Explainable and Robust AI-powered Intrusion Detection Management

可解释且强大的人工智能驱动的入侵检测管理

• 批准号: 10074348
• 金额: $ 6.36万
• 依托单位: NETRITY LTD
• 依托单位国家: 英国
• 项目类别: Grant for R&D
• 财政年份: 2023
• 资助国家: 英国
• 起止时间: 2023 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=10074348
• 关键词: Explainable; Robust; AI; powered; Intrusion

Recently there has been a rise in cyber attacks with 81% of UK organizations suffering some form of cyberattack in 2021\. In the UK the cost amounts to $1.08 million per incident while the lack of a specialised workforce is the largest challenge. Companies including SMEs, large organisations, and the public sector are expected to continue expanding their online presence. Especially when critical sectors are concerned (e.g. power, oil and gas, defence, health) this online presence introduces a larger surface for potential attacks with more and more private and protected information being threatened. As a result, there is a rise in the demand for cybersecurity solutions which are now more relevant than ever. Much research is undertaken in the UK and globally in developing more secure hardware and software solutions to address this increasing need. One of the directions that aim to automate cybersecurity efforts is Intrusion Detection and Management (IDM) and Intrusion Prevention Systems (IPS).IDM and IPS will become necessary for any organisation that handles and stores sensitive information (e.g. GDPR protected information, critical infrastructure, operations management etc.). However, as many modern solutions depend heavily on the use of Artificial Intelligence (AI) they demand that their users are highly specialised both in cybersecurity and AI. This in turn introduces issues of trust specifically for organisations in the critical domains. The main challenge for innovative AI approaches is that they either focus on signature or anomaly-based detection in large volumes of network traffic monitoring data. In both categories, AI has been applied but industrially used products still lack in explainable, robust, and transparent solutions. Also, there are limited publicly available datasets that allow models to train over known limited patterns. Models are usually trained in well-known datasets and cannot identify or respond to more sophisticated attacks. This is a barrier to their widespread use at present.We propose to address this barrier by developing solutions compliant with Ethical AI intelligence strategy, following legislation, and legal frameworks. This ascertains that the AI approach will be Transparent, Reliable, and Accountable ensuring that AI models will be designed and developed with an increased level of explainability, and reliability thus reducing the training overhead for companies and organisations. This project's objectives are to expand our solutions for the IDM use case and evaluate the explainability and robustness through stress testing under orchestrated attacks from single and multiple sources.

最近网络攻击有所增加，81% 的英国组织将在 2021 年遭受某种形式的网络攻击。在英国，每次事故的成本高达 108 万美元，而缺乏专业劳动力是最大的挑战。包括中小企业、大型组织和公共部门在内的公司预计将继续扩大其在线业务。特别是当涉及关键部门（例如电力、石油和天然气、国防、卫生）时，这种在线存在为潜在攻击带来了更大的表面，越来越多的私人和受保护信息受到威胁。因此，对网络安全解决方案的需求不断增加，而这些解决方案现在比以往任何时候都更加重要。英国和全球开展了大量研究，开发更安全的硬件和软件解决方案，以满足这一日益增长的需求。旨在实现网络安全工作自动化的方向之一是入侵检测和管理 (IDM) 和入侵防御系统 (IPS)。对于任何处理和存储敏感信息（例如 GDPR 保护的信息、关键基础设施、运营管理等）。然而，由于许多现代解决方案严重依赖人工智能 (AI) 的使用，因此要求用户在网络安全和人工智能方面高度专业化。这反过来又引入了专门针对关键领域组织的信任问题。创新人工智能方法的主要挑战是它们要么专注于大量网络流量监控数据中的签名或基于异常的检测。在这两个类别中，人工智能都得到了应用，但工业使用的产品仍然缺乏可解释、稳健和透明的解决方案。此外，允许模型在已知的有限模式上进行训练的公开数据集有限。模型通常是在众所周知的数据集中进行训练的，无法识别或响应更复杂的攻击。这是目前其广泛使用的障碍。我们建议通过开发符合道德人工智能情报战略、遵循立法和法律框架的解决方案来解决这一障碍。这确定了人工智能方法将是透明、可靠和负责任的，确保人工智能模型的设计和开发具有更高的可解释性和可靠性，从而减少公司和组织的培训开销。该项目的目标是扩展我们针对 IDM 用例的解决方案，并通过来自单一和多个来源的精心策划的攻击下的压力测试来评估可解释性和稳健性。