Search

With the development of information technology, the number and methods of cyber attacks continue to increase, making network security issues increasingly important. Intrusion detection has become a vital means of dealing with cyber threats. Current intrusion detection methods predominantly rely on machine learning. However, machine learning suffers from limitations in detection capability and the requirement for extensive feature engineering. Additionally, current intrusion detection datasets face the challenge of data imbalance. To address these challenges, this paper proposes a novel solution leveraging Generative Adversarial Networks (GANs) to balance the dataset and introduces an attention mechanism into the generator to efficiently extract key feature information, the mechanism can effectively sort the key information of the data and quickly capture important features. Subsequently, a combination of 1D Convolutional Neural Networks (1DCNN) and Bidirectional Gated Recurrent Units (BiGRU) is employed to construct a classification model capable of extracting both spatial and temporal features. Furthermore, Particle Swarm Optimization (PSO) is utilized to optimize the input weights and hidden biases of the model, so as to further improve the accuracy and robustness of the model. Finally, the model is trained and implemented for network intrusion detection. To demonstrate the applicability of the model, experiments were conducted using the NSL-KDD dataset and the UNSW-NB15 dataset. The final results showed that the proposed model outperformed other models, achieving accuracies of 99.15% and 97.33% on the respective datasets. This indicates that the model improves the efficiency of network intrusion detection and better ensures the effectiveness of network security. [ABSTRACT FROM AUTHOR]

The rapid development of Internet of Things (IoT) technology has enabled the emergence of the Internet of Medical Things (IoMT), especially in body area network applications. To protect sensitive medical data, it is essential to ensure privacy preservation and detect intrusions in this context. This study proposes a novel intrusion detection system that protects the privacy of IoMT networks, specifically in the context of body area networks. For feature extraction, the system employs a recurrent U-Net autoencoder algorithm, which effectively captures temporal dependencies in IoMT data. In addition, privacy is protected through the combination of data anonymization techniques and data classification using Principal Component Analysis (PCA). Combining the recurrent U-Net autoencoder algorithm, privacy preservation mechanisms, and PCA-based data classification, the proposed system architecture comprises the U-Net autoencoder algorithm. The proposed method is superior to existing approaches in terms of accuracy, precision, recall, F-measure, and classification loss, as demonstrated by experimental evaluations. This research contributes to the field of privacy protection and intrusion detection in IoMT, specifically in body area network applications. [ABSTRACT FROM AUTHOR]

Intelligent Transportation Systems have become integral to daily life, with VANETs (vehicular ad-hoc networks) playing the pivotal role. VANETs, the subsets of MANETs, employ vehicles as nodes to establish intelligent transport systems. However, due to critical applications such as military use, these networks are susceptible to attacks. With features like high mobility, dynamic network topology, and coverage issues, security breaches are a concern. This necessitates a secure routing algorithm to mitigate attacks and ensure message delivery. In our study, we utilize the UNSW-NB15 intrusion detection dataset to develop training and testing models. Our proposed novel intrusion detection system employs a feature selection algorithm that prioritizes significant arriving traffic attributes. This algorithm enhances abnormal activity detection while minimizing associated features. To achieve this, we modify the Conditional Random Field algorithm with fuzzy-based rules, resulting in a more efficient selection of influential and contributing features for detecting attacks such as DoS, Worms, Fuzzers, and Shellcode. Through appropriate feature selection using the modified Conditional Random Field and Support Vector Machine classification system in our experiments, we demonstrate a notable increase in security by reducing the false positive rate. Additionally, our approach excels in detecting accuracy of Fuzzers (98.86%), DoS (98.80%), Worms (34.45%), and Shellcode (89.308%), ultimately enhancing network performance. These findings underscore the effectiveness of our proposed method in enhancing intrusion detection and overall network efficiency. [ABSTRACT FROM AUTHOR]

