# Integration of Machine Learning-Based Attack Detectors into Defensive Exercises of a 5G Cyber Range
## 10 Conclusions, Open Challenges, and Future Work
### Future Work  
In future work, we propose to develop offensive attack exercises supported by ML models for the red team. In these exercises, our GAN-based solution could be applied to generate variants of a specific attack and penetration tests.  
Adversarial examples are a topic of great interest in the area of information security and defense against cybersecurity threats. In this context, we propose the development of exercises for the red team that contains adversarial examples that can fool attack detection models while appearing as normal traffic to human analysts. Additionally, we propose creating lessons and exercises that teach the blue team how to defend against these adversarial attacks to increase the robustness and resilience of ML-based detection systems.  
This work focused on the integration of ML-based detectors in defensive exercises, but the integration in these exercises of mitigation strategies to be applied after a successful detection of an attack is another interesting research line that will be explored in the future. This line of research is not trivial as it will involve additional synchronization between the SPIDER cyber range running the exercises and the Mouseworld Lab acting as a network digital twin that not only emulates the attacks but also receives the mitigation actions from the trainee and applies them in real-time in the emulated scenario, which will produce changes not initially programmed in the emulation.  
Defensive exercises based on unsupervised ML techniques can also be a perfect complement to the exercises developed in this work, as they allow the trainee to learn in which attack scenarios it is better to apply unsupervised or supervised techniques or a combination of both. The integration of unsupervised ML techniques into SPIDER exercises must address the design of new messages between the STA and the SPIDER components that interact with it (e.g., the Dashboard and the Evaluation Agent) as the output structure generated by unsupervised ML models is quite different from that of supervised methods.  
Conceptualization, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; methodology, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; software, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; validation, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; investigation, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; data curation, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; writing--original draft preparation, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; writing--review and editing, A.M., A.P., A.K., L.d.I.C., J.I.M. and D.R.; funding acquisition, A.M. All authors have read and agreed to the published version of the manuscript.  
The research leading to these results received partial funding from the European Union's Horizon 2020 research and innovation programme under grant agreement n*833685 (SPIDER) and by the Spanish Ministerio de Asuntos Economicos y Transformacion Digital, Programa UNICO under project B5 GEMINI (TSI-063000-2021-79, TSI-063000-2021-81).  
We thank [PERSON] (Telefonica I+D) for his valuable help in the design, implementation, integration, and deployment of the cryptomining detection and DoH flooding attack exercises. We thank [PERSON] (UBITECH), technical leader of the SPIDER project, and the other SPIDER collaborators, who contributed their knowledge and experience in fruitful discussions on the SPIDER architecture during the realization of the project.  
The authors declare no conflict of interest.