用机器学习实现网络攻击的实时自动阻断，21秒完成从发现到封禁。
Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning
- 构建闭环系统，自动采集数据并训练分类器。
- 在SYN洪水攻击中实现96.7%的F1分数，21秒内完成封禁。
- 适合需要极速响应的安全系统，如SDN环境防御。
自主响应已从单纯的检测精度问题演变为时间敏感的挑战。近期入侵事件显示，初始访问到首次横向移动的间隔最短仅27秒，这一时间窗口远低于人工干预的可行性。本文提出一个无需人工介入的闭环框架，在软件定义网络中实现攻击的实时检测与阻断，并以该严格时序要求为评估标准，而非仅依赖检测准确率。系统通过自动化数据管道收集IP流量并聚合为带标签训练数据；预防模块选择并训练候选分类器，直接向SDN控制器下发阻断规则。在一次针对SYN洪水拒绝服务攻击的案例研究中，部署的K-近邻分类器取得96.7%的F1分数，从流量可用到规则生效的周期仅需21秒，优于目前已知最快突破时间。
原文摘要 · Abstract (English)
Autonomous response has evolved into a timing-critical challenge rather than solely a matter of detection accuracy. In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds, a window that precludes any human-in-the-loop workflow. This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement, evaluating its performance against this stringent temporal constraint rather than relying exclusively on detection accuracy. An automated data pipeline collects IP flows and aggregates them into labeled training data, while a prevention module selects and trains candidate classifiers and issues blocking rules directly to the SDN controller. In a SYN flooding denial of service case study, the deployed K-Nearest Neighbors classifier achieved an F1 score of 96.7% and the cycle from flow availability to enforced block completed in 21 seconds, below the fastest breakout time reported to date.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。