Re: [Nmlrg] Machine Learning in network

On 06/09/2015 21:01, Sheng Jiang wrote:
>> Some more detailed introduction.
>>
>> DDoS and APT are very active research topics. Application layer DDoS
>> attacks are more difficult to detect than layer 4 DDoS attacks. In many
>> cases, the application layer DDoS does not introduce large amount
>> traffics. However, by using big data and data mining tech, it is possible
>> to find out the clues of such attacks.
> 
> Hi, Dacheng,
> 
> Applying machine learning in DDoS protection is an interest use case. For my understanding, the machine would learn the potential attack behaviors, am I right?
> 
> If yes, I have two questions: a) does the machine learning has the possibility to learn/identify new attack behaviors, which was not recognized before? If yes, what is the working principles? b) is it possible for autonomic reaction from the network operational perspective after detect such DDoS attack? Give the machine learning may not be accurate, my guess is human intervention is needed.

I suppose this is in some ways similar to spam processing in email. For example,
a Bayesian spam filter is surprisingly good, but sometimes makes mistakes, so human
training to correct false positives and false negatives is essential. How can
human training be achieved for a real-time case like DDOS?

   Brian

> 
> Best regards,
> 
> Sheng
> 
>> There were some related discussions in Dots. If you are interested, I
>> could find them out later.
>>
>> _______________________________________________
>> nmlrg mailing list
>> nmlrg@irtf.org
>> https://www.irtf.org/mailman/listinfo/nmlrg
> _______________________________________________
> nmlrg mailing list
> nmlrg@irtf.org
> https://www.irtf.org/mailman/listinfo/nmlrg
> 

Re: [Nmlrg] Machine Learning in network - solicitation for use cases