Search

Improving traffic safety is considered as one of the most important tasks by many countries, and current solutions are not very effective due to the human factor. There are 30,000 deaths and 2.2 million injuries caused by car accidents each year just in the US alone. Many of these accidents are due to the lack of sufficient traffic information and slow driver reaction. Vehicular ad hoc networks (VANETs) is a peer-to-peer communication protocol designed to improve traffic safety. In order to achieve this, cars communicate with each other over a wireless channel exchanging information such as their current speeds, locations, heading angles, brake system statuses, etc. VANETs help collect traffic information more accurately and from a much wider area than drivers. Autonomous driving eliminates the human factor, which will prevent traffic accidents more effectively. Autonomous vehicles are expected to be on the market in 2020. VANET will be used by these cars since it decreases the dependency on expensive sensors, thus making the deployment of autonomous vehicles easier and faster. The accurate traffic information collected using VANETs from a wide area will provide highly effective collision avoidance tools in these autonomous vehicles. However, these benefits are counterbalanced by possible security attacks. Researchers showed that computers inside these vehicles can be compromised; as a result, attackers can take full control of them. Similar to Internet botnets, we can expect that attackers will organize these vehicles into vehicular botnets. We demonstrate the particular dangers of this threat by designing vehicular botnets that consist of these compromised autonomous cars. Existing research into security problems with autonomous vehicles cannot properly cope with our vehicular botnets since they fail to consider the possibility of cooperative malicious cars.This dissertation investigates the potential uses of vehicular botnets, how they can be organized and controlled, and how we might detect and defend against them. We discuss how an attacker who controls a number of vehicles can organize them into a botnet using the current VANET infrastructure. We demonstrate three powerful attacks performed by our vehicular botnets. We then present our detection mechanism to find vehicular botnets, discuss possible approaches to evict them from the network, and the effect of their eviction. Our work is the first that ever proposed and designed vehicular botnets in the literature. The evaluation of our work is solely through simulations since experimenting with real autonomous vehicles is impractical and dangerous.

Detecting outliers in real-time is increasingly important for many real-world applications such as detecting abnormal heart activity, intrusions to systems, spams or abnormal credit card transactions. However, detecting outliers in data streams rises many challenges such as high-dimensionality, dynamic data distribution and unpredictable relationships. Our simulations demonstrate that some advanced solutions still show drawbacks. In this paper, first, we improve the capacity to detect outliers of both micro-clusters based algorithms (MCOD) and distance-based algorithms (Abstract-C and Exact-Storm) known for their performance. This is by adding a layer called LiCS that classifies online the K-nearest-neighbors (Knn) of each node based on their evolutionary status. This layer aggregates the results and uses a count threshold to better classify nodes. Experiments on SpamBase datasets confirmed that our technique enhances the accuracy and the precision of such algorithm and helps to reduce the unclassified nodes.Second, we propose a hybrid solution based on iterative majority voting and our LiCS. Experiments on real data proves that it outperforms discussed algorithms in terms of accuracy, precision and sensitivity in detecting outliers. It also minimizes the issue of unclassified instances and consolidate the different outputs of algorithms.

Intrusion detection acts as a vital function in providing information security, and additionally the key technology is to precisely classify diverse attacks. Intrusion detection system (IDS) is identified as an important security issue within the cloud network environment. In this paper, IDS is given based on an innovative optimized custom RC-NN (Recurrent Convolutional Neural Network) which is proposed for intrusion detection along with the Ant Lion optimization algorithm. By this method, CNN (Convolutional Neural Network) is made hybrid with LSTM (Long Short Term Memory). Thus, all the attacks identified with the network layer of cloud are classified efficiently. The experimental results shown below describe the presentation of the IDS classification model with high accuracy, thus improving the detection rate or error rate. The optimized custom RC-NN-IDS model thus achieved an improved classification accuracy of 94% and also a decreased error rate of 0.0012. Additionally true positive rate, true negative rate and precision are considered as performance metrics. The proposed approach is evaluated using the DARPA IDS evaluation Data Sets and CSE-CIC-IDS2018 dataset and is compared with some existing approaches.

The Industrial Internet of Things (IIoT) has become very popular in recent years. However, IIoT is still an attractive and vulnerable target for attackers to exploit and experiment with different types of attacks. To confront this problem, the research community began exploring novel systems to protect the network. However, there are concerns related to some of theses systems regarding the increasing levels of required human interaction, which impact their efficiency. Recently, machine learning techniques are gaining much interest in security applications as they exhibit fast processing capabilities with real-time predictions. One of the significant challenges in the implementation of these techniques is the available training data for each new potential attack category, which is most of the time, unfeasible. Hence, these techniques might suffer from low detection rates for the attacks with relatively small training data (minority classes). In this article, we propose a novel algorithm based on machine learning to alleviate the class imbalance problem by computing an optimized weight for each machine learning-based decision. In particular, a supervised machine learning algorithm is first used to classify the attack categories for each node. The decisions made by the machine learning classifier are then stored in a private database. A specially designed best effort iterative weighted attack classification algorithm exploits this collected data to enhance the accuracy of the rarely detectable attack types. For each class, the weight that maximizes the diagonal to maximum ratios of the confusion matrix is iteratively computed. Such approach is shown to enhance the overall classification performance and detection accuracy even for the rarely detectable classes. Both the UNSW and NSL-KDD datasets are used in this article to validate the proposed model and verify its efficiency in detecting intrusions. The simulation results show that the proposed model can effectively detect intrusion attacks with a higher detection rate and the lowest false alarm rate compared to the state-of-the-art techniques. 2007-2012 IEEE. Qatar Foundation;Qatar National Research Fund Scopus

Targeted cyber attacks, which today are known as Advanced Persistent Threats (APTs), use low and slow patterns to bypass intrusion detection and alert correlation systems. Since most of the attack detection approaches use a short time-window, the slow APTs abuse this weakness to escape from the detection systems. In these situations, the intruders increase the time of attacks and move as slowly as possible by some tricks such as using sleeper and wake up functions and make detection difficult for such detection systems. In addition, low APTs use trusted subjects or agents to conceal any footprint and abnormalities in the victim system by some tricks such as code injection and stealing digital certificates. In this paper, a new solution is proposed for detecting both low and slow APTs. The proposed approach uses low-level interception, knowledge-based system, system ontology, and semantic correlation to detect low-level attacks. Since using semantic-based correlation is not applicable for detecting slow attacks due to its significant processing overhead, we propose a scalable knowledge-based system that uses three different concepts and approaches to reduce the time complexity including (1) flexible sliding window called Vermiform window to analyze and correlate system events instead of using fixed-size time-window, (2) effective inference using a scalable inference engine called SANSA, and (3) data reduction by ontology-based data abstraction. We can detect the slow APTs whose attack duration is about several months. Evaluation of the proposed approach on a dataset containing many APT scenarios shows 84.21% of sensitivity and 82.16% of specificity.

