Advanced threat hunting over software-defined networks in smart cities

The emergence of Software-Defined Networking (SDN) has brought along a wave of new technologies and developments in the field of networking with hopes of dealing with network resources more efficiently and providing a foundation of programmability. SDN allows for both flexibility and adaptability by separating the control and data planes in a network environment by virtualizing network hardware. Threat hunting is a technique that allows for the detection of advanced network threats through forensic analysis. We present an advanced threat hunting model by combining the SDN infrastructure with threat hunting techniques and machine learning models aiming to intelligently handle advanced network threats such as lateral movement. We found that our approach outperforms current threat hunting models in vital areas such as the detection to mitigation time. Our results show that we are able to detect advanced threats with 93.4% accuracy and begin mitigation within 10 seconds of detection.

Grantor dc:publisher

University of Tennessee at Chattanooga

Author dc:creator

• Schmitt, Steven

Contributors dc:contributor

• Kandah, Farah
• Yang, Li; Skjellum, Anthony
• College of Engineering and Computer Science

• Software-defined networking (Computer network technology)
• Computational intelligence
• Computer networks -- Security measures

Licence

• https://rightsstatements.org/page/InC/1.0/?language=en

Language dc:language

English, eng

Repository record dc:identifier

https://scholar.utc.edu/theses/576

OAI identifier oai:identifier

oai:scholar.utc.edu:theses-1732