Search

In the rapidly evolving landscape of the Internet of Things (IoT), ensuring robust intrusion detection is paramount for device and data security. This paper proposes a novel method for intrusion detection in IoT networks that leverages a unique blend of subspace clustering and ensemble learning. Our framework integrates three innovative strategies: Clustering Results as Features (CRF), Two-Level Decision Making (TDM), and Iterative Feedback Loop (IFL). These strategies synergize to enhance detection performance and model robustness. We employ mutual information for feature selection and utilize four subspace clustering algorithms – CLIQUE, PROCLUS, SUBCLU, and LOF – to create additional feature sets. Three base learners – NB, LGBM, and XGB – are used in conjunction with a Logistic Regression (LR) meta-learner. To fine-tune our model, we apply Particle Swarm Optimization (PSO) for hyperparameter optimization. We evaluate our framework on the UNSW-NB15 dataset, which contains realistic and diverse IoT network traffic data. The results show that our framework outperforms the state-of-the-art methods in terms of accuracy (97.05%), precision (96.33%), recall (96.55%), F1-score (96.45%), and false positive rate (0.029). Our framework can effectively detect both known and unknown attacks in IoT networks and achieve high accuracy and low false positive rate. The paper contributes both practical implications for network security and theoretical advancements in intrusion detection research.

This paper presents a method for detecting cyber-attacks in cyber-physical systems using a monitor. The method employs an abstract model called Tiny Twin, which is built at design time and is used at runtime to detect inconsistencies. Tiny Twin is a state transition system that represents the observable behavior of the system from the monitor point of view. We model the behavior of the system in the Rebeca modeling language and use Afra model checker to generate the state space. The Tiny Twin is built automatically, by abstracting the state space while keeping the observable actions and preserving the trace equivalence. For doing that we had to solve the complexities in the state space introduced by time-shifts, nondeterministic assignments and abstraction of internal actions. We formally define the state space as Concise Rebeca Timed Transition System (CRTTS), and then map CRTTS to an LTS. The LTS is then fed to a tool to abstract away the non-observable actions.

The Internet of Things (IoT) represents a swiftly expanding sector that is pivotal in driving the innovation of today's smart services. However, the inherent resource-constrained nature of IoT nodes poses significant challenges in embedding advanced algorithms for cybersecurity, leading to an escalation in cyberattacks against these nodes. Contemporary research in Intrusion Detection Systems (IDS) predominantly focuses on enhancing IDS performance through sophisticated algorithms, often overlooking their practical applicability. This paper introduces Deep-IDS, an innovative and practically deployable Deep Learning (DL)-based IDS. It employs a Long-Short-Term-Memory (LSTM) network comprising 64 LSTM units and is trained on the CIC-IDS2017 dataset. Its streamlined architecture renders Deep-IDS an ideal candidate for edge-server deployment, acting as a guardian between IoT nodes and the Internet against Denial of Service, Distributed Denial of Service, Brute Force, Man-in-the-Middle, and Replay Attacks. A distinctive aspect of this research is the trade-off analysis between the intrusion Detection Rate (DR) and the False Alarm Rate (FAR), facilitating the real-time performance of the Deep-IDS. The system demonstrates an exemplary detection rate of 96.8% at the 70% threshold of DR-FAR trade-off and an overall classification accuracy of 97.67%. Furthermore, Deep-IDS achieves precision, recall, and F1-scores of 97.67%, 98.17%, and 97.91%, respectively. On average, Deep-IDS requires 1.49 seconds to identify and mitigate intrusion attempts, effectively blocking malicious traffic sources. The remarkable efficacy, swift response time, innovative design, and novel defense strategy of Deep-IDS not only secure IoT nodes but also their interconnected sub-networks, thereby positioning Deep-IDS as a leading IDS for IoT-enhanced computer networks.

Machine learning is a subset of Computerized reasoning (simulated intelligence), which centers around the execution of certain frameworks that can gain from the verifiable information, recognize examples and pursue consistent choices with next to zero human intercessions. Network protection is the act of safeguarding advanced frameworks, like PCs, servers, cell phones, organizations and related information from vindictive assaults. Joining network protection and ML has two significant angles, to be specific representing network safety where the AI is applied, and the utilization of AI for empowering network protection. This joining can help us in different ways, similar to it gives upgraded security to the AI models, works on the exhibition of the network safety strategies, and supports compelling discovery of multi day assaults with less human mediation. In this review paper, we examine around two distinct ideas by joining digital protection and ML. We likewise examine the benefits, issues and difficulties of joining network safety and ML. Besides, we examine the different assaults and give an extensive near investigation of different procedures in two different thought about classes.

With the continuous advancement of Internet of Things (IoT) intelligence, IoT security issues have become more and more prominent in recent years. The research on IoT security has become a hot spot. A lightweight IoT intrusion detection model fusing a convolutional neural network, bidirectional long short-term memory network is proposed. It aims to improve processed data security and attack detection accuracy. First, sampling is performed by a hybrid sampling algorithm fusing SMOTE and ENN. Its aim is to minimize the impact of imbalanced-data and ensure data quantity in the process. Then, the data features are extracted by 2-dimensional convolutional neural network (2dCNN), and the effect of useless information is reduced by mean pooling and maximum pooling, so it can be adapted to the demanding resource environment of the IoT. On this basis, long-range dependent temporal features are extracted using bidirectional long short-term memory (BiLSTM), which aims to fully extract data features to improve detection accuracy in the limited resource environment. Finally, the algorithm is validated on the UNSW_NB15 dataset, and the results of the experiments reaches 93.5% at Accuracy, 86.4% at Precision, 85.3% at Recall and 85.8% at F1-Score. According to the results, the proposed algorithm can generate higher-quality samples, achieve higher detection rate with faster inference time and spend lower memory costs.

This report documents the program and the findings of Dagstuhl Seminar 23431 "Network Attack Detection and Defense - AI-Powered Threats and Responses". With the emergence of artificial intelligence (AI), attack detection and defense are taking on a new level of quality. Artificial intelligence will promote further automation of attacks. There are already examples of this, such as the Deep Locker malware. It is expected that we will soon face a situation in which malware and attacks will become more and more automated, intelligent, and AI-powered. Consequently, today’s threat response systems will become more and more inadequate, especially when they rely on manual intervention of security experts and analysts. The main objective of the seminar was to assess the state of the art and potentials that AI advances create for both attackers and defenders. The seminar continued the series of Dagstuhl events "Network Attack Detection and Defense" held in 2008, 2012, 2014, and 2016. The objectives of the seminar were threefold, namely (1) to investigate various scenarios of AI-based malware and attacks, (2) to debate trust in AI and modeling of threats against AI, and (3) to propose methods and strategies for AI-powered network defenses. At the seminar, which brought together participants from academia and industry, we stated that recent advances in artificial intelligence have opened up new possibilities for each of these directions. In general, more and more researchers in networking and security look at AI-based methods which made this a timely event to assess and categorize the state of the art as well as work towards a roadmap for future research. The outcome of the discussions and the proposed research directions are presented in this report.

Nowadays, vehicles are equipped with multiple Electronic Control Units (ECUs) each of which communicates with one another using a specification called Controller Area Network (CAN). CAN provides its own share of benefits in modernizing automobiles, but it also brought along a security issue to the automotive industry. CAN bus does not have any mechanism for encrypting or authenticating CAN payloads. As a countermeasure against these drawbacks, we have experimented on identifying intrusions in the CAN bus using Long Short-Term Memory Networks (LSTM). LSTM networks are trained with features extracted from reverse engineered packets. In a specific range of time windows, we have extracted three parameters, the number of packets, the bit flip rate and the average time difference that are used to train LSTM. The trained LSTM is later then used to predict all the three features which will be combined to a single anomaly signal using a root mean squared error. Depending on which side of the threshold appears the anomaly signal value, we managed to identify anomalies in an acceptable performance rate, up to F1 score of 98%. We have tested our methods with a variety of attacks on the CAN bus and demonstrated how effective our detection methods is.

