Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning

• URL: http://arxiv.org/abs/2608.22075v3
• Date: Wed, 26 Aug 2026 16:58:18 GMT
• Title: Autonomous Cyber Defense: Real-Time Attack Detection and Mitigation in Software-Defined Networks Using Machine Learning
• Abstract summary: In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds.<n>This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement.
• Score: 78.29352305480285
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Autonomous response has evolved into a timing-critical challenge rather than solely a matter of detection accuracy. In recent intrusions, the interval between initial access and the first lateral movement has been observed to be as short as 27 seconds, a window that precludes any human-in-the-loop workflow. This paper presents a closed-loop framework that detects and blocks attacks in software-defined networks without operator involvement, evaluating its performance against this stringent temporal constraint rather than relying exclusively on detection accuracy. An automated data pipeline collects IP flows and aggregates them into labeled training data, while a prevention module selects and trains candidate classifiers and issues blocking rules directly to the SDN controller. In a SYN flooding denial of service case study, the deployed K-Nearest Neighbors classifier achieved an F1 score of 96.7% and the cycle from flow availability to enforced block completed in 21 seconds, below the fastest breakout time reported to date.

Related papers

• A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs [0.0]
  This paper presents a Network Intrusion Detection System (NIDS) for DDoS detection in transport networks, developed in collaboration with Ericsson.<n>Building on a statistical baseline, we improve detection effectiveness with an Isolation Forest trained on a wider set of flow features.<n>We also compare three deployments, monolithic, Kafka-based, and gRPC-based, on a Raspberry Pi 5 testbed replaying the CICDDoS 2019 dataset.
  arXiv  Detail & Related papers  (2026-09-11T09:00:33Z)
• ANTMAN: An Efficient and Interpretable RTL-Level Run-Time Detection Framework for Stealthy Branch Predictor Attacks on BOOM [1.6013674661312771]
  microarchitectural side channel attacks remain underexplored in RISCV compared with x86 and ARM ISAs.<n>We propose the first secure-by-design, highly interpretable, non-intrusive, RTL-level runtime detection solution for stealthy branch predictor attacks on BOOM RISC-V.
  arXiv  Detail & Related papers  (2026-08-10T12:03:09Z)
• FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems [0.0]
  FlowGuard is an identity-independent defence based on flow matching that classifies incoming queries as out-of-distribution (OOD)<n>This approach exploits the fact that queries generated synthetically for data-free model stealing attacks occupy a lower-dimensional manifold than real network traffic.<n>We evaluate our method against PRADA and FDINet using MAZE and DisGUIDE attacks in single-client and distributed (100-client Sybil) settings.
  arXiv  Detail & Related papers  (2026-06-02T10:18:45Z)
• Federated Stream-Processing and Latency-Gated Response for Cross-Sector Threat Detection and Collaborative Containment [0.0]
  Critical infrastructure defense is bottlenecked by the operational reality that preventive controls are frequently bypassed by sophisticated supply-chain compromises and stolen administrative credentials.<n>We present a novel, high- throughput stream-processing and correlation framework designed to detect coordinated cross-sector threat campaigns and orchestrate containment at machine speed.
  arXiv  Detail & Related papers  (2026-05-17T08:32:08Z)
• QUACK! Making the (Rubber) Ducky Talk: A Systematic Study of Keystroke Dynamics for HID Injection Detection [60.105690843777666]
  We show that robust, privacy-preserving detection is achievable using lightweight models operating solely on timing features.<n>Our analysis reveals that attacker sophistication does not monotonically translate into improved evasion.
  arXiv  Detail & Related papers  (2026-04-17T08:53:24Z)
• Robust Semi-Supervised Temporal Intrusion Detection for Adversarial Cloud Networks [4.040477308370048]
  This paper proposes a robust semi-supervised temporal learning framework for cloud intrusion detection.<n>It exploits unlabeled traffic while suppressing unreliable samples.<n>It consistently outperforms state-of-the-art supervised and semi-supervised network intrusion detection systems.
  arXiv  Detail & Related papers  (2026-04-14T12:23:52Z)
• Rethinking Latency Denial-of-Service: Attacking the LLM Serving Framework, Not the Model [12.046157489400457]
  Large Language Models face an emerging and critical threat known as latency attacks.<n>Because inference is inherently expensive, even modest slowdowns can translate into substantial operating costs and severe availability risks.<n>We introduce a new Fill and Squeeze attack strategy targeting the state transition of the scheduler.
