Grant: Discovery Grants Program - Individual

Nowadays, cybercriminals are increasingly sophisticated, ingenious and highly collaborative. To tackle pervasive modern cyber threats, the latest research has focused on improving security mechanisms using machine learning (ML) techniques. In this context, ML-based Network Intrusion Detection System (NIDS) constitute the frontline defense against network attacks that threaten the security of data and networks. Because of their wide deployment, NIDS are continuously targeted by stealthy intelligent attacks. Through the use of adversarial techniques, attackers are able to deceive and evade the NIDS defense strategy. In fact, they slightly modify their attacks attributes so that they are no longer classified as malicious by the detection model. In addition, due to the inherent dynamic nature of modern network environments, the efficiency of the network intrusion detection degrades significantly when facing new attack patterns (such as: zero-day attacks). This is caused by the critical problem of traffic concept drift. Indeed, malicious network activities are often polymorphic and constantly evolving as attackers adapt to defenses to render them obsolete. Thus, by inheriting ML vulnerabilities, NIDS may provide more opportunities to attackers, by expanding the attack surface of the network they are meant to protect. Consequently, there is an urgent need to strengthen ML-based network intrusion detection mechanisms against modern intelligent attacks. For this purpose, this research program aims to develop and validate novel proactive network intrusion detection mechanisms that are robust, adaptive, and collaborative. The targeted security mechanisms will be able to effectively and efficiently resist adversarial attacks by prioritizing feasible and focusing on more likely cyberattacks. In addition, new context-awareness and adaptation capabilities will be proposed to better guide models training tasks and models tuning for NIDS. Moreover, efficient NIDS will be developed based on distributed learning and detection model transferability between various security service providers and security nodes. This research program will provide novel approaches that will enhance the robustness and the resilience of cybersecurity enforcement and speed up the deployment of security mechanisms. Consequently, it will allow a better protection of IT (Information Technology) infrastructure and personal devices while reducing response time to cyberattacks. Moreover, these defense countermeasures will avoid huge economic losses by drastically mitigating service interruptions and breakdowns. It will support the Canadian ICT industry (Information and Communication Technology), help Canada maintain its leadership in cybersecurity and support the training of highly qualified personnel in this area.