The number of computer controlled vehicles throughout the world is rising at a staggering speed. Even though this enhances the driving experience, it opens a new security hole in the automotive industry. To alleviate this issue, we are proposing an intrusion detection system (IDS) to the controller area network (CAN), which is the de facto communication standard of present-day vehicles. We implemented an IDS based on the analysis of ID sequences. The IDS uses a trained Long-Short Term Memory (LSTM) to predict an arbitration ID that will appear in the future by looking back to the last 20 packet arbitration IDs. The output from the LSTM network is a softmax probability of all the 42 arbitration IDs in our test car. The softmax probability is used in two approaches for IDS. In the first approach, a single arbitration ID is predicted by taking the class which has the highest softmax probability. This method only gave us an accuracy of 0.6. Applying this result in a real vehicle would give us a lot of false negatives, hence we devised a second approach that uses log loss as an anomaly signal. The evaluated log loss is compared with a predefined threshold to see if the result is in the anomaly boundary. Furthermore, We have tested our approach using insertion, drop and illegal ID attacks which greatly outperform the conventional method with practical F1 scores of 0.9, 0.84, and 1.0 respectively., 2020 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops),23-27 March 2020,Austin, TX, USA, USA

The coronavirus pandemic has overburdened medical institutions, forcing physicians to diagnose and treat their patients remotely. Moreover, COVID-19 has made humans more conscious about their health, resulting in the extensive purchase of IoT-enabled medical devices. The rapid boom in the market worth of the internet of medical things (IoMT) captured cyber attackers attention. Like health, medical data is also sensitive and worth a lot on the dark web. Despite the fact that the patients health details have not been protected appropriately, letting the trespassers exploit them. The system administrator is unable to fortify security measures due to the limited storage capacity and computation power of the resource-constrained network devices. Although various supervised and unsupervised machine learning algorithms have been developed to identify anomalies, the primary undertaking is to explore the swift progressing malicious attacks before they deteriorate the wellness systems integrity. In this paper, a Dew-Cloud based model is designed to enable hierarchical federated learning (HFL). The proposed Dew-Cloud model provides a higher level of data privacy with greater availability of IoMT critical application(s). The hierarchical long-term memory (HLSTM) model is deployed at distributed Dew servers with a backend supported by cloud computing. Data pre-processing feature helps the proposed model achieve high training accuracy (99.31%) with minimum training loss (0.034). The experiment results demonstrate that the proposed HFL-HLSTM model is superior to existing schemes in terms of performance metrics such as accuracy, precision, recall, and f-score., Funding Agencies|CENIIT Project [17.01]; Excellence Center at Linkoeping-Lund in IT (ELLIIT)

Hackare fortsätter att bli bättre på att få otillåten tillgång till våra datorer och kan undvika de mest grundläggande intrångsskyddade system och brandväggar på en standarddator. Då numren av intrång växer varje år och kostar företag miljoner av dollar, så verkar gapet mellan attackerare och försvarare att bli större. Frågan som då kan uppstå är, hur kan vi skydda oss själva? Kunskapen som blivit insamlad i detta arbete pekar tydligt på att det finns saker vi kan göra vilket svarar på frågan, hur kan vi upptäcka intrång? Studien visar att mer avancerade Intrusion Detection System (IDS) kan bli implementerad på hemdatorer (och i företag). Det finns många alternativ att välja mellan, men de valda IDSer – OSSEC och Snort – kan upptäcka säkerhetsbrister på enskilda host-maskiner (eller på nätverket) i realtid tack vare avancerad loggningshanterings och övervakning. Svårighetsgraden av att använda och implementera dessa IDSer var utmanande men tillfredställande och konfigurationen var flexibel vilket tillåter IDSerna att bli installerade på en ensam host-dator eller i ett nätverk. Om ett enkelt-att-följa grafiskt översikt av felmeddelanden är vad man önskar så har OSSEC IDS, tillsammans med att skicka e-mail över felmeddelandet, den funktionaliteten. Snort, på andra sidan, har en enkel konfiguration och flexibilitet i att skriva regler. Det borde framgå tydligt att implementera en IDS på ert system inte gör det ogenomträngligt, inte heller löser det alla säkerhetsrelaterade problem, men det som kommer att hända är att vi får en bättre förståelse av de hot som uppstår i våra system., Hackers keeps getting better at gaining unauthorized access to our computers and can avoid some of the most basic intrusion detection systems and firewalls on a standard computer. The gap between attackers and defenders seem to grow as intrusions increase in numbers every year, costing companies millions of dollars, so the question is posed, how can we protect ourselves? The research done in this work clearly points to that there are things that can be done which answers the question, how can we detect intrusions? The study has shown that a more advanced intrusion detection system (IDS) can be implemented on home computers (and in businesses). There are many options to choose from but the chosen IDSs – OSSEC and Snort – can detect security issues on the host computer (or on the network) in real-time by advanced logging management and monitoring. The implementation and usage difficulties of these IDSs are challenging but satisfying and the configurations are flexible allowing the IDSs to be installed on a single host or in a larger network. If an easy-to-follow graphical overview of the alerts on your system is what you are looking for then that, and sending e-mails of the alert, is found in the OSSEC IDS. Snort, on the other hand, has easy configurations and flexible rule-writing and the options of sniffing packets on the network. It should be clear that implementing an IDS on your system does not make it impenetrable nor solve all the security issues but what it will do is to give you a better understanding of the threats on your system.

The Internet of Things is expanding, and with the increasing numbers of connected devices,exploitation of those devices also becomes more common. Since IoT devices and IoT networksare used in many crucial areas in modern societies, ranging from everything between securityand militrary applications to healthcare monitoring and production efficiency, the need to securethese devices is of great importance for researchers and businesses. This project explores howan intrusion detection system called DETONAR can be used on border router logs, instead of itsoriginal use of sniffer devices. Using DETONAR in this way allows us to detect many differentattacks, without contributing to the additional cost of deploying sniffer devices and the additionalrisk of the sniffer devices themselves becoming the target of attack

With the advent of Fifth Generation (5G) mobile networks, a diverse range of new computer networking technologies are being devised to meet the stringent demands of applications that require ultra-low latency, high bandwidth and geolocation-based services. Multi-Access Edge Computing (MEC) is a prominent example of such an emerging technology, which provides cloud computing services at the edge of the network using mobile base stations. This architectural shift of services from centralised cloud data centers to the network edge, helps reduce bandwidth usage and improve response time, meeting the ultra-low latency requirements laid out for 5G. However, MEC also inherits some of the security vulnerabilities affecting traditional networks and cloud computing, such as coordinated cyber attacks. This highlights a clear need for security mechanisms like Intrusion Detection Systems (IDS), specifically Collaborative Intrusion Detection Systems (CIDS), which have proven to be effective in identifying attacks spread across multiple locations. However, identifying the right CIDS model for MEC is not straightforward due to the tradeoff between different factors such as detection accuracy, network overhead, computation and memory overhead. Most CIDS solutions for MEC use a cloud-based backend for offloading their heavy data processing tasks, introducing latency. Intrusion Detection becomes even more convoluted when modern security layers like zero trust are added onto MEC environments. These challenges highlight the need for purely edge-based CIDS architectures and mechanisms for MEC that can integrate well with modern security layers, and is an area that is yet to be explored. This thesis addresses these challenges by first introducing a practical application use-case scenario using a car parking application running in MEC clusters. We then outline different attack patterns such as volumetric as well as stealthy attacks to compromise our application. This sets the base foundati

