Dr. Khaled Khan and Dr. Noora Fetais from the Department of Computer Science and Engineering (CSE) have been awarded a patent titled “Methods and Systems for Monitoring Network Security” in collaboration with KINDI Center for Computing Research in the College of Engineering at Qatar University.

The Qatar National Research Funds has supported this research under National Priority Research Program (NPRP8-531-1-111). Dr. Khaled and Dr Noora acted as the Lead PI and PI of the project respectively. Dr. Armstrong Nhlabatsi from KINDI also participated in the research project. They collaborated with the researchers from the University of Canterbury (New Zealand) and the University of Queensland (Australia).  

Modern networks are becoming more and more dynamic, such as frequent changes compared to the traditional static networks (e.g., hosts addition and removal, vulnerability change, applications and services update, and attack surface change). In a dynamic network, the configuration of at least one of the hosts or edges changes over time. The dynamic network is a network selected from a group of configured components including cloud computing, a software-defined networking arrangement, or an Internet of Things network. As network components change over time, the security posture of the network also changes, as vulnerabilities associated with the network components shift accordingly. Hence, it is of paramount importance to be able to assess the security of dynamic networks in order to understand and further enhance the security. 

This patented approach is a new technique for monitoring the security of a computing network, which includes a plurality of hosts and a plurality of edges which link connected hosts. The method comprises capturing and storing network state information in response to at least one of the time-driven trigger, an event-driven trigger or a user-driven trigger. The method further comprises storing security-related data which is indicative of the change in the security of the network during the time window for a user to monitor the change in the security of the network. Detecting a change in the security of the network comprises at least one of the following events: the addition of a new host to the network; the removal of a host from the network; the addition of a new edge to the network; the removal of an edge from the network; the addition of a vulnerability to a host in the network; or the removal of a vulnerability from a host in the network. The method calculates at least one security metric for the network and a weight value for at least one of the components in the network. The approach is capable of capturing such critical changes and reflecting the modified security posture in order to precisely assess the security of dynamic networks.