Search

Cybersecurity finds widespread applications across diverse domains, encompassing intelligent industrial systems, residential environments, personal gadgets, and automobiles. This has spurred groundbreaking advancements while concurrently posing persistent challenges in addressing security concerns tied to IoT devices. IoT intrusion detection involves using sophisticated techniques, including deep learning models such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and anomaly detection algorithms, to identify unauthorized or malicious activities within IoT ecosystems. These systems continuously monitor and analyze network traffic and device behavior, seeking patterns that deviate from established norms. When anomalies are detected, security measures are triggered to thwart potential threats. IoT intrusion detection is vital for safeguarding data integrity, ensuring users' privacy, and maintaining critical systems' reliability and safety. As the IoT landscape evolves, effective intrusion detection mechanisms become increasingly essential to mitigate the ever-growing spectrum of cyber threats. Practical security approaches, notably deep learning-based intrusion detection, have been introduced to tackle these issues. This study utilizes deep learning models, including convolutional neural networks (CNNs), long short-term memory (LSTM), and gated recurrent units (GRUs), while introducing an ensemble deep learning architectural framework that integrates a voting policy within the model's structure, thereby facilitating the computation and learning of hierarchical patterns. In our analysis, we compared the performance of ensemble deep learning classifiers with traditional deep learning techniques. The standout models were CNN-LSTM and CNN-GRU, achieving impressive accuracies of 99.7% and 99.6%, along with exceptional F1-scores of 0.998 and 0.997, respectively. [ABSTRACT FROM AUTHOR]

With the exponential surge in the number of internet-connected devices, the attack surface for potential cyber threats has correspondingly expanded. Such a landscape necessitates the evolution of intrusion detection systems to counter the increasingly sophisticated mechanisms employed by cyber attackers. Traditional machine learning methods, coupled with existing deep learning implementations, are observed to exhibit limited proficiency due to their reliance on outdated datasets. Their performance is further compromised by elevated false positive rates, decreased detection rates, and an inability to efficiently detect novel attacks. In an attempt to address these challenges, this study proposes a deep learning-based system specifically designed for the detection of malicious network traffic. Three distinct deep learning models were employed: Deep Neural Networks (DNN), Long Short-Term Memory (LSTM), and Gated Recurrent Units (GRU). These models were trained using two contemporary benchmark intrusion detection datasets: the CICIDS 2017 and the Coburg Intrusion Detection Data Sets (CIDDS). A robust preprocessing procedure was conducted to merge these datasets based on common and essential features, creating a comprehensive dataset for model training. Two separate experimental setups were utilized to configure these models. Among the three models, the LSTM displayed superior performance in both experimental configurations. It achieved an accuracy of 98.09%, a precision of 98.14%, an F1-Score of 98.09%, a True Positive Rate (TPR) of 98.05%, a True Negative Rate (TNR) of 99.69%, a False Positive Rate (FPR) of 0.31%, and a False Negative Rate (FNR) of 1.95%. [ABSTRACT FROM AUTHOR]

Software-Defined Networking (SDN) enables flexibility in developing security tools that can effectively and efficiently analyze and detect malicious network traffic for detecting intrusions. Recently Machine Learning (ML) techniques have attracted lots of attention from researchers and industry for developing intrusion detection systems (IDSs) considering logically centralized control and global view of the network provided by SDN.Many IDSs have developed using advances in machine learning and deep learning. This study presents a comprehensive review of recent work of ML-based IDS in context to SDN. It presents a comprehensive study of the existing review papers in the field. It is followed by introducing intrusion detection, ML techniques and their types. Specifically, we present a systematic study of recent works, discuss ongoing research challenges for effective implementation of ML-based intrusion detection in SDN, and promising future works in this field. [ABSTRACT FROM AUTHOR]

Internet Protocol version 6 (IPv6) and its core protocol, Internet Control Message Protocol version 6 (ICMPv6), need to be secured from attacks, such as Denial of Service (DoS) and Distributed DoS (DDoS), in order to be reliable for deployment. Several Intrusion Detection Systems (IDSs) have been built and proposed to detect ICMPv6-based DoS and DDoS attacks. However, these IDSs suffer from several drawbacks, such as the inability to detect novel attacks and a low detection accuracy due to their reliance on packet-based traffic representation. Furthermore, the existing IDSs that rely on flow-based traffic representation use simple heuristics features that do not contribute to detecting ICMPv6-based DoS and DDoS attacks. This paper proposes a flow-based IDS by enriching the existing features with a set of new features to improve the detection accuracy. The flow consists of packets with similar attributes (i.e., packets with the same source and destination IP address) and features that can differentiate between normal and malicious traffic behavior, such as the source IP address's symmetry and the whole flow's symmetry. The experimental results reveal that the enriched features significantly improved the IDS's detection accuracy by 16.02% and that the false positive rate decreased by 19.17% compared with state-of-the-art IDSs. [ABSTRACT FROM AUTHOR]

