用微分段+深度学习提升零信任网络的异常检测能力
Micro-Segmentation Anomaly Detection in Zero-Trust Software-Defined Network Fabrics
- 将网络流量细分为微段，输入ViT和1D-CNN模型进行分析
- 微分段数据使F1分数达0.95，优于原始数据的0.90
- ViT更擅长识别隐蔽的横向移动行为，适合安全研究者
零信任架构需严格网络分段与持续验证以降低隐式信任和横向威胁传播。本文通过软件定义网络（SDN）中的微分段技术，利用深度学习模型检测传统粗粒度监控无法发现的恶意行为。构建了视觉变压器（ViT）和一维卷积神经网络（1D-CNN）两种模型，对原始及微分段后的网络流数据进行处理。在模拟零信任SDN数据集上的实验表明，微分段显著提升检测准确率：基于分段输入的模型达到F1分数0.95，高于使用原始数据的0.90。其中ViT模型表现略优，尤其在识别未被原始数据捕捉到的细微横向移动模式方面更具优势。结果强调了在零信任网络中集成微分段对增强入侵检测效果的重要性。未来工作将扩展至真实世界大规模网络数据集，并引入动态在线分段技术。
原文摘要 · Abstract (English)
Zero Trust Architecture (ZTA) principles need rigorous network segmentation and ongoing verification to reduce implicit trust and lateral threat propagation. This paper investigates anomaly detection in software-defined networking (SDN) systems by micro-segmentation, using deep learning models to detect harmful actions that evade traditional coarse-grained monitoring. Two models are developed: a Vision Transformer (ViT) and a 1D Convolutional Neural Network (1D-CNN), which are used to both raw and micro-segmented network flow data. Experimental findings from a simulated zero-trust SDN dataset indicate that micro-segmentation substantially improves detection accuracy. The models trained on segmented input demonstrate enhanced accuracy and F1-scores (F1 = 0.95) compared to those utilizing unsegmented raw data (F1 = 0.90). The ViT-based detector marginally surpasses the 1D-CNN, particularly in recognizing nuanced lateral movement patterns that are unnoticed in unprocessed data. These findings highlight the significance of including micro-segmentation inside zero-trust networks to enhance intrusion detection efficacy. Future efforts will broaden this methodology to include extensive real-world network datasets and dynamic online segmentation techniques.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。