In the past couple of years, neural networks have gained widespread use in network security analysis. This type of analysis is usually performed in a nonlinear and highly correlated manner. Due to the immense amount of data traffic, the current models are prone to false alarms and poor detection. Deep-learning models can help security researchers identify and extract data features that are related to an attack. They can also minimize the data's dimensionality and detect intrusions. Unfortunately, the complexity of the network structure and hidden neurons of a deep-learning model can be set by error-prone procedures. In order to improve the performance of deep learning models, a new algorithm is proposed. This method combines a gradient boost regression and particle swarm optimization. The proposes a method called the Spark-DBN-SVM-GBR algorithm. The simulations conducted proposed algorithm revealed that it has a better accuracy rate than other deep learning models and the experiments conducted on the PSO-GBR algorithm revealed that it performed better than the current optimization technique when detecting unauthorized attack activities. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) is a strategy that leads the network via software by separating its control plane from the underlying forwarding plane. In support of a global digital network, multi-domain SDN architecture emerges as a viable solution. However, the complex and ever-evolving nature of network threats in a multi-domain environment presents a significant security challenge for controllers in detecting abnormalities. Moreover, multi-domain anomaly detection poses a daunting problem due to the need to process vast amounts of data from diverse domains. Deep learning models have gained popularity for extracting high-level feature representations from massive datasets. In this work, a novel deep neural network architecture, supervised learning based LD-BiHGA (Low Dimensional Bi-channel Hybrid GAN Attention) system is designed to learn class-specific features for accurate anomaly detection. Two asymmetric GANs are employed for learning the normal and abnormal network flows separately. Then, to extract more relevant features, a bi-channel attention mechanism is added. This is the first study to introduce an innovative hybrid architecture that merges bi-channel hybrid GANs with attention models for the purpose of anomaly detection in a multi-domain SDN environment that effectively handles real-time unbalanced data. The suggested architecture demonstrates its effectiveness on three benchmark datasets, achieving an average accuracy improvement of 7.225% on balanced datasets and 3.335% on imbalanced datasets compared to previous intrusion detection system (IDS) architectures in the literature. [ABSTRACT FROM AUTHOR]

Prediction of malicious attacks and monitoring of network behaviour is significant for providing security and mitigating the loss of credential information. In order to monitor network traffic and identify different types of attacks in the network, numerous existing algorithms have been provided for classifying unauthorized access from the authorized access. However, the traditional techniques have faced complications in satisfying the accuracy while making predictions of malicious activities. Detection accuracy have been addressed as a drawback which hinders in making appropriate identification of threats. In order to overcome such challenges, the proposed work is designed with effective IDS mechanism for detecting and classifying the attacks taken from the UNSW-NB15 and NSL-KDD dataset. IDS (Intrusion Detection System) implementation is accomplished with three stages such as pre-processing is the initial phase in which scaling re-sizing of all images to similar width and height. Process of checking missing values reduces the computational complexities and enhances accuracy. Second stage is the novel feature-selection process accomplished by E-GSS (Enhanced Genetic Sine Swarm Intelligence) for selecting significant and optimal features. Finally, classification is the final phase in which intrusion is classified using novel DMH-ANN (Deep Meta-Heuristics Artificial Neural Network) which is internally being compared to three classifiers such as RF (Random Forest), NB (Naïve Bayes) and XG-Boost (Extreme Gradient). Experimental evaluation is carried out with the performance metrics such as accuracy, precision and recall and compared with existing algorithms for exhibiting the effectiveness of the proposed model. The research outcome reveals its efficiency in detecting and classifying attacks with greater accuracy. [ABSTRACT FROM AUTHOR]

The Internet’s evolution resulted in a massive amount of data. As a result, the internet has become more sophisticated and vulnerable to massive attacks. The attack detection system is a key feature for system security in modern networks. The IDS might be signature-based or detect anomalous behavior. Researchers recently created several detection algorithms for identifying network intrusions in vehicular network security, but they failed to detect intrusions effectively. For this reason, the optimal Deep Learning approach, namely Political Fractional Dingo Optimizer (PFDOX)-based Deep belief network is introduced for attack detection in network security for vehicles. The Internet of Vehicle simulation is done initially, and then the input data is passed into the pre-processing phase, which removes noise present in the data. Then, the feature extraction module receives the pre-processed data. The Deep Maxout Network is trained using the Fractional Dingo optimizer (FDOX)is utilized to detect normal and abnormal behavior. Fractional calculus and Dingo optimizer (DOX) are combined to create the proposed FDOX. Finally, intruder/attack types are classified using the Deep Belief Network, which is tuned using the PFDOX. The PFDOX is created by the assimilation of the DOX, Fractional Calculus, and Political Optimizer (PO). The experimental result shows that the designed PFDOX_DBN for attack type classification offers a better result based on f-measure, precision, and recall with the values of 0.924, 0.916, and 0.932, for the CIC-IDS2017 dataset. [ABSTRACT FROM AUTHOR]

