Systems and methods for cyber intrusion detection and prevention
Systems and methods for detecting cyber attacks on a computer network are provided. The system trains attack and detection models. The attack model is used to synthesize network traffic for transmission to a detection model. The detection model is used to make a determination as to whether an attack is occurring. The results of the determination are used as training data for the attack and detection models.
1. A method of detecting cyber attacks in a computer network, the method comprising:
training an attack model using a first artificial neural network, said training said attack model being based on at least one of an attack database, previous network behavior, and previous network traffic patterns;
training a detection model using a second artificial neural network, said training said detection model being based on at least one of the previous network behavior and the previous network traffic patterns;
synthesizing, by an attack module, an attack vector based on the attack model;
transmitting the attack vector to a detection module;
determining, by the detection module, whether an attack is taking place;
updating at least one of the attack model and the detection model based on correctness of the determination made by the detection module; and
responsive to the determination of the detection module being correct, incrementing a detection model score.
2. The method of claim 1 , further comprising:
receiving network traffic at the detection module; and
outputting, by the detection module, an output vector based on the received network traffic.
3. The method of claim 2 , wherein the output vector indicates that an attack is taking place.
4. The method of claim 3 , wherein the output vector comprises an identity of a host executing an attack.
5. The method of claim 2 , wherein the output vector comprises a flag indicating the absence of an attack.
6. The method of claim 2 , further comprising:
receiving, at the detection module, application logs from at least one of an application running in the computer network and an application running in a distributed computing system.
7. The method of claim 1 , further comprising:
responsive to the determination of the detection module being incorrect, incrementing an attack model score.
8. The method of claim 7 , further comprising decrementing the detection model score.
9. The method of claim 1 , further comprising decrementing an attack model score.
10. A system for detecting cyber attacks on a computer network, the system comprising:
a processor;
a memory containing computer-readable instructions for execution by said processor, said instructions, when executed by said processor, causing the processor to:
train an attack model using a first artificial neural network, said training said attack model being based on at least one of an attack database, previous network behavior, and previous network traffic patterns;
train a detection model using a second artificial neural network, said training said detection model being based on at least one of the previous network behavior and the previous network traffic patterns;
synthesize, by an attack module, an attack vector based on the attack model;
transmit the attack vector to a detection module;
determine, by the detection module, whether an attack is taking place;
update at least one of the attack model and the detection model based on correctness of the determination made by the detection module; and
responsive to the determination of the detection module being correct, incrementing a detection model score.
11. The system of claim 10 , wherein the instructions further cause the processor to:
receive network traffic at the detection module; and
output, by the detection module, an output vector based on the received network traffic.
12. The system of claim 11 , wherein the output vector indicates that an attack is taking place.
13. The system of claim 12 , wherein the output vector comprises an identity of a host executing an attack.
14. The system of claim 11 , wherein the output vector comprises a flag indicating the absence of an attack.
15. The system of claim 11 , wherein the instructions further cause the processor to:
receive, at the detection module, application logs from at least one of an application running in the computer network and an application running in a distributed computing system.
16. The system of claim 10 , wherein the instructions further cause the processor to:
responsive to the determination of the detection module being incorrect, incrementing an attack model score.
17. The system of claim 16 , wherein the instructions further cause the processor to decrement the detection model score.
18. The system of claim 10 , wherein the instructions further cause the processor to decrement an attack model score.