Visible to the public Fuzzy Logic Aided Intelligent Threat Detection in Cisco Adaptive Security Appliance 5500 Series Firewalls

TitleFuzzy Logic Aided Intelligent Threat Detection in Cisco Adaptive Security Appliance 5500 Series Firewalls
Publication TypeConference Paper
Year of Publication2018
AuthorsNaik, N., Jenkins, P., Kerby, B., Sloane, J., Yang, L.
Conference Name2018 IEEE International Conference on Fuzzy Systems (FUZZ-IEEE)
ISBN Number978-1-5090-6020-7
Keywordsadvanced threat detection, analysing packet drop statistics, Cisco adaptive security appliance 5500 series firewall, complete basic threat detection, comprehensible solution, Computer crime, customised feature based threat detection, feature extraction, firewalls, Firewalls (computing), Fuzzy logic, fuzzy reasoning, fuzzy reasoning system, intelligent threat detection solution, Metrics, Monitoring, network traffic, organisational aspects, organisational networks, organisational security, prioritised security events, pubcrawl, resilience, Resiliency, security, security status, significant information, software version, statistical information, third-party tool, threat detection function, threat detection process, threat detection statistics, Tools, traffic patterns, user interfaces, valuable features

Cisco Adaptive Security Appliance (ASA) 5500 Series Firewall is amongst the most popular and technically advanced for securing organisational networks and systems. One of its most valuable features is its threat detection function which is available on every version of the firewall running a software version of 8.0(2) or higher. Threat detection operates at layers 3 and 4 to determine a baseline for network traffic, analysing packet drop statistics and generating threat reports based on traffic patterns. Despite producing a large volume of statistical information relating to several security events, further effort is required to mine and visually report more significant information and conclude the security status of the network. There are several commercial off-the-shelf tools available to undertake this task, however, they are expensive and may require a cloud subscription. Furthermore, if the information transmitted over the network is sensitive or requires confidentiality, the involvement of a third party or a third-party tool may place organisational security at risk. Therefore, this paper presents a fuzzy logic aided intelligent threat detection solution, which is a cost-free, intuitive and comprehensible solution, enhancing and simplifying the threat detection process for all. In particular, it employs a fuzzy reasoning system based on the threat detection statistics, and presents results/threats through a developed dashboard user interface, for ease of understanding for administrators and users. The paper further demonstrates the successful utilisation of a fuzzy reasoning system for selected and prioritised security events in basic threat detection, although it can be extended to encompass more complex situations, such as complete basic threat detection, advanced threat detection, scanning threat detection, and customised feature based threat detection.

Citation Keynaik_fuzzy_2018