An architecture for anomaly detection in large complex critical infrastructures

摘要

Deregulation, cyber-terrorism, and increased interdependency are making large complex critical infrastructures, such as the telecommunications and electricity networks, increasingly vulnerable. Solutions are needed that can provide a rapid automatic response to the known and unknown dangers that threaten them today. This paper outlines the work that is being done at Queen Mary, University of London on the design of an agent-based anomaly detection and repair system that will address this problem. This will build up a model of normality for the telecommunications management network, interact with existing protection mechanisms, diagnose problems and carry out self-healing. The layered safeguards that will be offered by this system will substantially increase the survivability of large complex critical infrastructures in the face of attacks, failures and accidents caused by insiders and outsiders.