Applications of Machine Learning to Causal Networks for Generating Attacks on Networked Systems

Abstract

The advent of the Internet-of-Things (IoT) and next-generation networking has led to the development of networked systems that are increasingly interconnected, complex, and vulnerable. Many of these systems, including the in-vehicle network (IVN) of the connected vehicle, were designed for closed networks, and are inherently vulnerable in this new environment. Others, including software defined network (SDN) technologies, are still in their nascent phases, but will soon be widely deployed with the expansion of 5G. These new networked systems provide attackers a large attack surface, which conventional security methods cannot easily detect and mitigate. This thesis explores the application of a causal network and machine learning (ML) based methodology, which preemptively generates attacks in order to mitigate vulnerabilities in networked systems. This methodology extracts intelligence from known attacks, represents them as causal networks, and employs ML techniques to extrapolate new attack vectors and vulnerabilities within the system. We demonstrate the feasibility of this approach by applying it to the controller area network (CAN) protocol of the IVN, as well as applying a modified approach to the OpenFlow protocol of the SDN. Within the IVN, the methodology achieves an 87.22% reduction in the search space and generates six attacks that are novel to the ML model. We generate an additional seven attacks in the SDN. We then demonstrate the respective attacks on an emulated CAN bus and emulated OpenFlow-enabled SDN.