Adding ML to the mix
Once you get past the traditional defenses, you can use ML to implement Network Traffic Analytics (NTA) as part of an IDS, as shown in Figure 5.2. Most ML strategies are based on some sort of anomaly detection. For example, it’s popular to use convolutional auto-encoders for network intrusion detection. A few early products still in the research stage, such as nPrintML, discussed in New Directions in Automated Traffic Analysis at https://pschmitt.net/, have also made an appearance. Here are just a few of the ways in which you can use ML to augment traditional security layers:
- Perform regression analysis to determine whether certain packets are somehow flawed compared to normal packets from a given source. In other words, you’re not dealing with absolutes but, rather, determining what is normal from a particular sender. Anything outside the normal pattern is suspect.
- Rely on classification to detect whether incoming data matches particular...
