Special issue on measure, detect and mitigate–challenges and trends in network security

Cybercrime has developed rapidly during the last decade, and recent years in particular have seen an unprecedented number of cyber attacks. Despite increased national and international efforts against cybercrime, cybercrime still has double-digit annual growth rates. As the number of services and systems connected to the Internet and migrating to cloud infrastructures increases, the ability to carry out attacks from a seemingly safe distance attracts more criminals and has made e-Crime a multi-billion dollar market. Furthermore, recent trends highlight that attacks target not only end hosts but also the Internet infrastructure itself, with attacks aiming at impeding the functioning of the domain name system and Internet backbones, for example. Network security is also gaining enormous political attention in times of mass surveillance, advanced persistent threats, and data leakages. Security is not just about detecting external perpetrators and protecting Internet users against them anymore. Companies and government agencies are called to responsibility when it comes to publicly reporting data breaches against their infrastructures. For example, European governments have just approved new data protection regulations that force parties to report data breaches to both governments and those who may be potentially affected. In this context, it becomes evident the importance of the steps we highlighted in this Special Issue: measure, detect, and mitigate. The dramatic trends in attack evolution call upon constant innovative solutions in each of these areas as well as in their synergistic combination. The goal of this Special Issue is twofold: we present contributions characterizing and measuring emerging network threats, as well as cutting-edge detection and mitigation techniques that are effective against network attacks and insider activities in today’s and future small-to-enterprise-sized networks and network backbones. A total of 14 papers was received for this Special Issue, for which we wish to thank all the authors. Three papers were considered, at an early stage, as out of scope and therefore did not go through the full review process. Of the 11 remaining papers, one was accepted after the first review round, five were rejected, and five underwent a second revision. In both review rounds, the papers received three reviews on average. In total, 33 reviewers participated in the review process, and based on their reviews, a final number of six papers were selected for publication. The papers featured in this Special Issue show how network security research is gaining increasing attention in both academia and industry. Monitoring in large networks, for example, university networks and Internet service provider access and backbone networks, plays a major role for gathering a better understanding of malicious activities in today’s networks. Bartos et al. investigate the use