This paper presents Duenna, an authentication framework for smart home systems (SHSs). When using controlling apps (e.g., a smartphone app), Duenna makes sure that only legitimate SHS users are allowed to operate their Internet of things (IoT) devices. Duenna is built upon a behavioral anomaly detection (BAD)-based approach. In particular, we hypothesize that SHS users usually operate their home IoT devices in typical and distinctive patterns. Therefore, users that attempt to operate devices differently from such a regular behavior are considered malicious. Technically, Duenna operates in two modes. In an initialization operation, Duenna first collects and processes the historical cyber and physical activities of an SHS user in addition to the historical states of the SHS itself to build a set of incremental anomaly detection (AD) models. Then, in an interactive operation, the trained AD models are, then, used as a baseline from which anomalous commands (i.e., outliers) are detected and rejected, while regular commands (i.e., targets) are considered legitimate and allowed to be executed. Through an empirical evaluation conducted on real-world data, Duenna exhibits high authentication rates ensuring both security and user experience. The findings obtained from such evaluation show that a user behavior-based approach is a promising security scheme that could be integrated into existing SHS platforms.

Presently, Supervisory Control and Data Acquisition (SCADA) systems are broadly adopted in remote monitoring large-scale production systems and modern power grids. However, SCADA systems are continuously exposed to various heterogeneous cyberattacks, making the detection task using the conventional intrusion detection systems (IDSs) very challenging. Furthermore, conventional security solutions, such as firewalls, and antivirus software, are not appropriate for fully protecting SCADA systems because they have distinct specifications. Thus, accurately detecting cyber-attacks in critical SCADA systems is undoubtedly indispensable to enhance their resilience, ensure safe operations, and avoid costly maintenance. The overarching goal of this paper is to detect malicious intrusions that already detoured traditional IDS and firewalls. In this paper, a stacked deep learning method is introduced to identify malicious attacks targeting SCADA systems. Specifically, we investigate the feasibility of a deep learning approach for intrusion detection in SCADA systems. Real data sets from two laboratory-scale SCADA systems, a two-line three-bus power transmission system and a gas pipeline are used to evaluate the proposed method’s performance. The results of this investigation show the satisfying detection performance of the proposed stacked deep learning approach. This study also showed that the proposed approach outperformed the standalone deep learning models and the state-of-the-art algorithms, including Nearest neighbor, Random forests, Naive Bayes, Adaboost, Support Vector Machine, and oneR. Besides detecting the malicious attacks, we also investigate the feature importance of the cyber-attacks detection process using the Random Forest procedure, which helps design more parsimonious models.

Network security and data security are the biggest concerns now a days. Every organization decides their future business process based on the past and day to day transactional data. This data may consist of consumer’s confidential data, which needs to be kept secure. Also, the network connections when established with the external communication devices or entities, a care should be taken to authenticate these and block the unwanted access. This consists of identification of the malicious connection nodes and identification of normal connection nodes. For that, we use a continuous monitoring of the network input traffic to recognize the malicious connection request called as intrusion and this type of monitoring system is called as an Intrusion detection system (IDS). IDS helps us to protect our network and data from insecure and malicious network connections. Many such systems exists in the real time scenario, but they have critical issues of performance like accuracy and efficiency. These issues are addressed as a part of this research work of IDS using machine learning techniques and HDFS. The TP-IDS is designed in two phases for increasing accuracy. In phase I of TP-IDS, Support Vector Machine (SVM) and k Nearest Neighbor (kNN) are used. In phase II of TP-IDS, Decision Tree (DT) and Naïve Bayes (NB) are used, where phase II is the validation phase of the system for increasing accuracy. Also, both the phases are having Hadoop distributed file system underlying data storage and processing architecture, which allows parallel processing to increase the speed of the system and hence achieve the efficiency in TP-IDS.

The security of industrial control systems is increasingly prominent, and the performance of intrusion detection classifiers depends more on hyper-parameters. This paper proposes an improved multiple population genetic algorithm (IMPGA) used to intelligently search hyper-parameters of classifiers, and the simulated annealing algorithm (SAA) is used to control the evolution rate among various populations. In addition, the hash fitness value is used to reduce resource consumption and the directional evolution operator is introduced to optimize the population. This method can effectively avoid the algorithm falling into local optimal solution and save the optimal solution in the process of evolution. Thus, the optimal or approximate optimal combinations of hyper-parameters of classifiers are obtained and the accuracy of the classifiers is finally improved. In this paper, experiments are conducted on the following datasets: the natural gas pipeline experimental dataset of Mississippi State University from 2014 (a gas dataset), the intrusion detection systems dataset of Canadian Institute for Cybersecurity from 2017 (CICIDS2017 dataset) and an oil depot dataset. The experimental results of those three datasets show that the area under curve (AUC) of the back propagation neural network (BPNN) is more than 98%, of the extreme gradient boosting (XGBoost) is more than 99%, and of the support vector machines (SVM) is more than 98%. This selection method can effectively detect the intrusion attacks.