Hadoop is a big data processing system that enables the distributed processing of massive data sets across multiple computers using straightforward programming techniques. Hadoop has been extensively investigated in many attacks as a result of its growing significance in industry. A company may learn about the actions of invaders as well as the weaknesses of the Hadoop cluster by examining a significant quantity of data from the log file. In a Big Data setting, the goal of the paper is to generate an analytical classification for intrusion detection. In this study, Hadoop log files were examined based on assaults that were recorded in the log files. Prior to analysis, the log data is cleaned and improved using a Hadoop preprocessing tool. For feature extraction, the hybrid Improved Sparrow Search Algorithm with Mutual Information Maximization (H-ISSA-MIM). Then the CNN (Convolutional Neural Network) classifier will detect the intrusions. The implementation is performed using the MATLAB 2020a software. The performance metrics like accuracy, precision, F-score, recall, specificity, FPR, FNR are calculated for the proposed methodology and it is compared with the existing techniques like Decision Tree (DT), Principal Components Analysis (PCA)- K means, Long Short Time Memory (LSTM). The maximum value of accuracy finds out in the proposed method 98%. [ABSTRACT FROM AUTHOR]

A severe problem that regularly affects cloud systems are intrusions. Ignore how the expansion of Internet of Things (IoT) devices will result in enormous intrusions. To distinguish intrusions from authorized network activity, detection is a crucial procedure. An Enhanced Lion Optimization Algorithm (ELOA) is utilized in this research, IoT intrusion detection system. Intrusions are classified using the Deep Belief Network (DBN) and an SDN controller technique. The proposed ELOA-based Intrusion Detection System uses the optimal weight in DBN to train the neurons to categorize the data in a network as normal and attacked during the training phase. In the testing step that follows training, data from nodes are examined, and by contrasting the training results, they are categorized as normal and attacked data. By using the proposed ELOA and DBN algorithms, our intrusion detection system can successfully identify intrusions. Based on the creation of blacklists for detecting IoT intrusions, the (SDN) Software Defined Networking controller can effectively prohibit harmful devices. In order to demonstrate that the proposed ELOA finds network intrusions more successfully, its performance is compared to that of other existing techniques. The node sizes of the algorithms are run and evaluated for 1000, 2000, 3000, 4000, and 5000 respectively. At highest node 5000, the Proposed ELOA and DPN have precision, recall, f-score and accuracy becomes as 97.8, 96.22, 97.5 and 98.67 respectively. [ABSTRACT FROM AUTHOR]

Industrial Control Systems (ICS) are susceptible to threats or attacks, and even minor changes or manipulation could cause major damage to industrial operations. Industrial control system cybersecurity is vital owing to the severe negative effects it could have on the economy, the environment, people, and politics. Therefore, it's also crucial to design intrusion detection systems for industrial control systems. In this paper, an efficient intrusion detection system with clustered ensemble feature selection and a Multi-Level Modified Gated Recurrent Unit (M-GRU) classification model is proposed. This intrusion detection system with a general framework for clustered ensemble feature ranking approach is proposed to effectively find the best feature subset in network packet traffic data. The features designated are fed into a multi class classification algorithm Multi-Level Modified Gated Recurrent Unit (M-GRU) to efficiently detect the cyberattacks. Evaluation criteria including precision, accuracy, recall and F1 score are assessed and compared to other cutting-edge algorithms to assess the performance of the proposed model. The proposed model attained an average accuracy of 98.21 %. Results show that the suggested model increased the attack detection accuracy by an average of 5.935% and 0.116% when compared to the Gated Recurrent Unit, Long Short Term Memory, random forest and naïve bayes models. [ABSTRACT FROM AUTHOR]

Intrusion detection systems have become one of the important tools for network security due to the frequent attacks brought about by the explosive growth of network traffic. Autoencoder is an unsupervised learning model with a neural network structure. It has a powerful feature learning capability and is effective in intrusion detection. However, its network construction suffers from overfitting and gradient disappearance problems. Traditional granular computing methods have advantages in solving such problems, but the process is relatively complex, the granularity dimension is high, and the computational cost is large, which is not suitable for application in intrusion detection systems. To address these problems, we propose a novel autoencoder: Granular AutoEncoders (GAE). The granulation reference set is constructed by random sampling. The granulation of training samples is based on single-feature similarity in a reference set to form granules. The granulation of multiple features results in granular vectors. Some operations of granules are defined. Furthermore, we propose some granular measures, including granular norms and granular loss functions. The GAE is further applied to the field of intrusion detection by designing an anomaly detection algorithm based on the GAE. The algorithm determines whether the network flows are anomalous by comparing the difference between an input granular vector and its output granular vector that is reconstructed by the GAE. Finally, some experiments are conducted using an intrusion detection dataset, comparing multiple metrics in terms of precision, recall, and F1-Score. The experimental results validate the correctness and effectiveness of the intrusion detection method based on GAE. And contrast experiments show that the proposed method has stronger ability for detecting anomalies than the correlation algorithms. [ABSTRACT FROM AUTHOR]

