Root Cause Analysis for Autonomous Optical Network Security Management
Artikel i vetenskaplig tidskrift, 2022

The ongoing evolution of optical networks towards autonomous systems supporting high-performance services beyond 5G requires advanced functionalities for automated security management. To cope with evolving threat landscape, security diagnostic approaches should be able to detect and identify the nature not only of existing attack techniques, but also those hitherto unknown or insufficiently represented. Machine Learning (ML)-based algorithms perform well when identifying known attack types, but cannot guarantee precise identification of unknown attacks. This makes Root Cause Analysis (RCA) crucial for enabling timely attack response when human intervention is unavoidable. We address these challenges by establishing an ML-based framework for security assessment and analyzing RCA alternatives for physical-layer attacks. We first scrutinize different Network Management System (NMS) architectures and the corresponding security assessment capabilities. We then investigate the applicability of supervised and unsupervised learning (SL and UL) approaches for RCA and propose a novel UL-based RCA algorithm called Distance-Based Root Cause Analysis (DB-RCA). The framework’s applicability and performance for autonomous optical network security management is validated on an experimental physical-layer security dataset, assessing the benefits and drawbacks of the SL-and UL-based RCA. Besides confirming that SL-based approaches can provide precise RCA output for known attack types upon training, we show that the proposed UL-based RCA approach offers meaningful insight into the anomalies caused by novel attack types, thus supporting the human security officers in advancing the physical-layer security diagnostics.

Författare

Carlos Natalino Da Silva

Chalmers, Elektroteknik, Kommunikation, Antenner och Optiska Nätverk

Marco Schiano

Telecom Italia S.P.A

Andrea Di Giglio

Telecom Italia S.P.A

Marija Furdek Prekratic

Chalmers, Elektroteknik, Kommunikation, Antenner och Optiska Nätverk

IEEE Transactions on Network and Service Management

19324537 (eISSN)

Vol. 19 3 2702-2713

Providing Resilient & secure networks [Operating on Trusted Equipment] to CriTical infrastructures (PROTECT)

VINNOVA (2020-03506), 2021-02-01 -- 2024-01-31.

Secured autonomic traffic management for a Tera of SDN flows (TeraFlow)

Europeiska kommissionen (EU) (EC/H2020/101015857), 2021-01-01 -- 2023-06-30.

Skydda optiska kommunikationsnätverk från cyber-säkerhetsattacker

Vetenskapsrådet (VR) (2019-05008), 2020-01-01 -- 2023-12-31.

Styrkeområden

Informations- och kommunikationsteknik

Ämneskategorier

Kommunikationssystem

Inbäddad systemteknik

DOI

10.1109/TNSM.2022.3198139

Mer information

Senast uppdaterat

2024-03-07