AI-Based Approach to Firewall Rule Refinement on High-Performance Computing Service Network
Source abstract
Abstract
High-performance computing (HPC) relies heavily on network security, particularly when supercomputing services are provided via public networks. As supercomputer operators, we introduced several security devices, such as anti-DDoS, intrusion prevention systems (IPSs), firewalls, and web application firewalls, to ensure the secure use of supercomputing resources. Potential threats are identified based on predefined security policies and added to the firewall rules for access control after detecting abnormal behavior through anti-DDoS, IPS, and system access logs. After analyzing the status change patterns for rule policies added owing to human errors among these added firewall log events, 289,320 data points were extracted over a period of four years. Security experts and operators must go through a strict verification process to rectify policies that were added incorrectly owing to human error, which adds to their workload. To address this challenge, our research applies various machine- and deep-learning algorithms to autonomously determine the normalcy of detection without requiring administrative intervention. Machine-learning algorithms, including naïve Bayes, K-nearest neighbor (KNN), OneR, a decision tree called J48, support vector machine (SVM), logistic regression, and the implemented neural network (NN) model with the cross-entropy loss function, were tested. The results indicate that the KNN and NN models exhibited an accuracy of 97%. Additional training and feature refinement led to even better improvements, increasing the accuracy to 98%, a 1% increase. By leveraging the capabilities of machine-learning and deep-learning technologies, we have provided the basis for a more robust, efficient, and autonomous network security infrastructure for supercomputing services.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software System Performance and Reliability · Network Security and Intrusion Detection · Network Packet Processing and Optimization
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
National Supercomputing Center, Korea Institute of Science and Technology Information, 245 Daehak-ro, Yuseong-gu, Daejeon 34141, Republic of Korea
Funding
Korea Institute of Science and Technology Information (KISTI)
References (37)
Show source-provided references
1. He, S., Zhu, J., He, P., and Lyu, M.R. (2016, January 23–27). Experience Report: System Log Analysis for Anomaly Detection. Proceedings of the 2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE), Ottawa, ON, Canada.10.1109/ISSRE.2016.21 ↗
2. Analysis of botnet attack communication pattern behavior on computer networks
3. A hierarchical security event correlation model for real-time threat detection and response10.3390/network4010004 ↗
4. Traffic and overhead analysis of applied pre-filtering ACL firewall on HPC service network10.23919/JCN.2021.000011 ↗
5. Classification of Firewall Logs Using Supervised Machine Learning Algorithms
6. The Analysis of Firewall Policy Through Machine Learning and Data Mining10.1007/s11277-017-4330-0 ↗
7. Discovering Anomalous Rules In Firewall Logs Using Data Mining And Machine Learning Classifiers
8. Ertam, F., and Kaya, M. (2018, January 22–25). Classification of firewall log files with multiclass support vector machine. Proceedings of the 2018 6th International Symposium on Digital Forensic and Security (ISDFS), Antalya, Turkey.10.1109/ISDFS.2018.8355382 ↗
9. Zhu, Q., He, Z., Zhang, T., and Cui, W. (2020). Improving Classification Performance of Softmax Loss Function Based on Scalable Batch-Normalization. Appl. Sci., 10.10.3390/app10082950 ↗
10. Network Attacks Detection Methods Based on Deep Learning Techniques: A Survey
11. Du, M., Li, F., Zheng, G., and Srikumar, V. (November, January 30). DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS ’17), Dallas, TX, USA.10.1145/3133956.3134015 ↗
12. Ali, M.N., Imran, M., Din, M.S.U., and Kim, B.S. (2023). Low rate DDoS detection using weighted federated learning in SDN control plane in IoT network. Appl. Sci., 13.10.3390/app13031431 ↗