Artificial Intelligence (AI)- based classifiers rely on Machine Learning (ML) algorithms to provide functionalities that system architects are often willing to integrate into critical Cyber-Physical Systems (CPSs) . However, such algorithms may misclassify observations, with potential detrimental effects on the system itself or on the health of people and of the environment. In addition, CPSs may be subject to threats that were not previously known, motivating the need for building Intrusion Detectors (IDs) that can effectively deal with zero-day attacks. Different studies were directed to compare misclassifications of various algorithms to identify the most suitable one for a given system. Unfortunately, even the most suitable algorithm may still show an unsatisfactory number of misclassifications when system requirements are strict. A possible solution may rely on the adoption of meta-learners, which build ensembles of base-learners to reduce misclassifications and that are widely used for supervised learning. Meta-learners have the potential to reduce misclassifications with respect to non-meta learners: however, misleading base-learners may let the meta-learner leaning towards misclassifications and therefore their behavior needs to be carefully assessed through empirical evaluation. To such extent, in this paper we investigate, expand, empirically evaluate, and discuss meta-learning approaches that rely on ensembles of unsupervised algorithms to detect (zero-day) intrusions in CPSs. Our experimental comparison is conducted by means of public datasets belonging to network intrusion detection and biometric authentication systems, which are common IDSs for CPSs. Overall, we selected 21 datasets, 15 unsupervised algorithms and 9 different meta-learning approaches. Results allow discussing the applicability and suitability of meta-learning for unsupervised anomaly detection, comparing metric scores achieved by base algorithms and meta-learners. Analyses and discussion end up showing how the adoption of meta-learners significantly reduces misclassifications when detecting (zero-day) intrusions in CPSs.

Contemporary organizations often employ signature-based network intrusion detection systems to increase the security of their computer networks. The effectiveness of a signature-based system primarily depends on the quality of the rules used to associate system events to known malicious behavior. However, the variables that determine the quality of rulesets is relatively unknown. This paper empirically analyzes the detection probability in a test involving Snort for 1143 exploitation attempts and 12 Snort rulesets created by the Emerging Threats Labs and the Sourcefire Vulnerability Research Team. The default rulesets from Emerging Threats raised priority-1-alerts for 39% of the exploit attempts compared to 31% for rulesets from the Vulnerability Research Team. The following features predict detection probability: if the exploit is publicly known, if the ruleset references the exploited vulnerability, the payload, the type of software targeted, and the operating system of the targeted software. The importance of these variables depends on the ruleset used and whether default rules are used. A logistic regression model with these variables classifies 69-92% of the cases correctly for the different rulesets.

Feature selection or reduction is a significant process for intrusion detection system (IDS) in finding optimal features. Irrelevant features present in the dataset increase load on computing resources and affect the performance of the system. The present study proposes a feature reduction method based on the combination of filter-based feature reduction algorithms, namely Information Gain Ratio (IGR), Correlation (CR), and ReliefF (ReF). The system initially obtains feature subsets for each classifier based on average weight and further Subset Combination Strategy (SCS) is applied. The proposed feature reduction method results in 24 reduced features for CICIDS 2017 DoS dataset. The proposed method shows an improved performance compared to the current state-of-the-art systems on CICIDS 2017 dataset. The proposed method has also been tested and compared with the current state-of-the-art systems on KDD Cup 99 dataset.

Intrusion detection in supervisory control and data acquisition (SCADA) systems is integral because of the critical roles of these systems in industries. However, available approaches in the literature lack representative flow-based datasets and reliable real-time adaption and evaluation. A publicly available labelled dataset to support flow-based intrusion detection research specific to SCADA systems is presented. Cyberattacks were carried out against our SCADA system test bed to generate this flow-based dataset. Moreover, a flow-based intrusion detection system (IDS) is developed for SCADA systems using a deep learning algorithm. We used the dataset to develop this IDS model for real-time operations of SCADA systems to detect attacks momentarily after they happen. The results show empirical proof of the model’s adequacy when deployed online to detect cyberattacks in real time National Science Foundation; Washington University in St. Louis;?Qatar National Research Fund; Funda o de Amparo Pesquisa do Estado de So Paulo; Qatar University Scopus

Network Intrusion detection systems are essential for the protection of advanced communication networks. Originally, these systems were hard-coded to identify specific signatures, patterns and rule violations; now artificial intelligence and machine learning algorithms provide promising alternatives. However, in the literature, various outdated datasets as well as a plethora of different evaluation metrics are used to prove algorithm efficacy. To enable a global comparison, this study compiles algorithms for different configurations to create common ground and proposes two new evaluation metrics. These metrics, the detection score and the identification score, together reliably present the performance of a network intrusion detection system to allow for practical comparison on a large scale. Additionally, we present a workflow to process raw packet flows into input features for machine learning. This framework quickly implements different algorithms for the various datasets and allows systematic performance comparison between those algorithms. Our experimental results, matching and surpassing the state-of-the-art, indicate the potential of this approach. As raw traffic input features are much easier and cheaper to extract when compared to traditional features, they show promise for application in real-time deep learning-based systems. ispartof: Ieee Access vol:9 pages:63995-64015 status: published

As information technology grows, network security is a significant issue and challenge. The intrusion detection system (IDS) is known as the main component of a secure network. An IDS can be considered a set of tools to help identify and report abnormal activities in the network. In this study, we use data mining of a new framework using fuzzy tools and combine it with the ant colony optimization algorithm (ACOR) to overcome the shortcomings of the k-means clustering method and improve detection accuracy in IDSs. Introduced IDS. The ACOR algorithm is recognized as a fast and accurate meta-method for optimization problems. We combine the improved ACOR with the fuzzy c-means algorithm to achieve efficient clustering and intrusion detection. Our proposed hybrid algorithm is reviewed with the NSL-KDD dataset and the ISCX 2012 dataset using various criteria. For further evaluation, our method is compared to other tasks, and the results are compared show that the proposed algorithm has performed better in all cases.

The multimedia service company, Netflix, increased the number of new subscribers during the Coronavirus pandemic age. Intrusion detection systems for multimedia platforms can prevent the platform from network attacks. An intelligent intrusion detection system is proposed for the security IP Multimedia Subsystem (IMS) based on machine learning technology. For increasing the accuracy of the classifiers, it is vital to select the critical features to construct the intrusion detection system. Two-class classifiers, including the Decision Tree, Support Vector Machine, and Naive Bayesian, are selected to evaluate intrusion detection accuracy. According to the three classifiers’ accuracy values, the most critical features are selected based on the features’ ranking orders. Six critical features are selected:Service, dst_host_same_srv_rate, Flag, Protocol Type, Dst_host_rerror_rate, and Count. Numerical comparison with state_of_the_art shows that critical features improve intrusion detection accuracy, which can be better than the deep learning method.

