A Resilience-Aware Intrusion Detection Framework: Quantifying Firewall Endurance Under Sustained Cyber Attacks using Machine Learning

Most of the existing intrusion detection systems are evaluated according to their ability to detect malicious activity with proper labeling. It is clear that such evaluation only tells whether the attack was detected or not. It gives no information about the defense resilience to the attack and the reaction time of the firewall. While the previous RF NRA approach tried to go beyond labeling by evaluating the risk level with the help of a random forest on NSL KDD dataset without any interaction with a real defense and staying offline. The current research is based on this idea but focuses more on the resilience measurement. The approach uses isolation forest to detect unusual traffic based on its learning from normal traffic and random forest to make a decision about the attack. Based on this decision, a severity level determines the type of response such as monitor, throttle, block or isolation. The firewall is implemented with the use of nftables to apply the rules which expire after some period of time and also include allowing list for rollback. Everything is logged with time stamp. The value of FRS is calculated every second on the basis of the log and it includes several measures including reaction time and service availability. Such measures as attack endurance time describe the time when the value is above some threshold while other measures evaluate the decline speed and recovery of the system. Evaluation will take place in a laboratory environment with five machines playing roles of hosts, IDS, firewall and attacker and re-played data. At least ten paired experiments are planned against default firewalls and signature-based systems. No results were produced at the moment, but they should be ready soon. It seems that such approach can tell more than just accuracy, although I am not completely sure about the exact correlation of measures.