Intrusion detection systems (IDS) can be used to detect irregularities in network traffic to improve network security and protect data and systems. From 2.4 times in 2018 to three times in 2023, the number of devices linked to IP networks is predicted to outnumber the total population of the world. In 2020, approximately 1.5 billion cyber-attacks on Internet of Things (IoT) devices have been reported. Classification of these attacks in the IoT network is the major objective of this research. This research proposes a hybrid machine learning model using Seagull Optimization Algorithm (SOA) and Extreme Learning Machine (ELM) classifier to classify and detect attacks in IoT networks. The CIC-IDS-2018 dataset is used in this work to evaluate the proposed model. The SOA is implemented for feature selection from the dataset, and the ELM is used to classify attacks from the selected features. The dataset has 80 features, in the proposed model used only 22 features with higher scores than the original dataset. The dataset is divided into 80% for training and 20% for testing. The proposed SOA-ELM model obtained 94.22% accuracy, 92.95% precision, 93.45% detection rate, and 91.26% f1-score. [ABSTRACT FROM AUTHOR]

The objective of the research work is to propose an intrusion detection system in a cloud environment using K-Means clustering-based outlier detection. In the open access and dispersed cloud architecture, the main problem is security and confidentiality because these are easily susceptible to intruders. Intrusion Detection System (IDS) is a commonly used method to identify the various attacks on the cloud which is easy to access from a remote area. The existing process can't provide the data to transmit securely. This work describes and notifies the modernly established IDS and alarm management methods by giving probable responses to notice and inhibit the intrusions in the cloud computing environment and to overcome the security and privacy issue. Proposed K-means Clustering based Outlier Detection (KmCOD) is used to detect the intruders and efficiently secure the data from malicious activity, where it is formulated respectively to increase the trustworthiness of the system by using applying intrusion detection techniques to virtual machines thus keeping the system safe and free from intrusion also provides system reliability. The parametric measures such as the detection rate, trace preprocessing, and correctly identified and incorrectly identified malicious activity are chosen. The performance analysis shows the accuracy of outlier detection as 81%, detection rate achieves 76%, packet arrival rate reaches 79%, pre-processing trace achieves 74%, and malicious activity rate of 21%. [ABSTRACT FROM AUTHOR]

In today's world, a Network Intrusion Detection System (NIDS) plays a vital role in order to secure the Wireless Sensor Network (WSN). However, the traditional NIDS model faced critical constraints with network traffic data due to growth in the complexity of modern attacks. These constraints have a direct impact on the overall performance of the WSN. In this paper, a new robust network intrusion classification framework based on the enhanced Visual Geometry Group (VGG-19) pre-trained model has been proposed to prolong the performance of WSN. Primarily, the pre-trained weights from the ImageNet dataset are utilized to train the parameters of the VGG-19. Afterward, a Hybrid Deep Neural Network based on Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) will be employed to extract the influential features from network traffic data to enlarge the intrusion detection accuracy. The proposed VGG-19 + Hybrid CNN-LSTM model exploits both binary classification and multi-classification to classify attacks as either normal or attacked. A network intrusion benchmark dataset is used to assess the performance of the suggested system. The results reveal that the proposed VGG-19 + Hybrid CNN-LSTM learning system surpasses other pre-trained models with a superior accuracy of 98.86% during the multi-classification test. [ABSTRACT FROM AUTHOR]

Intrusion attack is considered as the major concerns to be focussed in wireless sensor network which should be seriously viewed for identification of secure and trustworthy information processing. The various characteristics involved in Intrusion attacks should be adapted precisely since it impacts on result of the intrusion detection in terms of accuracy. PCA-based centralized approach (PCACID) and Knowledge based Intrusion Detection Strategy (KBIDS) is suggested in this research for achieving the accurateintrusion detection. Though KBIDS is involved in achieving accurate detection, the demerit is that time complexity and computational overhead are progressively more which in turn influences on the entire network performance. Traffic Variation based Intrusion Detection System (TV-IDS) plays a major role in mitigating these issues. In addition to it, Fuzzy based mean shift clustering is also suggested for incorporating clustering feature process which influences precise clustering result with the advantage of less time complexity. The decision classifier takes its role after the assessment of data points bias variations. This variation factor helps in recognizing smaller traffic variation and not determined as irregular data. The classification is achieved by hybrid genetic neuro fuzzy classifier. The updating of ANFIS weight values is accomplished concurrently with optimal selection by means of genetic algorithm. The optimal route path is chosen by greatly utilizing the artificial bee colony algorithm. The various fitness parameters involved in this research are energy level of nodes, bandwidth, etc., for efficient data transmission successfully. MATLAB simulation platform is greatly utilized for assessment of overall results for validating that proposed TV-IDS achieves improved outcomes comparatively. [ABSTRACT FROM AUTHOR]