Although cloud computing is considered the most widespread technology nowadays, it still suffers from many challenges, especially related to its security. Due to the open and distributed nature of the cloud environment, this makes the cloud itself vulnerable to various attacks. In this paper, the design of a novel integrated Cloud-based Intrusion Detection System (CIDS) is proposed to immunise the cloud against any possible attacks. The proposed CIDS consists of five main modules to do the following actions: monitoring the network, capturing the traffic flows, extracting features, analyzing the flows, detecting intrusions, taking a reaction, and logging all activities. Furthermore an enhanced bagging ensemble system of three deep learning models is utilized to predict intrusions effectively. Moreover, a third-party Cloud-based Intrusion Detection System Service (CIDSS) is also exploited to control the proposed CIDS and provide the reporting service. Finally, it has been shown that the proposed approach overcomes all problems associated with attacks on the cloud raised in the literature. © 2021 Wisam Elmasry et al., published by De Gruyter 2021.

The next-generation of Industrial Automation and Control Systems (IACS) and Supervisory Control and Data Acquisition (SCADA) systems pose numerous challenges in terms of cybersecurity monitoring. We have been witnessing the convergence of OT/IT networks, combined with massively distributed metering and control scenarios such as smart grids. Larger and geographically widespread attack surfaces, and inherently more data to analyse, will become the norm. Despite several advances in recent years, domain-specific security tools have been facing the challenges of trying to catch up with all the existing security flaws from the past, while also accounting for the specific needs of the next-generation of IACS. Moreover, the aggregation of multiple techniques and sources of information into a comprehensive approach has not been explored in depth. Such a holistic perspective is paramount since it enables a global and enhanced analysis enabled by the usage, combination and aggregation of the outputs from multiple sources and techniques. This paper starts by providing a review of the more recent anomaly detection techniques for SCADA systems, focused on both theoretical machine learning approaches and complete frameworks. Afterwards, it proposes a complete framework for an Intrusion and Anomaly Detection System (IADS) composed of specific detection probes, an event processing layer and a core anomaly detection component, amongst others. Finally, the paper presents an evaluation of the framework within a large-scale hybrid testbed, and a comparison of different anomaly detection scenarios based on various machine learning techniques. info:eu-repo/semantics/publishedVersion

Anomaly-based detection techniques have a high number of false positives, which degrades the detection performance. To address this issue, we propose a distributed intrusion detection system, named ISM-AC, based on anomaly detection using artificial immune system and attack graph correlation. To analyze network traffic, we use negative selection, clonal selection, and immune network algorithms to implement an agent-based detection system. ISM-AC leverages the programmability of software-defined networking to reduce the false positive rate. Our findings show that ISM-AC achieves better detection performance for denial of service, user to root, remote to local, and probe attack classes. Alert correlation plays a key role in this achievement.

Class rarity is a frequent challenge in cybersecurity. Rarity occurs when the positive (attack) class only has a small number of instances for machine learning classifiers to train upon, thus making it difficult for the classifiers to discriminate and learn from the positive class. To investigate rarity, we examine three individual web attacks in big data from the CSE-CIC-IDS2018 dataset: “Brute Force-Web”, “Brute Force-XSS”, and “SQL Injection”. These three individual web attacks are also severely imbalanced, and so we evaluate whether random undersampling (RUS) treatments can improve the classification performance for these three individual web attacks. The following eight different levels of RUS ratios are evaluated: no sampling, 999:1, 99:1, 95:5, 9:1, 3:1, 65:35, and 1:1. For measuring classification performance, Area Under the Receiver Operating Characteristic Curve (AUC) metrics are obtained for the following seven different classifiers: Random Forest (RF), CatBoost (CB), LightGBM (LGB), XGBoost (XGB), Decision Tree (DT), Naive Bayes (NB), and Logistic Regression (LR) (with the first four learners being ensemble learners and for comparison, the last three being single learners). We find that applying random undersampling does improve overall classification performance with the AUC metric in a statistically significant manner. Ensemble learners achieve the top AUC scores after massive undersampling is applied, but the ensemble learners break down and have poor performance (worse than NB and DT) when no sampling is applied to our unique and harsh experimental conditions of severe class imbalance and rarity.

In order to correct the deficiencies of intrusion detection technology, the entire computer and network security system are needed to be more perfect. This work proposes an improved k-means algorithm and an improved Apriori algorithm applied in data mining technology to detect network intrusion and security maintenance. The classical KDDCUP99 dataset has been utilized in this work for performing the experimentation with the improved algorithms. The algorithm’s detection rate and false alarm rate are compared with the experimental data before the improvement. The outcomes of proposed algorithms are analyzed in terms of various simulation parameters like average time, false alarm rate, absolute error as well as accuracy value. The results show that the improved algorithm advances the detection efficiency and accuracy using the designed detection model. The improved and tested detection model is then applied to a new intrusion detection system. After intrusion detection experiments, the experimental results show that the proposed system improves detection accuracy and reduces the false alarm rate. A significant improvement of 90.57% can be seen in detecting new attack type intrusion detection using the proposed algorithm.

