The Next Generation Cognitive Security Operations Center: Network Flow Forensics Using Cybersecurity Intelligence

Abstract

A Security Operations Center (SOC) can be defined as an organized and highly skilled team that uses advanced computer forensics tools to prevent, detect and respond to cybersecurity incidents of an organization. The fundamental aspects of an effective SOC is related to the ability to examine and analyze the vast number of data flows and to correlate several other types of events from a cybersecurity perception. The supervision and categorization of network flow is an essential process not only for the scheduling, management, and regulation of the network's services, but also for attacks identification and for the consequent forensics' investigations. A serious potential disadvantage of the traditional software solutions used today for computer network monitoring, and specifically for the instances of effective categorization of the encrypted or obfuscated network flow, which enforces the rebuilding of messages packets in sophisticated underlying protocols, is the requirements of computational resources. In addition, an additional significant inability of these software packages is they create high false positive rates because they are deprived of accurate predicting mechanisms. For all the reasons above, in most cases, the traditional software fails completely to recognize unidentified vulnerabilities and zero-day exploitations. This paper proposes a novel intelligence driven Network Flow Forensics Framework (NF3) which uses low utilization of computing power and resources, for the Next Generation Cognitive Computing SOC (NGC2SOC) that rely solely on advanced fully automated intelligence methods. It is an effective and accurate Ensemble Machine Learning forensics tool to Network Traffic Analysis, Demystification of Malware Traffic and Encrypted Traffic Identification.

A Hybrid Adaptive Educational eLearning Project based on Ontologies Matching and Recommendation System

“…This work presented a hybrid [53][54][55][56], innovative [57], reliable [58][59] and highly effective eLearning system that has the capacity to gather and analyze data from learning repositories and to adapt these to the educational curriculum according to the student skills and experience, based on sophisticated computational intelligence methods [60]. The AEeLS is a clearly innovative effort to effectively analyze and recommend relevant educational content based on semantic ontologies techniques.…”

Identifying data streams anomalies by evolving spiking restricted Boltzmann machines

“…This study has emerged after extensive and long-term research on stream analysis, and it performs actions on real-time data. This paper exploits and considers some of the most important suggestions and innovations of our prior research [27][28][29][30][31].…”

Research Trends, Challenges, and Emerging Topics in Digital Forensics: A Review of Reviews

“…In this regard, while the use of distributed platforms is not exempt from potential issues [239], they can also be potentially used to leverage community-based intelligence against threats and to leverage auditable forensic investigations [78], [245]- [247]. Following such an idea and in order to accelerate the response towards sophisticated threats and international campaigns, the community is devoting research efforts towards federated learning models [248], [249], and other emerging topics such as cognitive security [250], [251]. Data protection and ethics in criminal investigations.…”