CyberFold: visual cybersecurity analysis

A security team monitoring a network receives thousands of alerts a day. Most are false alarms; a few aren’t. Telling them apart by hand is impossible.

CyberFold is a strategic project of INCIBE, Spain’s National Cybersecurity Institute, funded by the Recovery Plan, in which a research group at Universidad Rey Juan Carlos studies how to apply manifold learning to intrusion and anomaly detection. The idea is to learn the shape of a network’s normal traffic, representing it in a few dimensions, to see what falls outside it.

The group’s results were in scientific papers. To validate them outside the lab they needed something people could use, and that’s where we came in: designing and building the platform.

The challenge

• Several research lines, one tool. Anomalies in connected (IoT) devices, in industrial networks, and reducing false alarms in intrusion detection systems.
• Users who aren’t machine learning experts. The people using the tool know their network well, but they don’t necessarily know the algorithms. The interface had to explain things without overwhelming them.
• Sensitive data. A company’s network traffic can’t leave its premises.

What we did

We started with the interface. With clickable prototypes, we validated each step of the flow with the group before building the product. Then we designed and developed the full platform:

• Preparing models from each network’s reference traffic.
• Monitoring traffic and seeing at a glance what deviates from normal and why.
• Reviewing alerts to decide which deserve attention and which are false alarms.

We also wrote the script for the demo video and the user documentation.

Results

• A platform that brings the project’s research lines together in a single tool.
• A demo and a video the group uses to show its work to the people who can use it.
• More about the project at cyberfold.es (in Spanish).