Abstract Intrusion Detection Systems (IDSs) have received more attention to safeguarding the vital information in a network system of an organization. Generally, the hackers are easily entering into a secured network through loopholes and smart attacks. In such situation, predicting attacks from normal packets is tedious, much challenging, time consuming and highly technical. As a result, different algorithms with varying learning and training capacity have been explored in the literature. However, the existing Intrusion Detection methods could not meet the desired performance requirements. Hence, this work proposes a new Intrusion Detection technique using Deep Autoencoder with Fruitfly Optimization. Initially, missing values in the dataset have been imputed with the Fuzzy C-Means Rough Parameter (FCMRP) algorithm which handles the imprecision in datasets with the exploit of fuzzy and rough sets while preserving crucial information. Then, robust features are extracted from Autoencoder with multiple hidden layers. Finally, the obtained features are fed to Back Propagation Neural Network (BPN) to classify the attacks. Furthermore, the neurons in the hidden layers of Deep Autoencoder are optimized with population based Fruitfly Optimization algorithm. Experiments have been conducted on NSL_KDD and UNSW-NB15 dataset. The computational results of the proposed intrusion detection system using deep autoencoder with BPN are compared with Naive Bayes, Support Vector Machine (SVM), Radial Basis Function Network (RBFN), BPN, and Autoencoder with Softmax. Article Highlights A hybridized model using Deep Autoencoder with Fruitfly Optimization is introduced to classify the attacks. Missing values have been imputed with the Fuzzy C-Means Rough Parameter method. The discriminate features are extracted using Deep Autoencoder with more hidden layers.

The concept of software-defined Internet of Things (SD-IoT) is becoming even more widespread. SD-IoT enables us to realize programmable networks and business, simplifying the management of the Internet of Things (IoT) and improving the IoT flexibility and scalability. However, with the promotion of SD-IoT-based applications and services, security issues in SD-IoT networks have become increasingly prominent. Aimed to deal with such issues, in this paper, we propose a two-stage intrusion detection approach for SD-IoT networks. It can more intelligently detect attacks under SD-IoT networks. In particular, we use the differential evolution algorithm's mutation mechanism to improve the firefly algorithm to solve the existing firefly algorithm's problems, such as slow convergence speed, easy to fall into local optimum on complex problems, and low accuracy. Next, based on the wrapper feature selection method, the selected features are sent to a novel ensemble classifier, composed of the C4.5 decision tree, multilayer perceptron, and instance-based learning. Again, the proposed approach uses the weighted voting method to determine whether network traffic is abnormal. Our proposal's detection performance is evaluated in binary and multiclass classifications by adopting the NSL-KDD and UNSW-NB15 public data sets. Experimental results show that the proposed multiclass classification approach's accuracy is 99.00% and 88.46%, respectively, while the false-positive rate is 0.81% and 4.16%, respectively. Finally, experimental results show that our proposal outperforms existing methods in terms of detection performance.

Machine learning algorithms efficiently trained on intrusion detection datasets can detect network traffic capable of jeopardizing an information system. In this study, we use the CSE-CIC-IDS2018 dataset to investigate ensemble feature selection on the performance of seven classifiers. CSE-CIC-IDS2018 is big data (about 16,000,000 instances), publicly available, modern, and covers a wide range of realistic attack types. Our contribution is centered around answers to three research questions. The first question is, “Does feature selection impact performance of classifiers in terms of Area Under the Receiver Operating Characteristic Curve (AUC) and F1-score?” The second question is, “Does including the Destination_Port categorical feature significantly impact performance of LightGBM and Catboost in terms of AUC and F1-score?” The third question is, “Does the choice of classifier: Decision Tree (DT), Random Forest (RF), Naive Bayes (NB), Logistic Regression (LR), Catboost, LightGBM, or XGBoost, significantly impact performance in terms of AUC and F1-score?” These research questions are all answered in the affirmative and provide valuable, practical information for the development of an efficient intrusion detection model. To the best of our knowledge, we are the first to use an ensemble feature selection technique with the CSE-CIC-IDS2018 dataset.

International audience; Industrial control system (ICS) or SCADA networks architecture has been evolved from isolated environments to interconnected networks with the enterprise networks and the Internet. Moreover, modern SCADA networks also encompass standard hardware and software as well as open protocols such as Ethernet and TCP/IP. SCADA networks are nowadays exposed to the same threats as the classic IT networks. Along with counter measures like antivirus, firewall, encryption, control access and other security policies, anomaly detection systems are of great importance as there is always a risk of security breach. Deep learning is drawing more and more attention these years from the research community due to outstanding results in image classification, video and natural language processing. In this paper, we propose a deep neural network (DNN) approach to build an efficient SCADA anomaly detection system. The proposed approach is a stacked sparse denoising auto-encoder (SSpDAE) to which we appended a softmax classifier to discriminate the SCADA data. The DNN anomaly detection system allows an automatic feature learning and gives better results in terms of detection rate, compared to standard approaches like random forest, Naïve Bayes, and decision tree.

Communication networks are expanding rapidly and becoming increasingly complex. As a consequence, the conventional rule-based algorithms or protocols may no longer perform at their best efficiencies in these networks. Machine learning (ML) has recently been applied to solve complex problems in many fields, including finance, health care, and business. ML algorithms can offer computational models that can solve complex communication network problems and consequently improve performance. This paper reviews the recent trends in the application of ML models in communication networks for prediction, intrusion detection, route and path assignment, Quality of Service improvement, and resource management. A review of the recent literature reveals extensive opportunities for researchers to exploit the advantages of ML in solving complex performance issues in a network, especially with the advancement of software-defined networks and 5G.

Artificial Intelligence (AI) techniques provide effective solutions for the detection of many aberrant network traffic patterns and attack flows. However, the validation of these techniques often relies on one training dataset. Recent results show that such training may fail in the face of dynamically-changing cyberattacks. Given the increased sophistication of cyberattacks nowadays, it is imperative to examine and improve the performance of such AI models. This paper proposes a defensive AI engine combined with a twofold feature selection technique and hyperparameter optimization of the AI model. In this work, we utilize the proposed system for binary attack flow identification and the AI models are trained and validated on the CICIDS2017 dataset. The system is then evaluated using synthesized atypical attack flows to mimic real-world scenarios. We demonstrate the effectiveness of the proposed atypical attack flow detection approach using several Deep Learning and Machine Learning models including DNN, Linear-SVC, and Stacked Decision Tree Classifier (S-DTC). Simulation results demonstrate that the proposed defensive AI engine significantly improves the True Positive Rate (TPR) of AI models on multiple atypical attacks.