In order to solve the problem that the population diversity of sparrow search algorithm (SSA) decreases and easily falls into the local optimal solution when it approaches the global optimal, an artificial immune algorithm-sparrow search algorithm (AIA-SSA) is proposed in this paper by combining artificial immune algorithm and sparrow search algorithm. This paper uses 10 benchmark functions for experimental simulation of AIA-SSA algorithm, and compares it with five widely used intelligent algorithms and SSA. Experimental results show that AIA-SSA overcomes the deficiency of SSA and improves the search accuracy, convergence speed and stability of the algorithm. Meanwhile, this paper applies AIA-SSA to network intrusion detection and constructs a network intrusion detection model based on support vector machine (SVM). After testing, the accuracy of AIA-SSA-SVM prediction for various network attacks has been greatly improved. It not only shows that AIA-SSA-SVM has a broad application prospect in the field of network security, but also verifies the feasibility and advanced nature of AIA-SSA in solving practical engineering problems. [ABSTRACT FROM AUTHOR]

The Wireless Sensor Networks (WSNs) contain a significant quantity of sensor nodes that computes and communicates for data transmission. The data packet sensed and transmitted contains various cross layer feature set that includes many important information. Many essential aspects, which include storage capability, consumption of energy, and, computational power should be taken into account while dealing with the data packets. On the other hand, many past researchers have carried out their work in order to detect intrusion utilizing cross-layer packets but fail in detecting them at the same time. Cross-layer and feature selection techniques play a key role in building an efficient Intrusion Detection System (IDS). An advantage of using the cross-layer technique is to achieve a higher correlation among different layers of the protocol so that one layer can use the parametric information of the other layer by breaking the traditional layer barriers. In this work, we propose a cross-layer based multi-feature selection model for intrusion detection in WSNs. Firstly, an optimized multi-feature selection algorithm is proposed for selecting efficient and useful features from the cross-layered architecture of the network. Secondly, a multi class intrusion detection model is proposed for the classification of different cross-layer based intrusion in the network. The proposed algorithm is developed for providing total security to cross-layer based networks by selecting prominent features and detecting intrusion at the same time. The simulation results are utilizing on real-time intrusive data from the network by analyzing the proposed model. [ABSTRACT FROM AUTHOR]

Industrial Wireless Sensor Network (IWSN) includes numerous sensor nodes that collect data about target objects and transmit to sink nodes (SN). During data transmission among nodes, intrusion detection is carried to improve data security and privacy. Intrusion detection system (IDS) examines the network for intrusions based on user activities. Several works have been done in the field of intrusion detection and different measures are carried out to increase data security from the issues related to black hole, Sybil attack, Worm hole, identity replication attack and etc. In various existing approaches, secure data transmission is not achieved, therefore resulted in compromising the security and privacy of IWSNs. Accurate intrusion detection is still challenging task in terms of improving security and intrusion detection rate. In order to improve intrusion detection rate (IDR) with minimum time, generalized Frechet Hyperbolic Deep and Dirichlet Secured (FHD-DS) data communication model is introduced. At first, Frechet Hyperbolic Deep Traffic (FHDT) feature extraction method is designed to extract more relevant network activities and inherent traffic features. With the help of extracted features, anomalous or normal data is predicted. Followed by Statistical Dirichlet Anomaly-based Intrusion Detection model is applied to discover intrusion. Here, Dirichlet distribution is evaluated to attain secure data transmission and significantly detect intrusions in WSNs. Experimental evaluation is carried out with KDD cup 99 dataset on factors such as IDR, intrusion detection time (IDT) and data delivery rate (DDR). The observed results show that the generalized FHD-DS data communication method achieves higher IDR with minimum time. [ABSTRACT FROM AUTHOR]

