Application of distributed computing and machine learning technologies to cybersecurity

Abstract

SHIELD is a distributed cyber-security system that leverages Network Function Virtualisation for dynamically deploying virtual Network Security Functions. The security functions send network traffic’s monitoring data to a bigdata store. The Data Analysis and Remediation Engine executes security analytics modules on top of monitoring data modules in order to detect threats. The security analytics heavily leverage Machine Learning algorithms for detecting anomalies and classifying threats. This paper presents the different Machine Learning algorithms and details the obtained results and the direction taken by the project with regards to its implementation, including business capabilities for the cybersecurity solution.