GRAPH4: A Security Monitoring Architecture Based on Data Plane Anomaly Detection Metrics Calculated over Attack Graphs

Giacomo Gori, Lorenzo Rinieri, Amir Al Sadi, Andrea Melis, Franco Callegati and Marco Prandini ()
Additional contact information
Giacomo Gori: Department of Computer Science and Engineering (DISI), Alma Mater Studiorum— Università di Bologna, 40136 Bologna, Italy
Lorenzo Rinieri: Department of Computer Science and Engineering (DISI), Alma Mater Studiorum— Università di Bologna, 40136 Bologna, Italy
Amir Al Sadi: Department of Computer Science and Engineering (DISI), Alma Mater Studiorum— Università di Bologna, 40136 Bologna, Italy
Andrea Melis: Department of Computer Science and Engineering (DISI), Alma Mater Studiorum— Università di Bologna, 40136 Bologna, Italy
Franco Callegati: Department of Computer Science and Engineering (DISI), Alma Mater Studiorum— Università di Bologna, 40136 Bologna, Italy
Marco Prandini: Department of Computer Science and Engineering (DISI), Alma Mater Studiorum— Università di Bologna, 40136 Bologna, Italy

Future Internet, 2023, vol. 15, issue 11, 1-19

Abstract: The correct and efficient measurement of security properties is key to the deployment of effective cyberspace protection strategies. In this work, we propose GRAPH4, which is a system that combines different security metrics to design an attack detection approach that leverages the advantages of modern network architectures. GRAPH4 makes use of attack graphs that are generated by the control plane to extract a view of the network components requiring monitoring, which is based on the specific attack that must be detected and on the knowledge of the complete network layout. It enables an efficient distribution of security metrics tasks between the control plane and the data plane. The attack graph is translated into network rules that are subsequently installed in programmable nodes in order to enable alerting and detecting network anomalies at a line rate. By leveraging data plane programmability and security metric scores, GRAPH4 enables timely responses to unforeseen conditions while optimizing resource allocation and enhancing proactive defense. This paper details the architecture of GRAPH4, and it provides an evaluation of the performance gains it can achieve.

Keywords: P4; attack graphs; anomaly detection; security metrics; entropy (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2023
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/15/11/368/pdf (application/pdf)
https://www.mdpi.com/1999-5903/15/11/368/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:15:y:2023:i:11:p:368-:d:1280506

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().