Research database

“The Internet is the first thing that humanity has built that humanity doesn't understand, the largest experiment in anarchy that we have ever had.” This quote from Eric Schmidt, former CEO of Google, is still very timely. The importance of the Internet has been clearly highlighted during the COVID-19 pandemic and in recent events in Russia-Ukraine conflict, anticipated by and contemporary to Internet-mediated information warfare and cyberwar. Yet, understanding and explaining how the Internet works and how humans use it remain open questions. Cybersecurity is dominating the priorities as we adapt to a post-COVID-19 era, with adversaries attacking devices connected in homes, hospitals, cars, etc. Visibility becomes as critical as the Internet itself, and extracting human-understandable actionable and valuable information (i.e. “explain”) from raw traffic data is crucial. In a nutshell, we need fundamental instruments to explain the Internet. XInternet aims at studying how to leverage Artificial Intelligence (AI) and Machine Learning (ML) to continuously and automatically extract valuable and actionable information from raw network data collected on the network. For this, we build upon datasets the partners already have and other means to collect new data by instrumenting state-of-art honeypots, passive monitors, and platforms to collect data from mobile devices. Armed with this, we will investigate the fundamental problem of understanding how to represent network data in a suitable manner for AI/ML applications. But network data changes over time and space. This calls for novel and specific representation architectures able to capture the correlation over time and space seen in internet traffic, and to clearly communicate such information in a standardized format to human operators. Moreover, the adoption of AI-based solutions is hindered by their inherent black-box nature, that constitutes an ethical and legal roadblock for real-world application, and a limit for its improvement. Therefore, we will employ Explainable AI techniques to make AI models interpretable, manageable, and trustworthy. We will demonstrate XInternet in two novel and timely use cases considering: (i) Mobile-app traffic classification and prediction where legitimate traffic is collected, represented, annotated, and analyzed, to design and implement novel strategies for traffic characterization, classification, and prediction at several granularities: a specific focus will be on traffic generated by the “most popular” apps during COVID-19 pandemic (e.g., Teams, Zoom, Skype, Meet, etc.); (ii) Cybersecurity, where malicious/anomalous traffic is collected, represented, annotated, and analyzed, to design and implement novel strategies for anomaly detection and analysis of cyber-attacks: a specific focus will be on malware traffic collected during the cyber-war of Russian-Ukraine conflict.