Automating network security

In this thesis we show that it is possible to build Secure Autonomous Response NETworks (SARNETs); networks that are capable of protecting themselves against attacks. The work describes how control software that utilises Software Defined Networking and Network Function Virtualisation can protect the services in the overlay network. We explain how we combine data from different information sources to improve attack classification and we define metrics that can be used to evaluate defences against attacks in single as well as in multi-domain environments. Finally, we show that multi-domain defence orchestration benefits from considering trust between the collaborating domains. The proof-of-concepts and contributions in this thesis open up new research challenges and introduce ideas that can help to build a more secure and reliable Internet.