Abstract:In an increasingly digitalized world, cybersecurity has emerged as a critical component of safeguarding sensitive information and infrastructure from malicious threats. The threat actors are often in line or even one step ahead of the defense, causing the increasing reliance of security teams on artificial intelligence while trying to detect zero-day attacks. However, most of the cybersecurity solutions based on artificial intelligence that can be found in the literature are trained and tested on reference datasets that are at least five or more years old, which gives a vague insight into their security performances. Moreover, they often tend to be designed as isolated, self-focused components. The aim of this paper is to design and implement a modular network intrusion detection architecture capable of simulating cyberattacks based on real-world scenarios while evaluating its defense capabilities. The architecture is designed as a full pipeline from real-time network data collection and transformation to threat-information presentation and visualization, with a pre-trained artificial intelligence module at its core. Well-known components like CICFlowMeter, Prometheus, and Grafana are used and modified to fit our data preparation and core modules to form the proposed architecture for real-world network traffic security monitoring. For the sake of cyberattack simulation, the proposed architecture is situated within a virtual environment, surrounded by the Kali Linux-based penetration simulation agent on one side and a vulnerable agent on the other. The intrusion detection artificial intelligence module is trained on the CICIDS-2017 dataset, and it is demonstrated using the proposed architecture that, despite being trained on an outdated dataset, the trained module is still effective in detecting sophisticated modern attacks. Two case studies are given to illustrate how modular architectures and virtual environments can be valuable tools to assess the security properties of artificial intelligence-based solutions through simulation in real-world scenarios.

Network Simulation with Complex Cyber-attack Scenarios

Simulation of Computer Network Attacks

Modular deep learning-based network intrusion detection architecture for real-world cyber-attack simulation

Modeling Realistic Adversarial Attacks against Network Intrusion Detection Systems

Network Attack-Defense Simulation Training System Based on HLA

Ensemble Machine Learning Techniques for Attack Prediction in NIDS Environment

Towards a Machine Learning Based Situational Awareness Framework for Cybersecurity: An SDN Implementation

Network Security Modeling and Cyber Attack Simulation Methodology

Designing a Network Intrusion Detection System Based on Machine Learning for Software Defined Networks

ML‐IDSDN: Machine learning based intrusion detection system for software‐defined network

ICSrange: A Simulation-based Cyber Range Platform for Industrial Control Systems

Intrusion detection systems for software-defined networks: a comprehensive study on machine learning-based techniques

A Novel Deep Learning based Model to Defend Network Intrusion Detection System against Adversarial Attacks

Simulating Malicious Attacks on VANETs for Connected and Autonomous Vehicle Cybersecurity: A Machine Learning Dataset

Wormhole attack detection and mitigation model for Internet of Things and WSN using machine learning

Evaluating Deception and Moving Target Defense with Network Attack Simulation

Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things

Untargeted White-box Adversarial Attack with Heuristic Defence Methods in Real-time Deep Learning based Network Intrusion Detection System

A Hypergraph-Based Machine Learning Ensemble Network Intrusion Detection System

Adversarial Challenges in Network Intrusion Detection Systems: Research Insights and Future Prospects