Nowadays, most cyber attackers exploit secure communication channels to hide malicious activities and imitate the behaviors of a legitimate user. These attacks over a secure channel make networked systems more vulnerable to new threats and increase the possibility of significant damage to other end users. Traditional TCP/IP-level traffic inspections do not suffice in investigating a secure sockets layer (SSL) conversation because the SSL conversation data is encrypted by a public key system and the SSL uses its own data unit of an SSL record. In this paper, we propose a novel malicious SSL traffic detection method, which reassembles SSL records from captured IP packets and inspects the characteristics of SSL records using a deep learning method. After an SSL record is reassembled from a single or multiple IP packets, the proposed method extracts unencrypted contents of the reassembled record and generates a sequence of unencrypted data from successive SSL records for deep learning-based classification. The sequences of SSL records are encoded using a long short-term memory autoencoder, and then an encoded feature map is generated for each SSL flow. These feature maps are forwarded to the convolutional neural network-based classifier to determine whether the SSL flow is malicious or not. The experiment shows that our proposed approach has a great separability between benign and malicious traffic flows on an encrypted SSL channel.

This paper investigates the effect of data integrity attacks on the central control of the microgrids (MGs), which can lead to severe blackouts and load shedding. It assesses this cyber attack from the steady state and optimal scheduling point of view. In order to stop the cyber hacking, a new deep learning-based framework has been developed based on the generative adversarial networks (GANs). In this framework, two networks compete with each other, wherein the first network generates fake data, and the second one is responsible for the data classification. In order to get into the most optimal features, a new optimization method based on a modified teaching-learning based optimization (TLBO) algorithm is also devised to reinforce the GAN model and help a better matching training process. In addition, a new modification is introduced for TLBO to avoid premature convergence and provide high population diversity. To show the effectiveness of the proposed framework, a real dataset of several smart metering devices in a MG has been tested. Results illustrate the high performance of the proposed framework, comparing to the well-known conventional detection frameworks with hit rate of 93.11%, miss rate of 6.89%, false alarm rate of 7.76% and correct reject rate of 92.24%.

Vehicles are becoming increasingly autonomous and connected, leading to an increase in the types of security threats to vehicles. Controller Area Network (CAN) is a serial bus system that is used to connect sensors and controllers (Electronic Control Units – ECUs) within a vehicle. ECUs vary widely in processing power, storage, memory, and connectivity. There is a need for efficient security countermeasures for protecting the CAN from various attacks. In this paper, we present a novel process to efficiently design functions that can be used for anomaly detection. Our earlier work successfully demonstrated the use of Long Short-Term Memory (LSTM) Networks to perform anomaly detection. This paper focuses on the efficient design and testing of functions that are attack-resistant and can be used in our anomaly detection engine. Once trained, our system is capable of efficiently detecting anomalies in real-time. We report the results of our anomaly detection function design process. We also present the results of our overall anomaly detection engine that are used as inputs to our detection engine. Our function design process and anomaly detection engine have been tested on data from real automobiles. We present the results of our experiments and analyze our findings.

Vehicles are equipped with Electronic Control Units (ECUs) to increase their overall system functionality and connectivity. However, the rising connectivity exposes a defenseless internal Controller Area Network (CAN) to cyberattacks. An Intrusion Detection System (IDS) is a supervisory module, proposed for identifying CAN network malicious messages, without modifying legacy ECUs and causing high traffic overhead. The traditional IDS approaches rely on time and frequency thresholding, leading to high false alarm rates, whereas state-of-the-art solutions may suffer from vehicle dependency. This paper presents a wavelet-based approach to locating the behavior change in the CAN traffic by analyzing the CAN network’s transmission pattern. The proposed Wavelet-based Intrusion Detection System (WINDS) is tested on various attack scenarios, using real vehicle traffic from two independent research centers, while being expanded toward more comprehensive attack scenarios using synthetic attacks. The technique is evaluated and compared against the state-of-the-art solutions and the baseline frequency method. Experimental results show that WINDS offers a vehicle-independent solution applicable for various vehicles through a unique approach while generating low false alarms.

Extreme learning machine (ELM) is a novel single-hidden layer feedforward neural network to obtain fast learning speed by randomly initializing weights and deviations. Due to its extremely fast learning speed, it has been widely used in training of massive data in recent years. In order to adapt to the real network environment, based on the ELM, we propose an improved particle swarm optimized online regularized extreme learning machine (IPSO-IRELM) intrusion detection algorithm model. First, the model replaces the traditional batch learning with sequential learning by dynamically adapting the new data obtained in the training network instead of training all collected samples in an offline manner; second, we improve the particle swarm optimization algorithm and compare it with typical improved algorithms to prove its effectiveness; finally, to solve the random initialization problem of IRELM, we use IPSO to optimize the initial weights and deviations of IRELM to improve the classification ability of IRELM. The experimental results show that IPSO-IRELM algorithm has better generalization ability, which not only improves the accuracy of intrusion detection, but also has certain recognition ability for minority class samples.

Recently, using artificial neural networks (ANNs) for network intrusion detection systems (NIDSs) has drawn much attention from security researchers. The capability of ANNs to learn patterns from numerous data helps detect attacks on networked systems. Moreover, to effectively monitor a newly emerging networked system consisting of distributed subsystems, such as edge, Internet of Things (IoT), and fog, recent studies have proposed an ANN-based distributed NIDS, where multiple ANNs are deployed to local gateways. To meet the incessant demand for high accuracy, ANN-based NIDSs have become complicated and heavy. With local gateways being small and low-end, such ANNs cannot be executed. Some researchers have proposed optimized algorithms to balance detection accuracy and runtime performance to solve this problem. For example, Kitsune empirically proved its efficiency, but a recent study reveals that Kitsune has limitations. In particular, Kitsune fails at identifying host-oriented attacks, which pretend to be benign during packet delivery but incur malicious behavior on destination devices. Panop is a novel ANN-based NIDS for a distributed network system that aims to detect malicious packets, including host-oriented attacks, while remaining sufficiently lightweight to be executed by low-end devices. Thus, the Panop ANN is designed to comprehensively learn network and device behaviors related to packet transactions in an IoT network. According to the experiments, Panop can detect host-oriented and other attacks with reasonably high accuracy with little degradation in runtime performance compared to the state-of-the-art NIDS for distributed network environments.