Cooperative Intelligent Transport System (C-ITS) is a promising technology that aims to improve the traditional transport management systems. In C-ITS infrastructure Autonomous Vehicles (AVs) communicate wirelessly with other AVs, Road Side Units (RSUs) and Traffic Command Centres (TCCs) using an open channel Internet. However, the use of the Internet brings inherent vulnerabilities related to privacy (e.g., adversary performing inference and data poisoning attacks), and security (e.g., AVs can be compromised using advanced hacking techniques) issues and prevents the faster realization of C-ITS applications. To address these challenges, this paper presents a privacy-preserving-based secure framework to provide both privacy and security in C-ITS infrastructure. The proposed framework provides two level of security and privacy using blockchain and deep learning modules. First, a blockchain module is designed to securely transmit the C-ITS data between AVs–RSUs-TCCs, and a smart contract-based enhanced Proof of Work (ePoW) technique is designed to verify data integrity and mitigate data poisoning attacks. Second, a deep-learning module is designed that includes Long-Short Term Memory-AutoEncoder (LSTM-AE) technique for encoding C-ITS data into a new format to prevent inference attacks. The encoded data is used by the proposed Attention-based Recurrent Neural Network (A-RNN), for intrusive events recognition in C-ITS infrastructure. The proposed A-RNN is trained using Truncated Backpropagation Through Time (BPTT) algorithm. The framework is further validated and tested using two publicly available ToN-IoT and CICIDS-2017 datasets. The proposed framework is compared with peer privacy-preserving intrusion detection techniques, and the result shows the effectiveness of the proposed framework over several state-of-the-art techniques in both blockchain and non-blockchain systems. [ABSTRACT FROM AUTHOR]

The rate of internet traffic in the digital world has expanded fast due to technological improvement. Because of the large number of internet users, there is a large volume of network traffic, and it is the most common and challenging task to evaluate, process, and store the data. The intrusion detection systems enhance the performance of early attacks prediction and malicious attack detection. The exiting techniques met a few challenges in terms of feature selection, computational cost, accuracy, higher dimensionality, computational time and so forth. To solve these issues, we proposed a novel deep learning model for intrusion detection in big data. The data was collected from NSL‐KDD, KDD‐Cup99, and UNSW‐NB15 datasets. Initially, the big data framework with a testbed is set up for big data analytics and processing in which the required information from a large volume is extracted. The datasets are stored in the Hadoop Distributed File System, which reduces the number of latencies in the distributed process. Finally, the intrusion detection from big data is performed using convolutional neural network‐based Hybrid Whale Tabu Optimization algorithm and it effectively classifies whether the data is intrusion is non‐intrusion. The proposed method provided appropriate and superior experimental results using the state‐of‐art method with various performance measures such as accuracy, Matthews correlation coefficient, balanced accuracy, specificity, sensitivity, precision, and F‐measures. [ABSTRACT FROM AUTHOR]

Low-power and Lossy Networks (LLNs) comprise nodes characterised by constrained computational power, memory, and energy resources. The LLN nodes empower ubiquitous connections amongst numerous devices (e.g. temperature, humidity, and turbidity sensors, together with motors, valves and other actuators) to sense, control and store properties of their environments. They are often deployed in hostile, unattended, and unfavourable conditions. Securing them often becomes very challenging. The extent of interconnected LLN devices poses a series of routing threats (e.g. wormhole, grayhole, DIO suppression, and increase rank attacks). Consequently, an efficient and effective intrusion detection system (IDS) is of utmost importance in identifying anomalous activities in the IPv6 over Low-powered Wireless Personal Area Networks (6LoWPAN). This article proposes a robust Adversarial Reinforcement Learning (ARL) framework to generate efficient IDSs for evolving data environments. The integration of ARL and incremental machine-learning facilitates the generation of resource-efficient and robust IDS detectors. We demonstrate in particular how such an approach, leveraging notions of ‘concept drift’ detection and adaptation, can handle inevitable changes in the environment, giving the IDS best chances of detecting attacks in the current profile. The range of routing attacks considered is the most comprehensive to date. For the first time, Black-box and Grey-box ML-based adversaries aiming to destabilise the 6LoWPAN are distinguished and addressed. [ABSTRACT FROM AUTHOR]

