNS Tunneling, etc. Leveraging machine- and deep-learning related concepts in the presence of the aforementioned adversarial tactics towards enhanced classification, detection and security awareness is the core pillar of Adversarial Machine Learning – another emerging research area that will be heavily investigated in the context of this project towards understanding and improving the effectiveness of AI methods in the presence of sophisticated adversaries.
Streamlined, this project will use available collected data sets containing information about known malicious attacks (e.g. phishing, botnets, viruses, man-in-the-middle attack, spoofing etc.) and make an adversarial machine-learning tool that can emulate attackers’ adversarial usage of machine learning techniques in their attack, within the context of malicious DNS servers. That information and tools will be used towards developing generic classification models that will be able to detect and protect against such adversaries and techniques.