Search

With the rapid evolution of mobile malware, especially Android malware, machine learning (ML)-based Android malware detection systems have drawn massive attention. Although ML algorithms have recently led to many vital breakthroughs in malware detection, they are still particularly vulnerable to adversarial example (AE) attacks. By applying small random perturbations (e.g. simply modifying different kinds of features from the application’s manifest file), an AE attack can cause the misclassification of legitimate applications. This paper proposes AAGAN, an automated Android malware generation system based on Generative Adversarial Networks (GAN) that can successfully deceive current ML detectors. Our experiment results indicate that AEs generated by our system can flip the prediction of the state-of-the-art detection algorithms in 99% of cases using a real-world dataset. To defend against AE attacks, we improve the robustness of our detection system by alternatively retraining with these newly generated AEs. Surprisingly, after retraining five times, AAGAN can achieve an 89% success rate in bypassing our malware detection system.

Intrusion Detection Systems (IDS) have garnered escalating significance in response to the evolving landscape of cyberattacks, driven by the adaptability and versatility of Software Defined Networking (SDN)-based networks in enhancing security orchestration. Although Machine Learning (ML) models have been developed for IDS, they require large amounts of labeled data to achieve high performance. However, acquiring labels for attacks is a time-consuming process and can cause problems in deploying the existing ML models in new systems or lower performance due to a shortage of labeled data on pre-trained datasets. Additionally, such ML-based IDS models lack the self-learning function to automatically adapt to new cyberattacks during network operations. To overcome these challenges, our work proposes Fed-Evolver, an automated evolving approach for federated IDS that combines Generative Adversarial Networks (GANs) with Auto Encoder (AE) and a semi-supervised adversarial Autoencoder (SSAAE) for spotting intrusion actions. Our Fed-Evolver leverages supervised and unsupervised learning strategies to build efficient IDS models in the context of labeled data scarcity with the help of Federated Learning (FL). It allows data owners to collaborate for training intrusion detection models to provide the self-evolving capability in SDN-enabled networks. Our proposed framework is evaluated on 6 cyberattack datasets, including CICIDS2018, CIC-ToN-IoT, NF-UNSW-NB15, InSDN, InSecLab-IDS2021, DNP3 Intrusion Detection, and it outperforms other ML methods even when trained with only 1% proportion of labeled data, achieving consistently high performance across all metrics on the datasets.

In the development of the Industrial Internet of Things (IIoT), cyber threats and attacks have become major issues and concerns in Industry 4.0 due to the negative impacts on the infrastructures and services across organizations. Nevertheless, due to the issues in preserving privacy and transparency, there is a lack of threat intelligence sharing among parties, leading to the low performance in uncovering malicious actors. In fact, the method of gathering and exploiting such data has been getting more crucial in a trend of machine learning (ML) adoption in cybersecurity. In this scenario, Federated Learning (FL) can assume a significant role in constructing an ML-based threat hunting solution for IIoT networks. This can be achieved by harnessing data resources from diverse parties, utilizing a local training strategy that eliminates the need for centralized data collection. Hence, this paper proposes FedChain-Hunter, a blockchain and FL-based threat-hunting framework to mutually seek cyber threats while ensuring data privacy and the transparency in the contribution of data owners. Specifically, Software Defined Networking (SDN) with programmable and flexible security orchestration is used to easily monitor and gather appropriate security events in the IIoT network. In addition, the Fully Homomorphic Encryption (HE) and Differential Privacy (DP) are integrated into the FL scheme to provide strong security and privacy-preserving aggregation for each ML model update. Also, the blockchain adoption offers the transparency, auditability for collaboration and contribution management through a decentralized platform. The experimental results on 5 datasets indicate that FedChain-Hunter can achieve high performance for cyber threat detection with security, reliability, and privacy guarantee.