A Machine Learning-Driven Threat Hunting Architecture for Protecting Critical Infrastructures

The number and the diversity in nature of daily cyber-attacks increased last few years, and trends are that both will grow exponentially in the near future, therefore, Critical Infrastructures’ Security Departments must have their own IT specialists to prevent and respond to cyber-attacks. To introduce more challenges in the existing cyber security landscape, many attacks are unknown until their spawn, even a long time after their initial actions, posing increasing difficulties on their detection and remediation. To be reactive against those cyber-attacks, usually defined as zero-day attacks, organizations must have Threat Hunters at their security departments that must be aware of unusual behaviors and Modus Operandi. Threat Hunters must face vast amounts of data (mainly benign and repetitive, and following predictable patterns) in short periods to detect any anomaly, with the associated cognitive overwhelm. The application of Artificial Intelligence, specifically Machine Learning (ML) techniques, can remarkably impact the real-time analysis of those data and can help to discriminate between harm-less data and malicious data, alleviating analysts from the above-mentioned overload and providing means to enhance their Cyber Situational Awareness (CSA). This work aims to design a system architecture that helps Threat Hunters using a Machine Learning approach for protecting all kind of Critical Infrastructures based on a distributed, scalable and online configurable framework of interconnected modular components.