Deploying Intrusion Detection Systems (IDSs) is an essential way to enhance the security of Multi-hop Clustered Wireless Sensor Networks (MCWSNs). The conventional IDS deployment architectural designs show limitations in ensuring the security of MCWSNs due to the limited monitoring range of the nodes. This paper proposes an efficient IDS deployment architecture for MCWSNs. The architecture is a hybrid design, in which the cluster heads and the sink collaboratively act as IDS agents to monitor the entire network and perform intrusion detection. Based on the new architecture, this paper proposes a resource allocation model to optimally allocate resources among the IDS agents so that the network’s security metric can be maximized. A comprehensive analytical framework is proposed to analyze the optimality of the model’s solution, and an efficient computational approach is developed to obtain the optimal resource allocation strategy. Extensive numerical simulation and comparison studies are conducted to validate the proposed method. [ABSTRACT FROM AUTHOR]

In this paper, we propose H-IDFS, a Histogram-based Intrusion Detection and Filtering framework, which assembles the CAN packets into windows, and computes their corresponding histograms. The latter are fed to a multi-class IDS classifier to identify the class of the traffic windows. If the window is found malicious, the filtering system is invoked to filter out the normal CAN packets from each malicious window. To this end, we propose a novel one-class SVM, named OCSVM-attack that is trained on normal traffic and considers the invariant and quasi-invariant features of the attack. Experimental results on two CAN datasets: OTIDS and Car-Hacking, show the superiority of the proposed H-IDFS, as it achieves an accuracy of 100% for window classification, and correctly filters out between 94.93% and 100% of normal packets from malicious windows. [ABSTRACT FROM AUTHOR]

Internet Protocol version 6 (IPv6) and its core protocol, Internet Control Message Protocol version 6 (ICMPv6), need to be secured from attacks, such as Denial of Service (DoS) and Distributed DoS (DDoS), in order to be reliable for deployment. Several Intrusion Detection Systems (IDSs) have been built and proposed to detect ICMPv6-based DoS and DDoS attacks. However, these IDSs suffer from several drawbacks, such as the inability to detect novel attacks and a low detection accuracy due to their reliance on packet-based traffic representation. Furthermore, the existing IDSs that rely on flow-based traffic representation use simple heuristics features that do not contribute to detecting ICMPv6-based DoS and DDoS attacks. This paper proposes a flow-based IDS by enriching the existing features with a set of new features to improve the detection accuracy. The flow consists of packets with similar attributes (i.e., packets with the same source and destination IP address) and features that can differentiate between normal and malicious traffic behavior, such as the source IP address’s symmetry and the whole flow’s symmetry. The experimental results reveal that the enriched features significantly improved the IDS’s detection accuracy by 16.02% and that the false positive rate decreased by 19.17% compared with state-of-the-art IDSs.

The modern Internet of Things (IoT)-based smart home is a challenging environment to secure: devices change, new vulnerabilities are discovered and often remain unpatched, and different users interact with their devices differently and have different cyber risk attitudes. A security breach’s impact is not limited to cyberspace, as it can also affect or be facilitated in physical space, for example, via voice. In this environment, intrusion detection cannot rely solely on static models that remain the same over time and are the same for all users. We present MAGPIE, the first smart home intrusion detection system that is able to autonomously adjust the decision function of its underlying anomaly classification models to a smart home’s changing conditions (e.g., new devices, new automation rules and user interaction with them). The method achieves this goal by applying a novel probabilistic cluster-based reward mechanism to non-stationary multi-armed bandit reinforcement learning. MAGPIE rewards the sets of hyperparameters of its underlying isolation forest unsupervised anomaly classifiers based on the cluster silhouette scores of their output. Experimental evaluation in a real household shows that MAGPIE exhibits high accuracy because of two further innovations: it takes into account both cyber and physical sources of data; and it detects human presence to utilise models that exhibit the highest accuracy in each case. MAGPIE is available in open-source format, together with its evaluation datasets, so it can benefit from future advances in unsupervised and reinforcement learning and be able to be enriched with further sources of data as smart home environments and attacks evolve. [ABSTRACT FROM AUTHOR]