The coronavirus pandemic has overburdened medical institutions, forcing physicians to diagnose and treat their patients remotely. Moreover, COVID-19 has made humans more conscious about their health, resulting in the extensive purchase of IoT-enabled medical devices. The rapid boom in the market worth of the internet of medical things (IoMT) captured cyber attackers attention. Like health, medical data is also sensitive and worth a lot on the dark web. Despite the fact that the patients health details have not been protected appropriately, letting the trespassers exploit them. The system administrator is unable to fortify security measures due to the limited storage capacity and computation power of the resource-constrained network devices. Although various supervised and unsupervised machine learning algorithms have been developed to identify anomalies, the primary undertaking is to explore the swift progressing malicious attacks before they deteriorate the wellness systems integrity. In this paper, a Dew-Cloud based model is designed to enable hierarchical federated learning (HFL). The proposed Dew-Cloud model provides a higher level of data privacy with greater availability of IoMT critical application(s). The hierarchical long-term memory (HLSTM) model is deployed at distributed Dew servers with a backend supported by cloud computing. Data pre-processing feature helps the proposed model achieve high training accuracy (99.31%) with minimum training loss (0.034). The experiment results demonstrate that the proposed HFL-HLSTM model is superior to existing schemes in terms of performance metrics such as accuracy, precision, recall, and f-score., Funding Agencies|CENIIT Project [17.01]; Excellence Center at Linkoeping-Lund in IT (ELLIIT)

The coronavirus pandemic has overburdened medical institutions, forcing physicians to diagnose and treat their patients remotely. Moreover, COVID-19 has made humans more conscious about their health, resulting in the extensive purchase of IoT-enabled medical devices. The rapid boom in the market worth of the internet of medical things (IoMT) captured cyber attackers attention. Like health, medical data is also sensitive and worth a lot on the dark web. Despite the fact that the patients health details have not been protected appropriately, letting the trespassers exploit them. The system administrator is unable to fortify security measures due to the limited storage capacity and computation power of the resource-constrained network devices. Although various supervised and unsupervised machine learning algorithms have been developed to identify anomalies, the primary undertaking is to explore the swift progressing malicious attacks before they deteriorate the wellness systems integrity. In this paper, a Dew-Cloud based model is designed to enable hierarchical federated learning (HFL). The proposed Dew-Cloud model provides a higher level of data privacy with greater availability of IoMT critical application(s). The hierarchical long-term memory (HLSTM) model is deployed at distributed Dew servers with a backend supported by cloud computing. Data pre-processing feature helps the proposed model achieve high training accuracy (99.31%) with minimum training loss (0.034). The experiment results demonstrate that the proposed HFL-HLSTM model is superior to existing schemes in terms of performance metrics such as accuracy, precision, recall, and f-score., Funding Agencies|CENIIT Project [17.01]; Excellence Center at Linkoeping-Lund in IT (ELLIIT)

Modern automotive functions are controlled by a large number of small computers called electronic control units (ECUs). These functions span from safety-critical autonomous driving to comfort and infotainment. ECUs communicate with one another over multiple internal networks using different technologies. Some, such as Controller Area Network (CAN), are very simple and provide minimal or no security services. Machine learning techniques can be used to detect anomalous activities in such networks. However, it is necessary that these machine learning techniques are not prone to adversarial attacks. In this paper, we investigate adversarial sample vulnerabilities in four different machine learning-based intrusion detection systems for automotive networks. We show that adversarial samples negatively impact three of the four studied solutions. Furthermore, we analyze transferability of adversarial samples between different systems. We also investigate detection performance and the attack success rate after using adversarial samples in the training. After analyzing these results, we discuss whether current solutions are mature enough for a use in modern vehicles., This research is partially funded by the CyReV project(Sweden’s Innovation Agency, D-nr 2019-03071), partiallyby the H2020 ARCADIAN-IoT (Grant ID. 101020259), andH2020 VEDLIoT (Grant ID. 957197).

With the rapid expansion and widespread adoption of the Internet of Things (IoT), maintaining secure connections among active devices can be challenging. Since IoT devices are limited in power and storage, they cannot perform complex tasks, which makes them vulnerable to different types of attacks. Given the volume of data generated daily, detecting anomalous behavior can be demanding. However, machine learning (ML) algorithms have proven successful in extracting complex patterns from big data, which has led to active applications in IoT. In this paper, we perform a comprehensive analysis, including 4 ML algorithms and 3 neural networks (NNs), and propose a pipeline which analyzes the influence data reduction (loss) has on the performance of these algorithms. We use random undersampling as a data reduction technique, which simulates reduced network traffic data. The pipeline investigates several degrees of data loss. The results show that models trained on the original data distribution obtain accuracy that verges on 100%. XGBoost performs best from the classic ML algorithms. From the deep learning models, the 2-layered NN provides excellent results and has sufficient depth for practical application. On the other hand, when the models are trained on the undersampled data, there is a decrease in performance, most notably in the case of NNs. The most prominent change is seen in the 4-layered NN, where the model trained on the original dataset detects attacks with a success of 93.53%, whereas the model trained on the maximally reduced data has a success of only 39.39%.

With the rapid expansion and widespread adoption of the Internet of Things (IoT), maintaining secure connections among active devices can be challenging. Since IoT devices are limited in power and storage, they cannot perform complex tasks, which makes them vulnerable to different types of attacks. Given the volume of data generated daily, detecting anomalous behavior can be demanding. However, machine learning (ML) algorithms have proven successful in extracting complex patterns from big data, which has led to active applications in IoT. In this paper, we perform a comprehensive analysis, including 4 ML algorithms and 3 neural networks (NNs), and propose a pipeline which analyzes the influence data reduction (loss) has on the performance of these algorithms. We use random undersampling as a data reduction technique, which simulates reduced network traffic data. The pipeline investigates several degrees of data loss. The results show that models trained on the original data distribution obtain accuracy that verges on 100%. XGBoost performs best from the classic ML algorithms. From the deep learning models, the 2-layered NN provides excellent results and has sufficient depth for practical application. On the other hand, when the models are trained on the undersampled data, there is a decrease in performance, most notably in the case of NNs. The most prominent change is seen in the 4-layered NN, where the model trained on the original dataset detects attacks with a success of 93.53%, whereas the model trained on the maximally reduced data has a success of only 39.39%.

Over the past few decades, Industrial Control Systems (ICS) have been targeted by cyberattacks and are becoming increasingly vulnerable as more ICSs are connected to the internet. Using Machine Learning (ML) for Intrusion Detection Systems (IDS) is a promising approach for ICS cyber protection, but the lack of suitable datasets for evaluating ML algorithms is a challenge. Although a few commonly used datasets may not reflect realistic ICS network data, lack necessary features for effective anomaly detection, or be outdated. This paper introduces the 'ICS-Flow' dataset, which offers network data and process state variables logs for supervised and unsupervised ML-based IDS assessment. The network data includes normal and anomalous network packets and flows captured from simulated ICS components and emulated networks, where the anomalies were applied to the system through various cyberattacks. We also proposed an open-source tool, "ICSFlowGenerator," for generating network flow parameters from Raw network packets. The final dataset comprises over 25,000,000 raw network packets, network flow records, and process variable logs. The paper describes the methodology used to collect and label the dataset and provides a detailed data analysis. Finally, we implement several ML models, including the decision tree, random forest, and artificial neural network to detect anomalies and attacks, demonstrating that our dataset can be used effectively for training intrusion detection ML models.