Modern power systems require increased connectivity to implement novel coordination and control schemes. Wide-spread use of information technology in smartgrid domain is an outcome of this need. IEC 61850-based communication solutions have become popular due to a myriad of reasons. Object-oriented modeling capability, interoperable connectivity and strong communication protocols are to name a few. However, power system communication infrastructure is not well-equipped with cybersecurity mechanisms for safe operation. Unlike online banking systems that have been running such security systems for decades, smartgrid cybersecurity is an emerging field. A recent publication aimed at equipping IEC 61850-based communication with cybersecurity features, i.e. IEC 62351, only focuses on communication layer security. To achieve security at all levels, operational technology-based security is also needed. To address this need, this paper develops an intrusion detection system for smartgrids utilizing IEC 61850‘s Sampled Value (SV) messages. The system is developed with machine learning and is able to monitor communication traffic of a given power system and distinguish normal data measurements from falsely injected data, i.e. attacks. The designed system is implemented and tested with realistic IEC 61850 SV message dataset. Tests are performed on a Modified IEEE 14-bus system with renewable energy-based generators where different fault are applied. The results show that the proposed system can successfully distinguish normal power system events from cyberattacks with high accuracy. This ensures that smartgrids have intrusion detection in addition to cybersecurity features attached to exchanged messages.

In this paper, we propose DiFF-RF, an ensemble approach composed of random partitioning binary trees to detect point-wise and collective (as well as contextual) anomalies. Thanks to a distance-based paradigm used at the leaves of the trees, this semi-supervised approach solves a drawback that has been identified in the isolation forest (IF) algorithm. Moreover, taking into account the frequencies of visits in the leaves of the random trees allows to significantly improve the performance of DiFF-RF when considering the presence of collective anomalies. DiFF-RF is fairly easy to train, and excellent performance can be obtained by using a simple semi-supervised procedure to setup the extra hyper-parameter that is introduced. We first evaluate DiFF-RF on a synthetic data set to i) verify that the limitation of the IF algorithm is overcome, ii) demonstrate how collective anomalies are actually detected and iii) to analyze the effect of the meta-parameters it involves. We assess the DiFF-RF algorithm on a large set of datasets from the UCI repository, as well as two benchmarks related to intrusion detection applications. Our experiments show that DiFF-RF almost systematically outperforms the IF algorithm, but also challenges the one-class SVM baseline and a deep learning variational auto-encoder architecture. Furthermore, our experience shows that DiFF-RF can work well in the presence of small-scale learning data, which is conversely difficult for deep neural architectures. Finally, DiFF-RF is computationally efficient and can be easily parallelized on multi-core architectures., Comment: arXiv admin note: text overlap with arXiv:1705.03800

Communication between the nodes in a vehicle is performed using many protocols. The most common of these is known as the Controller Area Network (CAN). The functionality of the CAN protocol is based on sending messages from one node to all others throughout a bus. Messages are sent without either source or destination addresses. Consequently, it is simple for an attacker to inject malicious messages. This may lead to some nodes malfunctioning or total system failure, which can affect the safety of the driver as well as the vehicle. Detecting intrusions is a challenging problem in the context of using CAN bus for in-vehicle communication. Most existing work focuses on the physical aspects without taking into consideration the data itself. Machine Learning (ML) tools, especially classification techniques, have been widely used to address similar problems. In this paper, we use and compare several ML techniques to deal with the problem of detecting intrusions in in-vehicle communication. An experimental study is performed using a real dataset extracted from a KIA Soul car. Compared to previous work, which focuses on detecting intrusions based on the physical aspect, this paper aims to concentrate on the application of data analysis and statistical learning techniques. Furthermore, the paper provides a comparative study of the most common ML techniques. The results show that the techniques under consideration in this paper outperform other techniques that have been used previously.

Detecting intrusion in network traffic has remained a problematic task for years. Progress in the field of machine learning is paving the way for enhancing intrusion detection systems. Due to this progress intrusion detection has become an integral part of network security. Intrusion detection has achieved high detection accuracy with the help of supervised machine learning methods. A key factor in enhancing the performance of supervised classifiers is how data is augmented for training the classification model. Data in real-world networks or publicly available datasets are not always normally (Gaussian) distributed. Instead, the distributions of variables are more likely to be skewed. To achieve a high detection rate, data normalization or transformation plays an important role for machine learning-based intrusion detection systems. Several methods are available to normalize the attributes of the data before training a classification model. However, opting for the most suitable normalization technique is still a questionable task. In this paper, a statistical method is proposed that can identify the most suitable normalization method for the dataset. The normalization method identified by the proposed approach gives the highest accuracy for an intrusion detection system. To highlight the efficiency of the proposed method, five different datasets were used with two different feature selection methods. The datasets belong to both Internet of things and traditional network environments. The proposed method is also able to identify hybrid normalizations to achieve even improved intrusion detection results.

Building the security mechanism for Controller Area Network (CAN) to defend against attack has drawn substantial attention recently. Fingerprinting ECUs to provide the ability of authentication based on the physical characteristics can protect the CAN network effectively. The clock skew which is unique and stable can be exploited to pinpoint the attacker and detect intrusion. However, a common downside of existing clock-skew-based approaches is that the estimation process can be affected by the message scheduling or arbitration. In our work, a novel intrusion detection system (IDS) that exploits the inherent difference in the clock of devices for automotive CAN network is designed. The estimation process of clock skew in our approach relies only on the time measurement of a single CAN frame. Thus, the disturbance from the data-link layer can be avoided. Since the performance of our IDS depends heavily on the accuracy of estimated clock skew, our approach is evaluated on CAN networks with different settings to simulate cases in which the sampling rate is sufficient or not. The feasibility as well as the limitation of our approach are presented in our work. The evaluation shows that our IDS can identify the sender and detect attacks with an average identification rate of more than 99.7% when the sampling rate is sufficient. Besides, the performance degradation as low sampling accuracy is shown and feasible measures for improvement are also discussed.

