Grant: Discovery Grants Program - Individual

In order to deal with the growing number and sophistication of attacks on Internet-based systems, cyber security researchers have increasingly been turning to the use of advanced analytics techniques, including the use of machine learning (ML). One common disadvantage of most research works on practical use of ML in cyber security is that they assume stationary processes and datasets. However, in modern-day cyber security systems - where regular operating conditions as well as the nature and/or manifestation of outside threats are subject to continuous change - traditional approaches to defence based on `stationary' methods (including `stationary' ML) are no longer appropriate. To attain and sustain a desired performance, modern ML-based cyber security systems need to operate within the framework of dynamic/adaptive decision making. They also need to be built on the concepts of cyber risk management in order to ensure the right balance between security, feasibility and usability - three objectives that are often conflicting with one other but ultimately equally important in all real-world cyber systems. The long-term goal of this program is to advance the state of the art in ML-based cyber security research. Specifically, the aim is to develop adaptive ML-based techniques capable of dealing with the inherent dynamicity of cyber security systems, and to do so within the context of cyber risk management, while also considering the possibility of deliberate adversarial attack/influence on the system's decision-making logic. The program will focus on two main application areas: security of Web systems and security of IoT systems. The specific problems addressed within the program will include: detection and mitigation of advanced (human-mimicking) bad bots in dynamic Web systems, detection and mitigation of rouge/misbehaving devices in IoT systems, and protection of user privacy in IoT systems. The program will provide state-of-the-art contributions to cyber security as well as applied machine learning research. The program is also of great practical significance due to its focus on the development of attack-resilient real-world cyber systems. Finally, the program will provide opportunity for training of HQP in both cyber security and machine learning - two areas that are identified as critically important for Canadian IT industry and its overall economy.