As power system's operational technology converges with innovative information and communication technologies, the need for extensive resilience testing for scenarios covering the electrical grid, networking bottlenecks, as well as cyber security threats, become a necessity. This paper proposes a comprehensive, multi-disciplinary simulation framework to test virtualized intelligent electronic devices (vIEDs), considering 1) functional requirements, 2) performance and quality of service of the underlying communication network using software-defined networking, and 3) cyber security intrusion detection schemes. This work serves as a reference for researchers interested in the grid modernization of information and communication infrastructure for future power systems. Six different cyber security attack surfaces have been identified within the framework scope. It was observed that migration of vIEDs due to device maintenance or external anomalies is interesting from an operational perspective yet still poses significant security threats. Therefore, both host-based and network-based intrusion detection schemes were analyzed. Also, the setup has been mapped to an offshore wind case study demonstrating its potential and possible scenarios to simulate., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Intelligent Electrical Power Grids, Electrical Sustainable Energy

With the rapid expansion and widespread adoption of the Internet of Things (IoT), maintaining secure connections among active devices can be challenging. Since IoT devices are limited in power and storage, they cannot perform complex tasks, which makes them vulnerable to different types of attacks. Given the volume of data generated daily, detecting anomalous behavior can be demanding. However, machine learning (ML) algorithms have proven successful in extracting complex patterns from big data, which has led to active applications in IoT. In this paper, we perform a comprehensive analysis, including 4 ML algorithms and 3 neural networks (NNs), and propose a pipeline which analyzes the influence data reduction (loss) has on the performance of these algorithms. We use random undersampling as a data reduction technique, which simulates reduced network traffic data. The pipeline investigates several degrees of data loss. The results show that models trained on the original data distribution obtain accuracy that verges on 100%. XGBoost performs best from the classic ML algorithms. From the deep learning models, the 2-layered NN provides excellent results and has sufficient depth for practical application. On the other hand, when the models are trained on the undersampled data, there is a decrease in performance, most notably in the case of NNs. The most prominent change is seen in the 4-layered NN, where the model trained on the original dataset detects attacks with a success of 93.53%, whereas the model trained on the maximally reduced data has a success of only 39.39%.

Cyber Security

In the dynamic landscape of cyber threats, multi-stage malware botnets have surfaced as significant threats of concern. These sophisticated threats can exploit Internet of Things (IoT) devices to undertake an array of cyberattacks, ranging from basic infections to complex operations such as phishing, cryptojacking, and distributed denial of service (DDoS) attacks. Existing machine learning solutions are often constrained by their limited generalizability across various datasets and their inability to adapt to the mutable patterns of malware attacks in real world environments, a challenge known as model drift. This limitation highlights the pressing need for adaptive Intrusion Detection Systems (IDS), capable of adjusting to evolving threat patterns and new or unseen attacks. This paper introduces MalBoT-DRL, a robust malware botnet detector using deep reinforcement learning. Designed to detect botnets throughout their entire lifecycle, MalBoT-DRL has better generalizability and offers a resilient solution to model drift. This model integrates damped incremental statistics with an attention rewards mechanism, a combination that has not been extensively explored in literature. This integration enables MalBoT-DRL to dynamically adapt to the ever-changing malware patterns within IoT environments. The performance of MalBoT-DRL has been validated via trace-driven experiments using two representative datasets, MedBIoT and N-BaIoT, resulting in exceptional average detection rates of 99.80% and 99.40% in the early and late detection phases, respectively. To the best of our knowledge, this work introduces one of the first studies to investigate the efficacy of reinforcement learning in enhancing the generalizability of IDS.

Intrusion detection systems (IDSs) are essential for protecting computer systems and networks from malicious attacks. However, IDSs face challenges in dealing with dynamic and imbalanced data, as well as limited label availability. In this thesis, we propose a novel elastic gradient boosting decision tree algorithm, namely Elastic CatBoost Uncertainty (eCBU), that adapts to concept drifts and copes with label scarcity by using a novel sequential uncertainty estimation method. We compare our method with state-of-the-art techniques on synthetic and real-world datasets and show that it achieves comparable accuracy and higher robustness to limited label availability in intrusion detection tasks., Computer Science | Artificial Intelligence

In recent years, machine learning (ML) techniques have been widely adopted as anomaly-based Intrusion Detection System in order to evaluate cyber and physical attacks against Industrial Control Systems. Nevertheless, a performance comparison of such techniques applied to multiple Cyber-Physical Systems datasets is still missing. In light of this, we propose a comparative study about the performance of four supervised ML-algorithms, Random Forest, k-nearest-Neighbors, Support-Vector-Machine and Naïve-Bayes, applied to three different publicly available datasets from water testbeds. Specifically, we consider three different scenarios where we evaluate: (1) the ability to detect cyber and physical anomalies with respect to the nominal samples, (2) the ability to detect specific types of cyber and physical attacks and (3) the ability to recognize unforeseen attacks without providing any previous knowledge about them. Results show the effectiveness of the ML-techniques in identifying cyber and physical anomalies under some assumptions about their effects on the process dynamics.

Detecting a malicious hacker intruding on a network system can be difficult. This challenge is made even more complex by the network activity generated by normal users and by the fact that it is impossible to know the hacker’s exact actions. Instead, the defender of the network system has to infer the hacker’s actions by statistics collected by the intrusion detection system, IDS. This thesis investigates the performance of hidden Markov models, HMM, to detect an intrusion automatically under different background activities generated by normal users. Furthermore, background subtraction techniques with inspiration from computer vision are investigated to see if normal users’ activity can be filtered out to improve the performance of the HMMs.The results suggest that the performance of HMMs are not sensitive to the type of background activity but rather to the number of normal users present. Furthermore, background subtraction enhances the performance of HMMs slightly. However, further investigations into how background subtraction performs when there are many normal users must be done before any definitive conclusions., Det kan vara svårt att upptäcka en hackare som gör intrång i ett nätverkssystem. Utmaningen blir ännu större genom nätverksaktiviteten som genereras av vanliga användare och av det faktum att det är omöjligt att veta hackarens exakta handlingar. Istället måste nätverkssystemets försvarare använda insamlad data från intrångsdetekteringssystemet, IDS, för att estimera hackarens handlingar. Detta arbete undersöker förmågan hos dolda Markovmodeller, HMM, att automatiskt upptäcka dataintrång under olika typer av bakgrundsaktiviteter som genereras av normala användare. Dessutom undersöks bakgrundssubtraktionstekniker med inspiration från datorseende för att se om normala användares aktivitet kan filtreras bort för att förbättra prestanda hos HMM. Resultaten tyder på att prestandan för HMM inte är känsliga för typen av bakgrundsaktivitet utan snarare för antalet närvarande normala användare. Dessutom förbättrar bakgrundssubtraktion prestandan hos HMM. Det krävs dock mer forskning för att dra definitiva slutsatser kring vilken effekt bakgrundssubstitution har när antalet normala användare är stort.

Along with current technological developments, security for data information residing on websites is very vulnerable to crimes in the internet world such as attacks on security holes in the database layer or often known as SQL Injection. SQL Injection attack is a method to insert SQL commands as input through an application in order to gain access to the database. This attack can find out usernames, passwords, and other data that is in the database. So that the SQL Injection attack is one of the most popular attacks and is often used to take advantage of security holes in the system because of how easy it is to use it. If the website database can be accessed, then a hacker can easily steal various confidential data, can even manipulate or damage data on the website. This article aims to test the effectiveness of SQL Injection attacks using the regular expression method. The results of research on effectiveness in SQL Injection are the accuracy of database search time and the accuracy of information from the database., Seiring perkembangan teknologi saat ini, keamanan terhadap informasi data yang berada di dalam website sangat rentan dengan kejahatan di dunia internet seperti serangan terhadap celah keamanan pada lapisan databases atau sering dikenal dengan istilah SQL Injection. Serangan SQL Injection merupakan metode untuk menyisipkan perintah SQL sebagai input melalui suatu aplikasi agar mendapatkan akses masuk ke dalam database. Serangan ini dapat mengetahui username, password, dan data lainnya yang berada di dalam database. Sehingga serangan SQL Injection merupakan salah satu serangan yang popular dan sering digunakan untuk memanfaatkan celah keamanan pada system karena cara menggunakannya yang mudah. Jika basis data website dapat diakses, maka seorang hacker dapat dengan mudah mencuri berbagai data rahasia, bahkan dapat memanupulasi atau merusak data pada website tersebut. Artikel ini memiliki tujuan untuk menguji tingkat efektifitas serangan SQL Injection dengan menggunakan metode regular expression. Hasil dari penelitian efektifitas dalam SQL Injection adalah akurasi waktu pencarian database dan ketepatan informasi dari database.