With the spread of the COVID-19 epidemic, the government has put forward higher requirements for network security and reliability through the flow of network managers and the release of information. Traditional intrusion detection technology and firewall technology cannot effectively defend against DDoS attacks. This paper analyzes the principles and defects of intrusion detection system and firewall. In this paper, the architecture design of intrusion prevention system which integrates audit and network defense functions is proposed. The system optimizes the detection and analysis component of detecting attack behavior according to the special requirements of attack defense task, and adds the module of attack behavior characteristic analysis and defense strategy generation. The policy execution component uses a special defense engine to execute defense policies, providing the system with deep defense capabilities. Experiments show that the validity and reliability of the key modules in the proposed defense model meet the technical requirements. It has a certain reference value to improve the reliability of network management system under the influence of COVID-19 epidemic situation. [ABSTRACT FROM AUTHOR]

Although much less fatal than the Ebola and previous SARS virus epidemics, the current coronavirus outbreak (COVID-19) has spread to more people in more countries in a much shorter time frame. With the rapid development of the Internet of things, it has played an important role to track/monitor transmission movements throughout the population. The technology infrastructure between mobile devices, wearable devices and sensors, smart home device makes it possible to readily deploy solutions to monitor and collect data and perform analysis to ensure policy make intelligent, rapid decisions. This research combines AOL and Support Vector Machine to form the Internet of things cycle through smart home. The parameters of Support Vector Machine model are optimized by ALO algorithm, which shortens the learning time and improves the performance of classifier. Then, the algorithm of ALO is used to optimize the Support Vector Machine intrusion detection method and agent technology, and the intrusion detection model is established. Experimental results show that the combination of these two can effectively reduce the false alarm rate of network intrusion. [ABSTRACT FROM AUTHOR]

With the continuous progress of social science and technology, the development of the Internet of things is growing. With the development of Internet of things, security problems emerge in endlessly. During the period of COVID-19, the Internet of Things have been widely used to fight virus outbreak. However, the most serious security problem of the Internet of things is network intrusion. This paper proposes a balanced quadratic support vector machine information security analysis method for Internet of things. Compared with the traditional support vector machine Internet of things security analysis method, this method has a higher accuracy, and can shorten the detection time, with efficient and powerful characteristics. The method proposed in this paper has certain reference value to the Internet of things network intrusion problem. It provides better security for the Internet of things during the protection period of covid-19. [ABSTRACT FROM AUTHOR]

While internet technologies have been evolving day by day, threats against them have been increasing with the same pace. One of the most serious and commonly executed attack type is Distributed Denial of Service (DDoS) attacks. Despite there are many security mechanisms against this type of attack, there is still need for new solutions due to the occurred DDoS attacks worldwide. In this work, a DDoS attack detection approach based on fuzzy logic and entropy is proposed. Network is modelled as a graph and graph-based features are used for discriminating attack traffic from attack-free traffic. Fuzzy-c-means clustering is applied based on these features in order to show the tendencies of IP addresses or port numbers to be in a same cluster or not. Based on this uncertainty, attack and attack-free traffic are modelled. In detection phase, fuzzy membership function is used. This algorithm is tested on the real data collected from Bogaziçi University network. [ABSTRACT FROM AUTHOR]

While internet technologies have been evolving day by day, threats against them have been increasing with the same pace. One of the most serious and commonly executed attack type is Distributed Denial of Service (DDoS) attacks. Despite there are many security mechanisms against this type of attack, there is still need for new solutions due to the occurred DDoS attacks worldwide. In this work, a DDoS attack detection approach based on fuzzy logic and entropy is proposed. Network is modelled as a graph and graph-based features are used for discriminating attack traffic from attack-free traffic. Fuzzy-c-means clustering is applied based on these features in order to show the tendencies of IP addresses or port numbers to be in a same cluster or not. Based on this uncertainty, attack and attack-free traffic are modelled. In detection phase, fuzzy membership function is used. This algorithm is tested on the real data collected from Bogaziçi University network. [ABSTRACT FROM AUTHOR]

The rise of the cloud computing model has resulted in more than terabytes of data being stored in the cloud platform every day on the Internet. Mining valuable information from these massive data has become an emerging industry direction, but the current Intrusion-detection system (IDS) has been unable to adapt to large-scale log information mining. Therefore, an association rule mining algorithm based on MapReduce parallel computing framework is proposed. Firstly, the frequent itemsets mining algorithm Apriori is analyzed, and the MapReduce model is used to parallelize and improve it to more efficiently complete the mining of frequent itemsets. Secondly, the parallel Apriori is designed to run on IDS. Finally, the simulation experiment was carried out by building an open source cloud computing framework Hadoop cluster. Finally, the simulation experiment was carried out by building an open source cloud computing framework Hadoop cluster. The results show that the proposed method has higher detection efficiency when processing massive data, and requires less processing time. [ABSTRACT FROM AUTHOR]