  arXiv  Detail & Related papers  (2026-02-08T09:05:54Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Federated Learning for Zero-Day Attack Detection in 5G and Beyond V2X Networks [9.86830550255822]
  Connected and Automated Vehicles (CAVs) on top of 5G and Beyond networks (5GB) make them vulnerable to increasing vectors of security and privacy attacks. We propose in this paper a novel detection mechanism that leverages the ability of the deep auto-encoder method to detect attacks relying only on the benign network traffic pattern. Using federated learning, the proposed intrusion detection system can be trained with large and diverse benign network traffic, while preserving the CAVs privacy, and minimizing the communication overhead.
  arXiv  Detail & Related papers  (2024-07-03T12:42:31Z)
• ROSpace: Intrusion Detection Dataset for a ROS2-Based Cyber-Physical System [2.1749194587826026]
  We present a dataset for intrusion detection by performing penetration testing on an embedded cyber-physical system built over Robot Operating System 2 (ROS2) The dataset is structured as a time series and describes the expected behavior of the system and its response to ROS2-specific attacks.
  arXiv  Detail & Related papers  (2024-02-13T13:54:47Z)
• The Adversarial Implications of Variable-Time Inference [47.44631666803983]
  We present an approach that exploits a novel side channel in which the adversary simply measures the execution time of the algorithm used to post-process the predictions of the ML model under attack. We investigate leakage from the non-maximum suppression (NMS) algorithm, which plays a crucial role in the operation of object detectors. We demonstrate attacks against the YOLOv3 detector, leveraging the timing leakage to successfully evade object detection using adversarial examples, and perform dataset inference.
  arXiv  Detail & Related papers  (2023-09-05T11:53:17Z)
• Label-Efficient Object Detection via Region Proposal Network Pre-Training [58.50615557874024]
  We propose a simple pretext task that provides an effective pre-training for the region proposal network (RPN) In comparison with multi-stage detectors without RPN pre-training, our approach is able to consistently improve downstream task performance.
  arXiv  Detail & Related papers  (2022-11-16T16:28:18Z)
• Early Detection of Network Attacks Using Deep Learning [0.0]
  A network intrusion detection system (IDS) is a tool used for identifying unauthorized and malicious behavior by observing the network traffic. We propose an end-to-end early intrusion detection system to prevent network attacks before they could cause any more damage to the system under attack.
  arXiv  Detail & Related papers  (2022-01-27T16:35:37Z)
• DAAIN: Detection of Anomalous and Adversarial Input using Normalizing Flows [52.31831255787147]
  We introduce a novel technique, DAAIN, to detect out-of-distribution (OOD) inputs and adversarial attacks (AA) Our approach monitors the inner workings of a neural network and learns a density estimator of the activation distribution. Our model can be trained on a single GPU making it compute efficient and deployable without requiring specialized accelerators.
  arXiv  Detail & Related papers  (2021-05-30T22:07:13Z)
• TANTRA: Timing-Based Adversarial Network Traffic Reshaping Attack [46.79557381882643]
  We present TANTRA, a novel end-to-end Timing-based Adversarial Network Traffic Reshaping Attack. Our evasion attack utilizes a long short-term memory (LSTM) deep neural network (DNN) which is trained to learn the time differences between the target network's benign packets. TANTRA achieves an average success rate of 99.99% in network intrusion detection system evasion.
  arXiv  Detail & Related papers  (2021-03-10T19:03:38Z)
• Fast Motion Understanding with Spatiotemporal Neural Networks and Dynamic Vision Sensors [99.94079901071163]
  This paper presents a Dynamic Vision Sensor (DVS) based system for reasoning about high speed motion. We consider the case of a robot at rest reacting to a small, fast approaching object at speeds higher than 15m/s. We highlight the results of our system to a toy dart moving at 23.4m/s with a 24.73deg error in $theta$, 18.4mm average discretized radius prediction error, and 25.03% median time to collision prediction error.
  arXiv  Detail & Related papers  (2020-11-18T17:55:07Z)
• Defending Water Treatment Networks: Exploiting Spatio-temporal Effects for Cyber Attack Detection [46.67179436529369]
  Water Treatment Networks (WTNs) are critical infrastructures for local communities and public health, WTNs are vulnerable to cyber attacks. We propose a structured anomaly detection framework to defend WTNs by modeling thetemporal characteristics of cyber attacks in WTNs.
  arXiv  Detail & Related papers  (2020-08-26T15:56:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.