Along with current technological developments, security for data information residing on websites is very vulnerable to crimes in the internet world such as attacks on security holes in the database layer or often known as SQL Injection. SQL Injection attack is a method to insert SQL commands as input through an application in order to gain access to the database. This attack can find out usernames, passwords, and other data that is in the database. So that the SQL Injection attack is one of the most popular attacks and is often used to take advantage of security holes in the system because of how easy it is to use it. If the website database can be accessed, then a hacker can easily steal various confidential data, can even manipulate or damage data on the website. This article aims to test the effectiveness of SQL Injection attacks using the regular expression method. The results of research on effectiveness in SQL Injection are the accuracy of database search time and the accuracy of information from the database., Seiring perkembangan teknologi saat ini, keamanan terhadap informasi data yang berada di dalam website sangat rentan dengan kejahatan di dunia internet seperti serangan terhadap celah keamanan pada lapisan databases atau sering dikenal dengan istilah SQL Injection. Serangan SQL Injection merupakan metode untuk menyisipkan perintah SQL sebagai input melalui suatu aplikasi agar mendapatkan akses masuk ke dalam database. Serangan ini dapat mengetahui username, password, dan data lainnya yang berada di dalam database. Sehingga serangan SQL Injection merupakan salah satu serangan yang popular dan sering digunakan untuk memanfaatkan celah keamanan pada system karena cara menggunakannya yang mudah. Jika basis data website dapat diakses, maka seorang hacker dapat dengan mudah mencuri berbagai data rahasia, bahkan dapat memanupulasi atau merusak data pada website tersebut. Artikel ini memiliki tujuan untuk menguji tingkat efektifitas serangan SQL Injection dengan menggunakan metode regular expression. Hasil dari penelitian efektifitas dalam SQL Injection adalah akurasi waktu pencarian database dan ketepatan informasi dari database.

The coronavirus pandemic has overburdened medical institutions, forcing physicians to diagnose and treat their patients remotely. Moreover, COVID-19 has made humans more conscious about their health, resulting in the extensive purchase of IoT-enabled medical devices. The rapid boom in the market worth of the internet of medical things (IoMT) captured cyber attackers attention. Like health, medical data is also sensitive and worth a lot on the dark web. Despite the fact that the patients health details have not been protected appropriately, letting the trespassers exploit them. The system administrator is unable to fortify security measures due to the limited storage capacity and computation power of the resource-constrained network devices. Although various supervised and unsupervised machine learning algorithms have been developed to identify anomalies, the primary undertaking is to explore the swift progressing malicious attacks before they deteriorate the wellness systems integrity. In this paper, a Dew-Cloud based model is designed to enable hierarchical federated learning (HFL). The proposed Dew-Cloud model provides a higher level of data privacy with greater availability of IoMT critical application(s). The hierarchical long-term memory (HLSTM) model is deployed at distributed Dew servers with a backend supported by cloud computing. Data pre-processing feature helps the proposed model achieve high training accuracy (99.31%) with minimum training loss (0.034). The experiment results demonstrate that the proposed HFL-HLSTM model is superior to existing schemes in terms of performance metrics such as accuracy, precision, recall, and f-score., Funding Agencies|CENIIT Project [17.01]; Excellence Center at Linkoeping-Lund in IT (ELLIIT)

Hackare fortsätter att bli bättre på att få otillåten tillgång till våra datorer och kan undvika de mest grundläggande intrångsskyddade system och brandväggar på en standarddator. Då numren av intrång växer varje år och kostar företag miljoner av dollar, så verkar gapet mellan attackerare och försvarare att bli större. Frågan som då kan uppstå är, hur kan vi skydda oss själva? Kunskapen som blivit insamlad i detta arbete pekar tydligt på att det finns saker vi kan göra vilket svarar på frågan, hur kan vi upptäcka intrång? Studien visar att mer avancerade Intrusion Detection System (IDS) kan bli implementerad på hemdatorer (och i företag). Det finns många alternativ att välja mellan, men de valda IDSer – OSSEC och Snort – kan upptäcka säkerhetsbrister på enskilda host-maskiner (eller på nätverket) i realtid tack vare avancerad loggningshanterings och övervakning. Svårighetsgraden av att använda och implementera dessa IDSer var utmanande men tillfredställande och konfigurationen var flexibel vilket tillåter IDSerna att bli installerade på en ensam host-dator eller i ett nätverk. Om ett enkelt-att-följa grafiskt översikt av felmeddelanden är vad man önskar så har OSSEC IDS, tillsammans med att skicka e-mail över felmeddelandet, den funktionaliteten. Snort, på andra sidan, har en enkel konfiguration och flexibilitet i att skriva regler. Det borde framgå tydligt att implementera en IDS på ert system inte gör det ogenomträngligt, inte heller löser det alla säkerhetsrelaterade problem, men det som kommer att hända är att vi får en bättre förståelse av de hot som uppstår i våra system., Hackers keeps getting better at gaining unauthorized access to our computers and can avoid some of the most basic intrusion detection systems and firewalls on a standard computer. The gap between attackers and defenders seem to grow as intrusions increase in numbers every year, costing companies millions of dollars, so the question is posed, how can we protect ourselves? The research done in this work clearly points to that there are things that can be done which answers the question, how can we detect intrusions? The study has shown that a more advanced intrusion detection system (IDS) can be implemented on home computers (and in businesses). There are many options to choose from but the chosen IDSs – OSSEC and Snort – can detect security issues on the host computer (or on the network) in real-time by advanced logging management and monitoring. The implementation and usage difficulties of these IDSs are challenging but satisfying and the configurations are flexible allowing the IDSs to be installed on a single host or in a larger network. If an easy-to-follow graphical overview of the alerts on your system is what you are looking for then that, and sending e-mails of the alert, is found in the OSSEC IDS. Snort, on the other hand, has easy configurations and flexible rule-writing and the options of sniffing packets on the network. It should be clear that implementing an IDS on your system does not make it impenetrable nor solve all the security issues but what it will do is to give you a better understanding of the threats on your system.

The Internet of Things is expanding, and with the increasing numbers of connected devices,exploitation of those devices also becomes more common. Since IoT devices and IoT networksare used in many crucial areas in modern societies, ranging from everything between securityand militrary applications to healthcare monitoring and production efficiency, the need to securethese devices is of great importance for researchers and businesses. This project explores howan intrusion detection system called DETONAR can be used on border router logs, instead of itsoriginal use of sniffer devices. Using DETONAR in this way allows us to detect many differentattacks, without contributing to the additional cost of deploying sniffer devices and the additionalrisk of the sniffer devices themselves becoming the target of attack

Modern automotive functions are controlled by a large number of small computers called electronic control units (ECUs). These functions span from safety-critical autonomous driving to comfort and infotainment. ECUs communicate with one another over multiple internal networks using different technologies. Some, such as Controller Area Network (CAN), are very simple and provide minimal or no security services. Machine learning techniques can be used to detect anomalous activities in such networks. However, it is necessary that these machine learning techniques are not prone to adversarial attacks. In this paper, we investigate adversarial sample vulnerabilities in four different machine learning-based intrusion detection systems for automotive networks. We show that adversarial samples negatively impact three of the four studied solutions. Furthermore, we analyze transferability of adversarial samples between different systems. We also investigate detection performance and the attack success rate after using adversarial samples in the training. After analyzing these results, we discuss whether current solutions are mature enough for a use in modern vehicles., This research is partially funded by the CyReV project(Sweden’s Innovation Agency, D-nr 2019-03071), partiallyby the H2020 ARCADIAN-IoT (Grant ID. 101020259), andH2020 VEDLIoT (Grant ID. 957197).