13. Wu, C., and Chen, S. (2023, January 1–14). A heuristic intrusion detection approach using deep learning model. Proceedings of the 2023 International Conference on Information Networking (ICOIN), Bangkok, Thailand.10.1109/ICOIN56518.2023.10049024 ↗
14. A deep learning-based intrusion detection and preventation system for detecting and preventing Denial-of-Service attacks10.1109/ACCESS.2022.3196642 ↗
15. DDoS detection using deep learning10.1016/j.procs.2023.01.217 ↗
16. Saeed, A.M., Wang, D., Alnedhari, H.A., Mei, K., and Wang, J. (2021, January 1–3). A survey of machine learning and deep learning based dga detection techniques. Proceedings of the International Conference on Smart Computing and Communication, Kochi, India.10.1007/978-3-030-97774-0_12 ↗
17. Hassaoui, M., Hanini, M., and El Kafhali, S. (2022, January 22–27). A comparative study of neural networks algorithms in cyber-security to detect domain generation algorithms based on mixed classes of data. Proceedings of the International Conference on Advanced Intelligent Systems for Sustainable Development, Rabat, Morocco.10.1007/978-3-031-35251-5_23 ↗
18. Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms10.1109/ACCESS.2024.3359595 ↗
19. Analysis and evaluation of network and application security based on next generation firewall10.12785/ijcds/130116 ↗
20. Malicious domain detection based on semi-supervised learning and parameter optimization10.1049/cmu2.12739 ↗
21. Unsupervised malicious domain detection with less labeling effort10.1016/j.cose.2022.102662 ↗
22. Ghadermazi, J., Shah, A., and Jajodia, S. (Digit. Threat. Res. Pract., 2024). A Machine Learning and Optimization Framework for Efficient Alert Management in a Cybersecurity Operations Center, Digit. Threat. Res. Pract., just accepted.10.1145/3644393 ↗
23. A novel two-stage deep learning model for network intrusion detection: LSTM-AE10.1109/ACCESS.2023.3266979 ↗
24. A performance overview of machine learning-based defense strategies for advanced persistent threats in industrial control systems10.1016/j.cose.2023.103445 ↗
25. Deep residual convolutional neural network: An efficient technique for intrusion detection system10.1016/j.eswa.2023.121912 ↗
26. A hierarchical intrusion detection model combining multiple deep learning models with attention mechanism10.1109/ACCESS.2023.3290613 ↗
27. Dependable intrusion detection system using deep convolutional neural network: A novel framework and performance evaluation approach10.1016/j.teler.2023.100077 ↗
28. A gradient-based approach for adversarial attack on deep learning-based network intrusion detection systems10.1016/j.asoc.2023.110173 ↗
29. Dawadi, B.R., Adhikari, B., and Srivastava, D.K. (2023). Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks. Sensors, 23.10.3390/s23042073 ↗
30. Saleous, H., and Trabelsi, Z. (2019, January 24–28). Enhancing Firewall Filter Performance Using Neural Networks. Proceedings of the 2019 15th International Wireless Communications & Mobile Computing Conference (IWCMC), Tangier, Morocco.10.1109/IWCMC.2019.8766576 ↗
31. Pinto, A., Herrera, L.-C., Donoso, Y., and Gutierrez, J.A. (2023). Survey on intrusion detection systems based on machine learning techniques for the protection of critical infrastructure. Sensors, 23.10.3390/s23052415 ↗
32. Beverly, R., and Sollins, K. (2018, January 13–15). An internet protocol address clustering algorithm. Proceedings of the Third Conference on Tackling Computer Systems Problems with Machine Learning Techniques (SysML’08), San Diego, CA, USA.
33. On detecting and classifying dga botnets and their families10.1016/j.cose.2021.102549 ↗
34. Economics of ransomware: Risk interdependence and large-scale attacks10.1287/mnsc.2022.4300 ↗
35. An empirical study of the naive Bayes classifier
36. Logistic regression in data analysis: An overview10.1504/IJDATS.2011.041335 ↗
37. Agarwala, A., Pennington, J., Dauphin, Y., and Schoenholz, S. (2020). Temperature check: Theory and practice for training models with softmax-cross-entropy losses. arXiv.