A Review of Cyber-Ranges and Test-Beds: Current and Future Trends

Ukwandu, Elochukwu; Farah, Mohamed Amine Ben; Hindy, Hanan; Brosset, David; Kavallieros, Dimitris; Atkinson, Robert; Tachtatzis, Christos; Bureš, Miroslav; Andonović, Ivan; Bellekens, Xavier

doi:10.3390/s20247148

Cited by 58 publications

(22 citation statements)

References 80 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A cyber range is a well defined controlled virtual environment used in cybersecurity training as an efficient way for trainees to gain practical knowledge through hands-on activities. Several works have been proposed to study and classify the concept of a cyber range covering different types of cyber ranges and security testbeds 34 – 36 . Although, in recent years, Artificial Intelligence and Machine Learning based technologies have been started to be actively used for cyber defense purposes 37 – 39 , their inclusion in cyber ranges is still in their infancy.…”

Section: Related Workmentioning

confidence: 99%

Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks

Mozó

González-Prieto

Pastor

et al. 2022

Sci Rep

View full text Add to dashboard Cite

Due to the growing rise of cyber attacks in the Internet, the demand of accurate intrusion detection systems (IDS) to prevent these vulnerabilities is increasing. To this aim, Machine Learning (ML) components have been proposed as an efficient and effective solution. However, its applicability scope is limited by two important issues: (i) the shortage of network traffic data datasets for attack analysis, and (ii) the data privacy constraints of the data to be used. To overcome these problems, Generative Adversarial Networks (GANs) have been proposed for synthetic flow-based network traffic generation. However, due to the ill-convergence of the GAN training, none of the existing solutions can generate high-quality fully synthetic data that can totally substitute real data in the training of ML components. In contrast, they mix real with synthetic data, which acts only as data augmentation components, leading to privacy breaches as real data is used. In sharp contrast, in this work we propose a novel and deterministic way to measure the quality of the synthetic data produced by a GAN both with respect to the real data and to its performance when used for ML tasks. As a by-product, we present a heuristic that uses these metrics for selecting the best performing generator during GAN training, leading to a novel stopping criterion, which can be applied even when different types of synthetic data are to be used in the same ML task. We demonstrate the adequacy of our proposal by generating synthetic cryptomining attacks and normal traffic flow-based data using an enhanced version of a Wasserstein GAN. The results evidence that the generated synthetic network traffic can completely replace real data when training a ML-based cryptomining detector, obtaining similar performance and avoiding privacy violations, since real data is not used in the training of the ML-based detector.

show abstract

Section: Related Workmentioning

confidence: 99%

Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks

Mozó

González-Prieto

Pastor

et al. 2022

Sci Rep

View full text Add to dashboard Cite

show abstract

“…Specifically, the game is set up as a partially observed game and the authors study different scenarios in which the abilities of the attacker and defender vary. In their game, the attacker must move through a graph to reach a target machine, simulating a problem similar to those posed in the Cyber Ranges [35]. In that work, the model-free algorithms PPO [36] and REINFORCE [37] are used to train the agent.…”

Section: ) Autonomous Intrusion Mitigation Systems In Sdnsmentioning

confidence: 99%

Towards Autonomous Defense of SDN Networks Using MuZero Based Intelligent Agents

et al. 2021

View full text Add to dashboard Cite

The Software Defined Networking (SDN) paradigm enables the development of systems that centrally monitor and manage network traffic, providing support for the deployment of machine learningbased systems that automatically detect and mitigate network intrusions. This paper presents an intelligent system capable of deciding which countermeasures to take in order to mitigate an intrusion in a software defined network. The interaction between the intruder and the defender is posed as a Markov game and MuZero algorithm is used to train the model through self-play. Once trained, the model is integrated with an SDN controller, so that it is able to apply the countermeasures of the game in a real network. To measure the performance of the model, attackers and defenders with different training steps have been confronted and the scores obtained by each of them, the duration of the games and the ratio of games won have been collected. The results show that the defender is capable of deciding which measures minimize the impact of the intrusion, isolating the attacker and preventing it from compromising key machines in the network.

show abstract

“…In the last decade, a number of commercial and noncommercial cyber ranges were developed, e.g., Cyber Range Instantiation System, DETER, ELTA Cyber Academy, Airbus Cyber Range, Silensec Cyber Range, and Circadence [6]- [9]. The comprehensive summary of cyber ranges is presented in [10]- [12]. These cyber ranges mainly differ in technologies, integrated capabilities, and functionalities.…”

Section: A Cyber Rangesmentioning

confidence: 99%

“…To conclude the review of related work, cybersecurity handson education currently uses lightweight labs [18] or cyber ranges [10]- [12]. The cyber ranges have its drawbacks in the difficult deployment and heavy resource requirements (despite being offloaded from students to instructors).…”

Section: B Lightweight Labsmentioning

confidence: 99%

Scalable Learning Environments for Teaching Cybersecurity Hands-on

Vykopal,

Čeleda,

Seda

et al. 2021

Preprint

View full text Add to dashboard Cite

A Review of Cyber-Ranges and Test-Beds: Current and Future Trends

Cited by 58 publications

References 80 publications

Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks

Synthetic flow-based cryptomining attack generation through Generative Adversarial Networks

Towards Autonomous Defense of SDN Networks Using MuZero Based Intelligent Agents

Scalable Learning Environments for Teaching Cybersecurity Hands-on

Contact Info

Product

Resources

About