This manuscript explores the problem of deploying sensors in networks to detect intrusions as effectively as possible. In water distribution networks, intrusions can cause a spread of contaminants over the whole network; we are searching for locations for where to install sensors in order to detect intrusion contaminations as early as possible. Monitoring epidemics can also be modelled into this framework. Given a network of interactions between people, we want to identify which “small” set of people to monitor in order to enable early outbreak detection. In the domain of the Web, bloggers publish posts and refer to other bloggers using hyperlinks. Sensors are a set of blogs that catch links to most of the stories that propagate over the blogosphere. In the sensor placement problem, we have to manage a trade-off between different objectives. To solve the resulting multi-objective optimization problem, we use a multi-objective evolutionary algorithm based on the Tchebycheff scalarization (MOEA/D). The key contribution of this paper is to interpret the weight vectors in the scalarization as probability measures. This allows us to use the Wasserstein distance to drive their selection instead of the Euclidean distance. This approach results not only in a new algorithm (MOEA/D/W) with better computational results than standard MOEA/D but also in a new design approach that can be generalized to other evolutionary algorithms.

The coronavirus pandemic has overburdened medical institutions, forcing physicians to diagnose and treat their patients remotely. Moreover, COVID-19 has made humans more conscious about their health, resulting in the extensive purchase of IoT-enabled medical devices. The rapid boom in the market worth of the internet of medical things (IoMT) captured cyber attackers attention. Like health, medical data is also sensitive and worth a lot on the dark web. Despite the fact that the patients health details have not been protected appropriately, letting the trespassers exploit them. The system administrator is unable to fortify security measures due to the limited storage capacity and computation power of the resource-constrained network devices. Although various supervised and unsupervised machine learning algorithms have been developed to identify anomalies, the primary undertaking is to explore the swift progressing malicious attacks before they deteriorate the wellness systems integrity. In this paper, a Dew-Cloud based model is designed to enable hierarchical federated learning (HFL). The proposed Dew-Cloud model provides a higher level of data privacy with greater availability of IoMT critical application(s). The hierarchical long-term memory (HLSTM) model is deployed at distributed Dew servers with a backend supported by cloud computing. Data pre-processing feature helps the proposed model achieve high training accuracy (99.31%) with minimum training loss (0.034). The experiment results demonstrate that the proposed HFL-HLSTM model is superior to existing schemes in terms of performance metrics such as accuracy, precision, recall, and f-score., Funding Agencies|CENIIT Project [17.01]; Excellence Center at Linkoeping-Lund in IT (ELLIIT)

The Internet of Things (IoT) is growing rapidly and so the need of ensuring protection against cybersecurity attacks to IoT devices. In this scenario, Intrusion Detection Systems (IDSs) play a crucial role and data-driven IDSs based on machine learning (ML) have recently attracted more and more interest by the research community. While conventional ML-based IDSs are based on a centralized architecture where IoT devices share their data with a central server for model training, we propose a novel approach that is based on federated learning (FL). However, conventional FL is ineffective in the considered scenario, due to the high statistical heterogeneity of data collected by IoT devices. To overcome this limitation, we propose a three-tier FL-based architecture where IoT devices are clustered together based on their statistical properties. Clustering decisions are taken by means of a novel entropy-based strategy, which helps improve model training performance. We tested our solution on the CIC-ToN-IoT dataset: our clustering strategy increases intrusion detection performance with respect to a conventional FL approach up to +17% in terms of F1-score, along with a significant reduction of the number of training rounds.

Cyber-physical system security for electric distribution systems is critical. In direct switching attacks, often coordinated, attackers seek to toggle remote-controlled switches in the distribution network. Due to the typically radial operation, certain configurations may lead to outages and/or voltage violations. Existing optimization methods that model the interactions between the attacker and the power system operator (defender) assume knowledge of the attacker's parameters. This reduces their usability. Furthermore, the trend with coordinated cyberattack detection has been the use of centralized mechanisms, correlating data from dispersed security systems. This can be prone to single point failures. In this paper, novel mathematical models are presented for the attacker and the defender. The models do not assume any knowledge of the attacker's parameters by the defender. Instead, a machine learning (ML) technique implemented by a multi-agent system correlates detected attacks in a decentralized manner, predicting the targets of the attacker. Furthermore, agents learn optimal mitigation of the communication level through Q-learning. The learned attacker motive is also used by the defender to determine a new configuration of the distribution network. Simulations of the technique have been performed using the IEEE 123-Node Test Feeder. The simulation results validate the capability and performance of the algorithm.

The explosion of online video streaming in recent years resulted in advanced services both in terms of efficiency and convenience. However, Internet-connected video cameras are prone to exploitation, leading to information security issues and data privacy concerns. The proliferation of video-capable Internet of Things devices and cloud-managed surveillance systems further extend these security issues and concerns. In this paper, a novel approach is proposed for video camera deception via honeypots, offering increased security measures compared to what is available on conventional Internet-enabled video cameras.

With the recent developments in the Internet of Things (IoT), the amount of data collected has expanded tremendously, resulting in a higher demand for data storage, computational capacity, and real-time processing capabilities. Cloud computing has traditionally played an important role in establishing IoT. However, fog computing has recently emerged as a new field complementing cloud computing due to its enhanced mobility, location awareness, heterogeneity, scalability, low latency, and geographic distribution. However, IoT networks are vulnerable to unwanted assaults because of their open and shared nature. As a result, various fog computing-based security models that protect IoT networks have been developed. A distributed architecture based on an intrusion detection system (IDS) ensures that a dynamic, scalable IoT environment with the ability to disperse centralized tasks to local fog nodes and which successfully detects advanced malicious threats is available. In this study, we examined the time-related aspects of network traffic data. We presented an intrusion detection model based on a two-layered bidirectional long short-term memory (Bi-LSTM) with an attention mechanism for traffic data classification verified on the UNSW-NB15 benchmark dataset. We showed that the suggested model outperformed numerous leading-edge Network IDS that used machine learning models in terms of accuracy, precision, recall and F1 score.

A problem with machine learning (ML) techniques for detecting intrusions in the Internet of Things (IoT) is that they are ineffective in the detection of low-frequency intrusions. In addition, as ML models are trained using specific attack categories, they cannot recognize unknown attacks. This article integrates strategies of cost-sensitive learning and multitask learning into a hybrid ML model to address these two challenges. The hybrid model consists of an autoencoder for feature extraction and a support vector machine (SVM) for detecting intrusions. In the cost-sensitive learning phase for the class imbalance problem, the hinge loss layer is enhanced to make a classifier strong against low-distributed intrusions. Moreover, to detect unknown attacks, we formulate the SVM as a multitask problem. Experiments on the UNSW-NB15 and BoT-IoT datasets demonstrate the superiority of our model in terms of recall, precision, and F1-score averagely 92.2%, 96.2%, and 94.3%, respectively, over other approaches., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.