Intrusion detection systems (IDSs) play an important point in resisting hacker intrusion. With the rapid development of the network technology, network security has received more and more attention from researchers of different fields, and the traditional network security system based on the regular intrusion detection rules cannot meet the growing demand of changeable and timely intrusion prevention. Therefore, the development of efficient IDSs always is an open challenge. Firstly, a novel intrusion detection method based on the Convolutional Neural Network (CNN) is proposed in this paper. Secondly, based on the proposed method, an efficient, real-time and automated intrusion detection system named IDS-CNN is well designed. The system is built by several open source tools, such as the packet capture interface Tcpdump, the traffic analysis Bro and the machine learning interface Tensorflow. The system is composed of data preprocessing, neural network training, network testing and intrusion response based on Linux platform. Finally, through the simulation experiment with NSL-KDD data set and the actual network flow test, the experimental results indicate that the proposed IDS-CNN system can not only complete the intrusion detection for network data streams efficiently, but also its detection precision is better than the state-of-the-art method. [ABSTRACT FROM AUTHOR]

The information network itself has the characteristics of vulnerability, and the information network is facing more and more threats. The existence of these two factors is the main reason for the frequent discovery of information network security problems. Network security depends on the development of information technology. Only the independent and controllable technology can obtain a safe and stable development space. However, network security is the premise of the development of information technology, so we can't go ahead blindly without considering the cost and cost for the development. In the face of safety and risk, we should master a balance point, and take multiple measures such as management, technology and system to control the safety risk in a controllable range. This paper analzye the information network security construction based on depth learning and modulus algorithm. The improved algorithm can be stably controlled within 0.007s in training time. Moreover, as the training difficulty increases, the training time will gradually increase, but the change is not obvious, and the overall tends to be stable. By training neural network with the selected instance and make its maximum close to real system working model or network attack model, thus the input to any of its monitoring data to be able to make quite the right judgment. [ABSTRACT FROM AUTHOR]

With the increasingly growing internal and external attacks on computer systems and online services, cybersecurity has become a vibrant research area. Countering intrusive attacks is a daunting task with no universal magic solution that can successfully handle all scenarios. A variety of machine-learning and computational intelligence techniques have been applied extensively to detect and classify these attacks. However, the effectiveness of these techniques greatly depends on the adopted data preprocessing methods for feature extraction and engineering. This paper presents an extended taxonomy of the work related to intrusion detection and reviews the state-of-the-art techniques for data preprocessing. It offers a critical up-to-date survey which can be an instrumental pedagogy to help junior researchers conceive the vast amount of research work and gain a holistic view and awareness of various contemporary research directions in this domain. [ABSTRACT FROM AUTHOR]

Without an iota of doubt, security, safety, and privacy are the most critical aspects of any Industrial Internet of Things (IIoT) environment. Among the existing intrusion detection methods, knowledge-based methods discover only the recognized attacks, the behavior-based methods suffer from high false positives, and specification-based methods demand the complete knowledge about the elements present in the IIoT environment. Examining the heterogeneous data from different and distributed sensors and sending the correct commands to actuators are vital to the increasingly industrialized economy. This work proposes an Intrusion Detection System (IDS) for the IIoT environment that combines both the anomaly and specification-based approaches. The resulting system overcomes the limitations of the contemporary techniques by detecting unidentified attacks. All kinds of data emanating from any IIoT setup comprising sensors and actuators are logged, and specification rules are constructed from it. Any violations of the created rules are treated as attacks. The validation is carried out through simulation using the Mininet tool with the dataset obtained from the real-world water treatment facility at the Singapore University of Technology and Design (SUTD). The results show only 3.2% of false positives with the detection rate of 96.4%. [ABSTRACT FROM AUTHOR]

