idps-escape

IDPS-ESCAPE user manual

IDPS-ESCAPE is aimed at closely capturing the notion of MAPE-K (Monitor, Analyze, Plan, Execute and Knowledge) from autonomic computing applied to cybersecurity, which translates into providing a comprehensive package that implements a Security Orchestration, Automation, and Response (SOAR) system.

This resulting SOAR system combines following building blocks: a Security Information and Event Management (SIEM) system, an Intrusion Detection and Prevention System (IDPS), Cyber Threat Intelligence (CTI) tools, a Risk-aware AD-based Active Response (RADAR) subsystem providing AD scenario implementations, coupled with active response solutions and SOAR playbooks facilitating security orchestration, and an anomaly detection (AD) subsystem, called ADBox.

We adopt a hybrid method aimed at robustness and resilience to adversarial interference involving three elements: (i) signature-based detection with (ii) AD based on deep learning models via MTAD-GAT, relying on state-of-the-art advances in artificial intelligence (AI) and machine learning (ML) such as the attention mechanism and (iii) a classical algorithm for AD on streams such as the Robust Random Cut Forest (RRCF) algorithm supporting categorical features.

RADAR and ADBox

The RADAR subsystem provides solutions for completing the SOAR mission of IDPS-ESCAPE enabling security orchestration and automation driven by a Risk-informed AD-based active response (AR) paradigm.

The two major missions of ADBox are to:

1. perform core time-series anomaly detection operations via ML;
2. manage the data flow from the indexer to the core machine learning algorithm, and back to the SIEM.

Map of content

• RADAR
  • Automated manager deployment via Ansible playbook
  • Automated agent deployment via Ansible playbook (soon…)
• ADBox
  • Installation
  • Setup and prerequisites
  • Quick start
  • Use case definition guide
  • Anomaly detection engine
  • MTAD-GAT
  • Detector
  • Front-end
  • Data transformation
  • Run modes
  • Wazuh ADBox integration
  • Example
  • Detector dashboard tutorial
  • Data cleaning
• Joint deployment of IDPS, SIEM and OpenSearch AD
• Integrations
• Glossary

SIEM, network and host IDPS and ML-based AD

To achieve comprehensive monitoring capabilities, we combine Suricata, an open-source Network Intrusion Detection System (NIDS), and Wazuh, a cybersecurity platform that integrates SIEM and XDR capabilities; see the instructions for a joint deployment of IDPS, SIEM/XDR and OpenSearch AD.

This site is open source. Improve this page.