Signature-based Intrusion Detection Systems (SIDS) play a crucial role within the arsenal of security components of most organizations. They can find traces of known attacks in the network traffic or host events for which patterns or signatures have been pre-established. SIDS include standard packages of detection rulesets, but only those rules suited to the operational environment should be activated for optimal performance. However, some organizations might skip this tuning process and instead activate default off-the-shelf rulesets without understanding its implications and trade-offs. In this work, we help gain insight into the consequences of using predefined rulesets in the performance of SIDS. We experimentally explore the performance of three SIDS in the context of web attacks. In particular, we gauge the detection rate obtained with predefined subsets of rules for Snort, ModSecurity and Nemesida using seven attack datasets. We also determine the precision and rate of alert generated by each detector in a real-life case using a large trace from a public webserver. Results show that the maximum detection rate achieved by the SIDS under test is insufficient to protect systems effectively and is lower than expected for known attacks. Our results also indicate that the choice of predefined settings activated on each detector strongly influences its detection capability and false alarm rate. Snort and ModSecurity scored either a very poor detection rate (activating the less-sensitive predefined ruleset) or a very poor precision (activating the full ruleset). We also found that using various SIDS for a cooperative decision can improve the precision or the detection rate, but not both. Consequently, it is necessary to reflect upon the role of these open-source SIDS with default configurations as core elements for protection in the context of web attacks. Finally, we provide an efficient method for systematically determining which rules deactivate from a ruleset to

Notwithstanding the predicted demise of signature-based network monitoring, it is still part of the bedrock of security operations. Rulesets are fundamental to the efficacy of Network Intrusion Detection Systems (NIDS). Yet, they have rarely been studied in production environments. We partner with a Managed Security Service Provider (MSSP) to gain more insight into the evolution of rulesets, the alerts that they trigger and the incidents that get investigated. We analyze a combined ruleset - including both commercial and proprietary rules - that consists of 130 thousand rules and was used to monitor hundreds of networks. We find that these rulesets keep growing over time but there is almost no overlap among them in terms of detection options or what indicators of compromise they contain. The combined ruleset triggered more than 62 million alerts and led to 150 thousand incident investigations by SOC analysts, though the vast majority of rules never triggered a single alert. We find that just 0.5% of all rules are responsible for more than 80% of the alerts and incidents and only 1.2% of all alerts were deemed to merit closer investigation. Of all incidents, 16% were labeled as false positives and 9% carried significant risk to the client organization. Independently of the type of rule, updating rules is a minor activity. Most rules are never modified and only a fraction is deleted, except for periodic purges in some sets. Seven in-depth interviews with rule developers corroborate the patterns we found in our analysis. Finally, we identify several rule management practices that influence rule and ruleset efficacy, such as supplementing commercial rules with your own and making rules as specific as possible., Organisation and Governance

The enormous amounts of data make it progressively difficult for a human to assign meaning to individual data points. For example, if several users are active on different devices in a computer network, all kinds of connections are registered: browsing websites, scrolling through social media, video calling with friends, and so on. However, these `human' labels are usually not stored by the computer. And, simply due to time restrictions, it is not possible for a cyber expert to give an interpretation to all the traffic. Fortunately, over the past decades, the field of data science has grown at lightning speed. Often Machine Learning (ML) is used to extract information from all kinds of data. ML includes mathematical algorithms that learn patterns in data and that can make predictions about it. Since a computer can perform calculations extremely much faster, huge datasets can be interpreted in considerably less time. Typically ML has difficulty recognising patterns of data that is has not been able to learn from before, though. People, however, are good at assigning meaning to deviating data points by using domain knowledge. Therefore, we investigate how we can combine human knowledge and computer power to arrive at better and understandable predictions. This thesis focuses on molding the symbiosis between human and machine. We consider the following three themes: Anomaly Detection, Model Evaluation and Active Learning. Anomaly detection algorithms are widely used within network intrusion detection, the field that deals with finding cyber attacks in network data. In Chapters 2 and 3, we apply algorithms to detect malicious points in, respectively, real cyber data and data with online aeroplane bookings that contain fraudulent reservations. First, we remove redundant or uninformative data features and create new variables by using domain knowledge and by combining or standardising other features. In addition, we demonstrate how we deal with unlabelled and partially la

Denial of Service (DoS) attacks and their distributed variant (DDoS) are major digital threats in today’s cyberspace. Defense mechanisms such as Intrusion Detection Systems aim at finding these and other malicious activities in network traffic. They predominantly use signature-based approaches to effectively detect intrusions. Unfortunately, constructing a database with signatures is very time-consuming and this approach can only find previously seen variants. Machine learning algorithms are known to be effective tools in detecting intrusions, but it has not been studied if they are also able to detect unseen variants. In this research, we study to what extent supervised learning algorithms are able to detect novel variants of application layer (D)DoS attacks. To be more precise, we focus on detecting HTTP attacks targeting a web server. The contributions of this research are as follows: we provide a procedure to create intrusion detection datasets combining information from the transport, network, and application layer to be directly used for machine learning purposes. We show that specific (D)DoS variants are successfully detected by binary classifiers learned to distinguish benign entries from another (D)DoS attack. Despite this result, we demonstrate that the performance of a classifier trained on detecting variant A and tested on finding variant B is not necessarily similar to its performance when trained on B and tested on A. At last, we show that using more types of (D)DoS attacks in the training set does not necessarily lead to a higher detection rate of unseen variants. Thus, selecting the right combination of a machine learning model with a (small) set of intrusions included in the training data can result in a higher novel intrusion detection rate.

Digital twins have recently gained significant interest in simulation, optimization, and predictive maintenance of Industrial Control Systems (ICS). Recent studies discuss the possibility of using digital twins for intrusion detection in industrial systems. Accordingly, this study contributes to a digital twin-based security framework for industrial control systems, extending its capabilities for simulation of attacks and defense mechanisms. Four types of process-aware attack scenarios are implemented on a standalone open-source digital twin of an industrial filling plant: command injection, network Denial of Service (DoS), calculated measurement modification, and naive measurement modification. A stacked ensemble classifier is proposed as the real-time intrusion detection, based on the offline evaluation of eight supervised machine learning algorithms. The designed stacked model outperforms previous methods in terms of F1Score and accuracy, by combining the predictions of various algorithms, while it can detect and classify intrusions in near real-time (0.1 seconds). This study also discusses the practicality and benefits of the proposed digital twin-based security framework, QC 20220630Part of proceedings: ISBN 978-166541647-4

Endpoint detection and response is an integral part of the security of large-scale networks. Embedded hardware, such as those found at Ericsson Radio Access Network endpoints, have strict performance requirements that need to be met. This fact makes implementing intrusion detection non-trivial, as intrusion detection software often generate a lot of processing overhead. Wazuh, an established open-source distributed and centralized intrusion detection and response system, shows a lot of promise as a large-scale intrusion detection system. It is very modular and has various capabilities that can be utilized in different ways to minimize processing overhead. One of these capabilities is native support for the native Linux syscall monitoring tool AuditD. While AuditD is very capable, it can introduce severe performance penalties in certain scenarios. Falco is another syscall monitoring tool that shows promise with regards to performance, and also has more features than AuditD; which is why Falco is included as a direct comparison to AuditD. This study evaluates Wazuh, AuditD, and Falco based on a set of requirements set by Ericsson, including flexibility, scalability and reliability, by enacting performance benchmarks with normal background operations active. The results of this study show that, with the correct configuration, Wazuh can be used as an intrusion detection system in embedded systems with limited hardware, where AuditD and Falco can serve as a great addition to detecting indicators of compromise. The solution is to use a minimal intrusion detection ruleset, and in the event of suspicious activity, activate more modules to increase threat detection at the cost of CPU overhead and execution time for normal system operation.

This thesis evaluates the performance of different machine learning approaches to log classification based on a dataset derived from simulating intrusive behavior towards an enterprise web application. The first experiment consists of performing attacks towards the web app in correlation with the logs to create a labeled dataset. The second experiment consists of one unsupervised model based on a variational autoencoder and four super- vised models based on both conventional feature-engineering techniques with deep neural networks and embedding-based feature techniques followed by long-short-term memory architectures and convolutional neural networks. With this dataset, the embedding-based approaches performed much better than the conventional one. The autoencoder did not perform well compared to the supervised models. To conclude, embedding-based ap- proaches show promise even on datasets with different characteristics compared to natural language.

