Cyber situational awareness through network anomaly detection: state of the art and new approaches

摘要: With a major change in the attack landscape, away from well-known vectors towards unique and highly tailored attacks, limitations of common rule- signature-based security systems become more obvious. Novel mechanisms can provide means to extend existing solutions order sophisticated approach. As critical infrastructures get increasingly accessible public networks they show up on attackers’ radars. consequence, establishing cyber situational awareness higher level through incident information sharing is vital for assessing increased risk national space. But legal obligations economical considerations limit motivation companies pursue initiatives. To support governmental initiatives, novel should inherently address limiting factors. One approach, AECID, presented that accounts many intrusion anomaly detection mechanisms; which further provides features privacy-aware awareness.