Search

Bug triaging is the process of prioritizing bugs based on their severity, frequency, and risk in order to be assigned to appropriate developers for validation and resolution. This article introduces a graph-based feature augmentation approach for enhancing bug triaging systems using machine learning. A new feature augmentation approach that utilizes graph partitioning based on neighborhood overlap is proposed. Neighborhood overlap is a quite effective approach for discovering relationships in social graphs. Terms of bug summaries are represented as nodes in a graph, which is then partitioned into clusters of terms. Terms in strong clusters are augmented to the original feature vectors of bug summaries based on the similarity between the terms in each cluster and a bug summary. We employed other techniques such as term frequency, term correlation, and topic modeling to identify latent terms and augment them to the original feature vectors of bug summaries. Consequently, we utilized frequency, correlation, and neighborhood overlap techniques to create another feature augmentation approach that enriches the feature vectors of bug summaries to use them for bug triaging. The new modified vectors are used to classify bug reports into different priorities. Bug Triage in this context is to correctly recognize the priority of new bugs. Several classification algorithms are tested using the proposed methods. Experimental results on a data set with Eclipse bug reports extracted from the Bugzilla tracking system have shown that our approach outperformed the existing bug triaging systems including modern techniques that utilize deep learning.

Association rule mining is a very useful knowledge discovery technique to identify co-occurrence patterns in transactional data sets. In this article, the authors proposed an ontology-based framework to discover multi-dimensional association rules at different levels of a given ontology on user defined pre-processing constraints which may be identified using, 1) a hierarchy discovered in datasets; 2) the dimensions of those datasets; or 3) the features of each dimension. The proposed framework has post-processing constraints to drill down or roll up based on the rule level, making it possible to check the validity of the discovered rules in terms of support and confidence rule validity measures without re-applying association rule mining algorithms. The authors conducted several preliminary experiments to test the framework using the Titanic dataset by identifying the association rules after pre- and post-constraints are applied. The results have shown that the framework can be practically applied for rule pruning and discovering novel association rules.

Cyber-attacks continue to increase worldwide, leading to significant loss or misuse of information assets. Most of the existing intrusion detection systems rely on per-packet inspection, a resource consuming task in today’s high speed networks. A recent trend is to analyze netflows (or simply flows) instead of packets, a technique performed at a relative low level leading to high false alarm rates. Since analyzing raw data extracted from flows lacks the semantic information needed to discover attacks, a novel approach is introduced, which uses contextual information to automatically identify and query possible semantic links between different types of suspicious activities extracted from flows. Time, location, and other contextual information mined from flows is applied to generate semantic links among alerts raised in response to suspicious flows. These semantic links are identified through an inference process on probabilistic semantic link networks (SLNs), which receive an initial prediction from a classifier that analyzes incoming flows. The SLNs are then queried at run-time to retrieve other relevant predictions. We show that our approach can be extended to detect unknown attacks in flows as variations of known attacks. An extensive validation of our approach has been performed with a prototype system on several benchmark datasets yielding very promising results in detecting both known and unknown attacks.

Software Defined Networking is an emerging architecture which focuses on the role of software to manage computer networks. Software Defined Networks (SDNs) introduce several mechanisms to detect specific types of attacks such as Denial of Service (DoS). Nevertheless, they are vulnerable to similar attacks that occur in traditional networks, such as the attacks that target control and data plane. Several techniques are proposed to handle the security vulnerabilities in SDNs. However, it is fairly challenging to create attack signatures, scenarios, or even intrusion detection rules that are applicable to dynamic environments such SDNs. This paper introduces a new approach to identify attacks on SDNs that uses: (1) similarity with existing attacks that target traditional networks, (2) an inference mechanism to avoid false positives and negatives during the prediction process, and (3) a packet aggregation technique which aims at creating attack signatures and use them to predict attacks on SDNs. We validated our approach on two datasets and showed that it yields promising results.

The recent evolution in programmable networks such as SDN opens the possibility to control networks using software controllers. However, such networks are vulnerable to attacks that occur in traditional networks. Several techniques are proposed to handle the security vulnerabilities in SDNs. However, it is challenging to create attack signatures, scenarios, or even intrusion detection rules that are applicable to SDN dynamic environments. Generative Adversarial Deep Neural Networks automates the generation of realistic data in a semi supervised manner. This paper describes an approach that generates synthetic attacks that can target SDNs. It can be used to train SDNs to detect different attack variations. It is based on the most recent OpenFlow models/algorithms and it utilizes similarity with known attack patterns to identify attacks. Such synthesized variations of attack signatures are shown to attack SDNs using adversarial approaches.

Recently, Internet of Vehicles (IoVs) has been recognised as a key solution for vehicular communications. Connected vehicles and infrastructure' roadside units have been shaping the underlying architecture of IoVs technology, where the conventional routing protocols cannot facilitate reliable and efficient communication for dynamic IoVs topologies. Hence, this technology is highly susceptible to frequent network fragmentations, thus exposing communication channels to regular failure problems. This paper, thus, introduces a novel routing repair strategy, referred as Reliable Route Repairing Strategy (RRRS) to tackle routing failure problems. Repairing the operation of channel communications is prioritised according to a stability degree of the connected vehicles. The RRRS features are combined with the traditional AOMDV protocol, and a comparison study has been conducted to compare the AOMDV, the RRRS-AOMDV and the HM-AOMDV protocols. The simulation results demonstrate that the RRRS-AOMDV achieves better performance, about 30% to 45% in terms of packets overhead and latency.