Signature-based Intrusion Detection Systems (SIDS) play a crucial role within the arsenal of security components of most organizations. They can find traces of known attacks in the network traffic or host events for which patterns or signatures have been pre-established. SIDS include standard packages of detection rulesets, but only those rules suited to the operational environment should be activated for optimal performance. However, some organizations might skip this tuning process and instead activate default off-the-shelf rulesets without understanding its implications and trade-offs. In this work, we help gain insight into the consequences of using predefined rulesets in the performance of SIDS. We experimentally explore the performance of three SIDS in the context of web attacks. In particular, we gauge the detection rate obtained with predefined subsets of rules for Snort, ModSecurity and Nemesida using seven attack datasets. We also determine the precision and rate of alert generated by each detector in a real-life case using a large trace from a public webserver. Results show that the maximum detection rate achieved by the SIDS under test is insufficient to protect systems effectively and is lower than expected for known attacks. Our results also indicate that the choice of predefined settings activated on each detector strongly influences its detection capability and false alarm rate. Snort and ModSecurity scored either a very poor detection rate (activating the less-sensitive predefined ruleset) or a very poor precision (activating the full ruleset). We also found that using various SIDS for a cooperative decision can improve the precision or the detection rate, but not both. Consequently, it is necessary to reflect upon the role of these open-source SIDS with default configurations as core elements for protection in the context of web attacks. Finally, we provide an efficient method for systematically determining which rules deactivate from a ruleset to

Industrial Control Systems (ICS) monitor and control physical processes. The security of ICS has drawn the attention of many researchers since successful cyber-attacks against ICS can cause extensive damage in the physical world. Most of the existing literature describes solutions to protect an ICS against attacks directly targeting its underlying IT infrastructure. However, there are comparatively less works that focus on detecting cyber attacks against the physical process itself. Detection mechanisms that do so are said to be process aware. In this paper, we propose a time-based process aware intrusion detection system (IDS) that detects attacks against a physical process by leveraging its regular nature and temporal properties. The IDS learns the temporal behavior of the process variables and uses it to detect attacks. We evaluate the performance of our IDS on a public SCADA dataset and on a simulated SCADA system developed as part of this study, and we compare it with two other process-aware IDS proposed in the literature. The results show that our solution is able to detect attacks that are not detected by IDS that ignore temporal properties.

Signature-based Intrusion Detection Systems (SIDS) play a crucial role within the arsenal of security components of most organizations. They can find traces of known attacks in the network traffic or host events for which patterns or signatures have been pre-established. SIDS include standard packages of detection rulesets, but only those rules suited to the operational environment should be activated for optimal performance. However, some organizations might skip this tuning process and instead activate default off-the-shelf rulesets without understanding its implications and trade-offs. In this work, we help gain insight into the consequences of using predefined rulesets in the performance of SIDS. We experimentally explore the performance of three SIDS in the context of web attacks. In particular, we gauge the detection rate obtained with predefined subsets of rules for Snort, ModSecurity and Nemesida using seven attack datasets. We also determine the precision and rate of alert generated by each detector in a real-life case using a large trace from a public webserver. Results show that the maximum detection rate achieved by the SIDS under test is insufficient to protect systems effectively and is lower than expected for known attacks. Our results also indicate that the choice of predefined settings activated on each detector strongly influences its detection capability and false alarm rate. Snort and ModSecurity scored either a very poor detection rate (activating the less-sensitive predefined ruleset) or a very poor precision (activating the full ruleset). We also found that using various SIDS for a cooperative decision can improve the precision or the detection rate, but not both. Consequently, it is necessary to reflect upon the role of these open-source SIDS with default configurations as core elements for protection in the context of web attacks. Finally, we provide an efficient method for systematically determining which rules deactivate from a ruleset to

A Smart Campus is a protected area within Smart Cities (Cities 2.0) where physical security of assets is vital for the continuous operation of the university. Concretely, there are specific mission-critical areas on the campus, which should be protected from unauthorized and malicious individuals. This paper describes a sustainable Smart Campus system architecture based on individuals’ spatiotemporal authentication fingerprint, generated by fusing data from mobile GPS devices and CCTV cameras infrastructure to detect malicious user behavior. The system incorporates unobtrusive monitoring to collect data from such individuals. While the system monitors for unauthorized access to restricted locations within the campus area, data are analyzed by an intrusion detection algorithm that sets off alarms and prompts physical evacuation. The efficiency of the proposed system is evaluated by gauging the prediction accuracy of alarms triggered and response time to the actual incidents on the campus. Results are promising for the adoption of the proposed system architecture by universities in Cities 2.0.

The Internet of Things (IoT) is becoming related to more and more people's daily life. It is a network that consists of resource-constrained devices. Nowadays, the application of IoT like smart wearable devices is very common. Due to the wide and important application of IoT, its security also attracts research attention without any doubt. IoT networks are exposed to various attacks, so detecting attacks is necessary to enhance IoT security, which is achieved by Intrusion Detection Systems (IDS). To build an IDS, machine learning can be used as an efficient tool to train intrusion detection models. However, machine-learning methods often consume a lot of memory and computation resources, which inspires research on implementing machine-learning-based IDS on resource-constrained devices for IoT networks. This thesis aims to design and implement a machine-learning-based IDS for IoT networks. The target IoT devices are installed with an embedded operating system called Contiki. A large dataset of IoT networks is first created, which covers numerous network topologies. Then an intrusion detection classifier is trained using the Random Forests algorithm. The IDS is implemented by integrating the trained classifier with devices with the Contiki system. We perform experiments both in simulation and on real devices to evaluate the proposed IDS. The results show that our IDS works well on Contiki nodes in IoT networks. In experiments based on simulation, the detection accuracy always achieves over 92% under different setups. In the experiments on real resource-constrained devices, the IDS gets a detection accuracy of 100% in 15 different network topologies., Sakernas Internet (från engelskans Internet of Things, IoT) blir en del av allt fler människors vardag. Det är ett nätverk som består av resursbegränsade enheter. Numera är det mycket vanligt med tillämpningar av sakernas internet, t.ex. smarta bärbara enheter. På grund av den breda och viktiga tillämpningen av sakernas internet drar säkerheten i sakernas internet också till sig forskningens uppmärksamhet utan tvekan. IoT-nätverk utsätts för olika attacker, så det är nödvändigt att upptäcka attacker för att förbättra IoT-säkerheten, vilket uppnås med hjälp av intrångsdetekteringssystem (IDS). För att bygga ett IDS kan maskininlärning användas som ett effektivt verktyg för att träna intrångsdetekteringsmodeller. Maskininlärningsmetoder förbrukar dock ofta mycket minne och beräkningsresurser, vilket inspirerar till forskning om att genomföra maskininlärningsbaserade IDS på resursbegränsade enheter för IoT-nätverk. Syftet med denna avhandling är att utforma och genomföra en maskininlärningsbaserad IDS för IoT-nätverk. IoT-enheterna är installerade med ett inbäddat operativsystem som heter Contiki. Först skapas ett stort dataset av IoT-nätverk, som täcker många nätverkstopologier. Därefter tränas en klassificerare för intrångsdetektering med hjälp av Random Forests-algoritmen. IDS genomförs genom att integrera den tränade klassificeraren med enheter med Contiki-systemet. Vi utför experiment både i simulering och på riktiga enheter för att utvärdera den föreslagna IDS. Resultaten visar att vårt IDS fungerar bra på Contiki-noder i IoT-nätverk. I experiment baserade på simulering uppnår detektionsnoggrannheten alltid över 92% under olika inställningar. I experimenten på riktiga resursbegränsade enheter uppnår IDS en detektionsnoggrannhet på 100% i 15 olika nätverkstopologier.