Cloud Security is of paramount importance in the new era of virtualization technology. Tenant Virtual Machine (VM) level security solutions can be easily evaded by modern attack techniques. Out-VM monitoring allows cloud administrator (CA) to monitor and control a VM from a secure location outside the VM. In this paper, we propose an out-VM monitoring based approach named as 'Program Semantic-Aware Intrusion Detection at Network and Hypervisor Layer' (PSI-NetVisor) to detect attacks in both network and virtualization layer in cloud. PSI-NetVisor performs network monitoring by employing behavior based intrusion detection approach (BIDA) at the network layer of centralized Cloud Network Server (CNS); providing the first level of defense from attacks. It incorporates semantic awareness in the intrusion detection approach and enables it to provide network monitoring and process monitoring at the hypervisor layer of Cloud Compute Server (CCoS); providing the second level of defense from attacks. PSI-NetVisor employs Virtual Machine Introspection (VMI) libraries based on software break point injection to extract process execution traces from hypervisor. It further applies depth first search (DFS) to construct program semantics from control flow graph of execution traces. It applies dynamic analysis and machine learning approaches to learn the behavior of anomalies which makes it secure from obfuscation and encryption based attacks. PSI-NetVisor has been validated with latest intrusion datasets (UNSW-NB & Evasive Malware) collected from research centers and results seem to be promising. [ABSTRACT FROM AUTHOR]

This paper presents a cascade of ensemble-based artificial neural network for multi-class intrusion detection (CANID) in computer network traffic. The proposed system learns a number of neural-networks connected as a cascade with each network trained using a small sample of training examples. The proposed cascade structure uses the trained neural network as a filter to partition the training data and hence a relatively small sample of training examples are used along with a boosting-based learning algorithm to learn an optimal set of neural network parameters for each successive partition. The performance of the proposed approach is evaluated and compared on the standard KDD CUP 1999 dataset as well as a very recent dataset, UNSW-NB15, composed of contemporary synthesized attack activities. Experimental results show that our proposed approach can efficiently detect various types of cyber attacks in computer networks. [ABSTRACT FROM AUTHOR]

Cloud computing inherits all the systems, networks as well asWeb Services' security vulnerabilities, in particular for software as a service (SaaS), where business applications or services are provided over the Cloud as Web Service (WS). Hence, WS-based applications must be protected against loss of integrity, confidentiality and availability when they are deployed over to the Cloud environment. Many existing IDP systems address only attacks mostly occurring at PaaS and IaaS. In this paper, we present our fuzzy association rule-based (FAR) and fuzzy associative pattern-based (FAP) intrusion detection and prevention (IDP) systems in defending against WS attacks at the SaaS level. Our experimental results have validated the capabilities of these two IDP systems in terms of detection of known attacks and prediction of newvariant attacks with accuracy close to 100%. For each transaction transacted over the Cloud platform, detection, prevention or prediction is carried out in less than five seconds. For load and volume testing on the SaaS where the system is under stress (at a work load of 5000 concurrent users submitting normal, suspicious and malicious transactions over a time interval of 300 seconds), the FAR IDP system provides close to 95% service availability to normal transactions. Future work involves determining more quality attributes besides service availability, such as latency, throughput and accountability for a more trustworthy SaaS. [ABSTRACT FROM AUTHOR]

Wireless networks are increasingly overwhelmed by Distributed Denial of Service (DDoS) attacks by generating flooding packets that exhaust critical computing and communication resources of a victim's mobile device within a very short period of time. This must be protected. Effective detection of DDoS attacks requires an adaptive learning classifier, with less computational complexity, and an accurate decision making to stunt such attacks. We propose a distributed intrusion detection system called Cooperative IDS to protect wireless nodes within the network and target nodes from DDoS attacks by using a Cooperative Fuzzy Q-learning (Co-FQL) optimization algorithmic technique to identify the attack patterns and take appropriate countermeasures. The Co-FQL algorithm was trained and tested to establish its performance by generating attacks from the NSL-KDD and 'CAIDA DDoS Attack 2007' datasets during the simulation experiments. Experimental results show that the proposed Co-FQL IDS has a 90.58% higher accuracy of detection rate than Fuzzy Logic Controller or Q-learning algorithm or Fuzzy Q-learning alone. [ABSTRACT FROM AUTHOR]

In security environments many complicated and interrelated software elements, such as firewalls, network scanners, event distributors and authentication tools, should work cooperatively. The proposed model consists of Multiagent Intrusion Detection System (MIDS) for gathering attack information. It provides a software environment that can afford a generalization/specialization process in order to accomplish attack abstraction. Such a model is designed to detect attacks of several protocols, such as Port Activity, SMTP, HTTP, and FTP. The system changes can be obtained by applying an appropriate security auditing policy. As such MIDS includes four agents; 1) Signature Agent (SA), 2) Network Events Agent (NEA), 3) Vulnerability Scan Agent (VSA) and 4) Intrusion Detection Agent (IDA). These agents are running on each host to be monitored. [ABSTRACT FROM AUTHOR]