Re: [Nmlrg] Machine Learning in network - solicitation for use cases

[Sheng Jiang <[e-mail]>]

>>>DDoS and APT are very active research topics. Application layer DDoS
>>>attacks are more difficult to detect than layer 4 DDoS attacks. In many
>>>cases, the application layer DDoS does not introduce large amount
>>>traffics. However, by using big data and data mining tech, it is possible
>>>to find out the clues of such attacks.
>>
>>Hi, Dacheng,
>>
>>Applying machine learning in DDoS protection is an interest use case. For
>>my understanding, the machine would learn the potential attack behaviors,
>>am I right?
>
>Yes， you are right.
>>
>>If yes, I have two questions: a) does the machine learning has the
>>possibility to learn/identify new attack behaviors, which was not
>>recognized before? If yes, what is the working principles?
>
>Normally we need to generate a normal behavior model and some
>“abnormal
>behavior models”, the machine will detect whether certain behavior of a
>client will be located in an ‘abnormal’ area.
>I need to check with my colleagues to see whether we could disclose more
>detailed information for the moment.

This would be an interesting use case. Looking forward to see more information. For now, I guess we do not need much details in algorithms or specific implementation. It would be interested to learn, in general, the objects of learning, and the expected output of the learning in the DDoS protection use case.

>> b) is it possible for autonomic reaction from the network operational
>>perspective after detect such DDoS attack? Give the machine learning may
>>not be accurate, my guess is human intervention is needed.
>
>In the current practice, machine learning procedure is normally offline.
>1) machine learning may not very that accurate. 2) big data processing
>needs time and computing resources.  Human involvement is required.

What may influence the accuracy of the mechanism learning result? In another word, how to improve the accuracy in machine learning mechanism? This question may not be DDoS protection specific.

Best regards,

Sheng

>Looking for future discussion on this topic.
>
>Cheers
>
>Dacheng
>
>>
>>Best regards,
>>
>>Sheng
>>
>>>There were some related discussions in Dots. If you are interested, I
>>>could find them out later.
>>>
>>>_______________________________________________
>>>nmlrg mailing list
>>>[e-mail]
>>>https://www.irtf.org/mailman/listinfo/nmlrg
>