The controller area network (CAN) bus protocol is exposed to threats from various attacks because it is designed without consideration of security. In a normal vehicle operation situation, controllers connected to a CAN bus transmit periodic and nonperiodic signals. Thus, if a CAN identifier (ID) sequence is configured by collecting the identifiers of CAN signals in their order of occurrence, it will have a certain pattern. However, if only a very small number of attack IDs are included in a CAN ID sequence, it will be difficult to detect the corresponding pattern change. Thus, a detection method that is different from the conventional one is required to detect such attacks. Since a CAN ID sequence can be regarded as a sentence consisting of words in the form of CAN IDs, a generative pretrained transformer (GPT) model can learn the pattern of a normal CAN ID sequence. Therefore, such a model is expected to be able to detect CAN ID sequences that contain a very small number of attack IDs better than the existing long short-term memory (LSTM)-based method. In this paper, we propose an intrusion detection model that combines two GPT networks in a bi-directional manner to allow both past and future CAN IDs (relative to the time of detection) to be used. The proposed model is trained to minimize the negative log-likelihood (NLL) value of the bi-directional GPT network for a normal sequence. When the NLL value for a CAN ID sequence is larger than a prespecified threshold, it is deemed an intrusion. The proposed model outperforms a single uni-directional GPT model with the same degree of complexity as other existing LSTM-based models because the bi-directional structure of the proposed model maintains the estimation performance for most CAN IDs, regardless of their positions in the sequence.

This paper presents a dataset to support researchers in the validation process of solutions such as Intrusion Detection Systems (IDS) based on artificial intelligence and machine learning techniques for the detection and categorization of threats in Cyber Physical Systems (CPS). To this end, data were acquired from a hardware-in-the-loop Water Distribution Testbed (WDT) which emulates water flowing between eight tanks via solenoid-valves, pumps, pressure and flow sensors. The testbed is composed of a real subsystem that is virtually connected to a simulated one. The proposed dataset encompasses both physical and network data in order to highlight the consequences of attacks in the physical process as well as in network traffic behaviour. Simulations data are organized in four different acquisitions for a total duration of 2 hours by considering normal scenario and multiple anomalies due to cyber and physical attacks.

Today’s smart city infrastructure is predominantly dependant on Internet of Things (IoT) technologies. IoT technology essentially facilitates a platform for service automation through connections of heterogeneous objects via the Internet backbone. However, the security issues associated with IoT networks make smart city infrastructure vulnerable to cyber-attacks. For example, Distributed Denial of Service (DDoS) attack violates the authorization conditions in smart city infrastructure; whereas replay attack violates the authentication conditions in smart city infrastructure. Both attacks lead to physical disruption to smart city infrastructure, which may even lead to financial loss and/or loss of human lives. In this paper, a hybrid deep learning model is developed for detecting replay and DDoS attacks in a real life smart city platform. The performance of the proposed hybrid model is evaluated using real life smart city datasets (environmental, smart river and smart soil), where DDoS and replay attacks were simulated. The proposed model reported high accuracy rates: 98.37% for the environmental dataset, 98.13% for the smart river dataset, and 99.51% for the smart soil dataset. The results demonstrated an improved performance of the proposed model over other machine learning and deep learning models from the literature.

Predominant network intrusion detection systems (NIDS) aim to identify malicious traffic patterns based on a handcrafted dataset of rules. Recently, the application of machine learning in NIDS helps alleviate the enormous effort of human observation. Federated learning (FL) is a collaborative learning scheme concerning distributed data. Instead of sharing raw data, it allows a participant to share only a trained local model. Despite the success of existing FL solutions, in NIDS, a network’s traffic data distribution does not always fit into the single global model of FL; some networks have similarities with each other but other networks do not. We propose Segmented-Federated Learning (Segmented-FL), where by employing periodic local model evaluation and network segmentation, we aim to bring similar network environments to the same group. A comparison between FL and our method was conducted against a range of metrics including the weighted precision, recall, and F1 score, using a collected dataset from 20 massively distributed networks within 60 days. By studying the optimized hyperparameters of Segmented-FL and employing three evaluation methods, it shows that Segmented-FL has better performance in all three types of intrusion detection tasks, achieving validation weighted F1 scores of 0.964, 0.803, and 0.912 with Method A, Method B, and Method C respectively. For each method, this scheme shows a gain of 0.1%, 4.0% and 1.1% in performance compared with FL.

Nowadays, the ever-increasing complication and severity of security attacks on computer networks have inspired security researchers to incorporate different machine learning methods to protect the organizations’ data and reputation. Deep learning is one of the exciting techniques which recently are vastly employed by the IDS or intrusion detection systems to increase their performance in securing the computer networks and hosts. This survey article focuses on the deep learning-based intrusion detection schemes and puts forward an in-depth survey and classification of these schemes. It first presents the primary background concepts about IDS architecture and various deep learning techniques. It then classifies these schemes according to the type of deep learning methods utilized in each of them. It describes how deep learning networks are utilized in the intrusion detection process to recognize intrusions accurately. Finally, a complete analysis of the investigated IDS frameworks is provided, and concluding remarks and future directions are highlighted.

open access article In this article, we present a comprehensive study with an experimental analysis of federated deep learning approaches for cyber security in the Internet of Things (IoT) applications. Specifically, we first provide a review of the federated learning-based security and privacy systems for several types of IoT applications, including, Industrial IoT, Edge Computing, Internet of Drones, Internet of Healthcare Things, Internet of Vehicles, etc. Second, the use of federated learning with blockchain and malware/intrusion detection systems for IoT applications is discussed. Then, we review the vulnerabilities in federated learning-based security and privacy systems. Finally, we provide an experimental analysis of federated deep learning with three deep learning approaches, namely, Recurrent Neural Network (RNN), Convolutional Neural Network (CNN), and Deep Neural Network (DNN). For each deep learning model, we study the performance of centralized and federated learning under three new real IoT traffic datasets, namely, the Bot-IoT dataset, the MQTTset dataset, and the TON_IoT dataset. The goal of this article is to provide important information on federated deep learning approaches with emerging technologies for cyber security. In addition, it demonstrates that federated deep learning approaches outperform the classic/centralized versions of machine learning (non-federated learning) in assuring the privacy of IoT device data and provide the higher accuracy in detecting attacks.