Intelligent Transportation Systems (ITS), especially Autonomous Vehicles (AVs), are vulnerable to security and safety issues that threaten the lives of the people. Unlike manual vehicles, the security of communications and computing components of AVs can be compromised using advanced hacking techniques, thus barring AVs from the effective use in our routine lives. Once manual vehicles are connected to the Internet, called the Internet of Vehicles (IoVs), it would be exploited by cyber-attacks, like denial of service, sniffing, distributed denial of service, spoofing and replay attacks. In this article, we present a deep learning-based Intrusion Detection System (IDS) for ITS, in particular, to discover suspicious network activity of In-Vehicles Networks (IVN), vehicles to vehicles (V2V) communications and vehicles to infrastructure (V2I) networks. A Deep Learning architecture-based Long-Short Term Memory (LSTM) autoencoder algorithm is designed to recognize intrusive events from the central network gateways of AVs. The proposed IDS is evaluated using two benchmark datasets, i.e., the car hacking dataset for in-vehicle communications and the UNSW-NB15 dataset for external network communications. The experimental results demonstrated that our proposed system achieved over a 99% accuracy for detecting all types of attacks on the car hacking dataset and a 98% accuracy on the UNSW-NB15 dataset, outperforming other eight intrusion detection techniques. [ABSTRACT FROM AUTHOR]

Nowadays, due to the increasing use of the Internet, security of computer systems and networks has become one of the main quality of service (QoS) criteria in ICT-based services. Apart from using traditional security solutions in software systems such as cryptography, firewalls and access control mechanisms, utilizing intrusion detection systems are also necessary. Intrusion detection is a process in which a set of methods are used to detect malicious activities against the victims. Many techniques for detecting potential intrusions in software systems have already been introduced. One of the most important techniques for intrusion detection based on machine learning is using Hidden Markov Models (HMM). Three main advantages of these techniques are high degree of precision, detecting unseen intrusion activities, and visual representation of intrusion models. Hence, in recent decades, many research communities have been working in HMM-based intrusion detection. Therefore, a large volume of research works has been published and hence, various research areas have emerged in this field. However, until now, there has been no systematic and up-to-date review of research works within the field. This paper aims to survey the research in this field and provide open problems and challenges based on the analysis of advantages, limitations, types of architectural models, and applications of current techniques.

Over the years, the amount of data shared between users from different areas have grown considerably. Consequently, so did network attacks. Security monitoring strategies must classify information types on networks quickly and effectively. Intrusion Detection Systems have been proposed with Machine Learning techniques and High-Performance Computing to avoid security anomalies. Thus, FPGA devices are good candidates to improve performance and energy efficiency. In this brief, we propose a reconfigurable FPGA-based K-means/K-modes architecture to accelerate the data clustering for network intrusion detection. We evaluated our approach over NSL-KDD data set and the results showed that K-means and K-modes can achieve up to 15 $\times$ and 994 $\times$ more operations per Watt than parallel software versions. [ABSTRACT FROM AUTHOR]

Ethereum smart contracts are programs that can be collectively executed by a network of mutually untrusted nodes. Smart contracts handle and transfer assets of values, offering strong incentives for malicious attacks. Intrusion attacks are a popular type of malicious attacks. In this article, we propose ContractGuard, the first intrusion detection system (IDS) to defend Ethereum smart contracts against such attacks. Like IDSs for conventional programs, ContractGuard detects intrusion attempts as abnormal control flow. However, existing IDS techniques/tools are inapplicable to Ethereum smart contracts due to Ethereum's decentralized nature and its highly restrictive execution environment. To address these issues, we design ContractGuard by embedding it in the contracts to profile context-tagged acyclic paths, and optimizing it under the Ethereum gas-oriented performance model. The main goal is to minimize the overheads, to which the users will be extremely sensitive since the cost needs to be paid upfront in digital concurrency. Empirical investigation using real-life contracts deployed in the Ethereum mainnet shows that on average, ContractGuard only adds to 36.14 percent of the deployment overhead and 28.27 percent of the runtime overhead. Furthermore, we conducted controlled experiments and show that ContractGuard successfully guard against attacks on all real-world vulnerabilities and 83 percent of the seeded vulnerabilities. [ABSTRACT FROM AUTHOR]