Search

Cloud computing environments, characterized by dynamic scaling, distributed architectures, and complex workloads, are increasingly targeted by malicious actors. These threats encompass unauthorized access, data breaches, denial-of-service attacks, and evolving malware variants. Traditional security solutions often struggle with the dynamic nature of cloud environments, highlighting the need for robust Adaptive Cloud Intrusion Detection Systems (CIDS). Existing adaptive CIDS solutions, while offering improved detection capabilities, often face limitations such as reliance on approximations for change point detection, hindering their precision in identifying anomalies. This can lead to missed attacks or an abundance of false alarms, impacting overall security effectiveness. To address these challenges, we propose ACIDS (Adaptive Cloud Intrusion Detection System)-PELT. This novel Adaptive CIDS framework leverages the Pruned Exact Linear Time (PELT) algorithm and a Support Vector Machine (SVM) for enhanced accuracy and efficiency. ACIDS-PELT comprises four key components: (1) Feature Selection: Utilizing a hybrid harmony search algorithm and the symmetrical uncertainty filter (HSO-SU) to identify the most relevant features that effectively differentiate between normal and anomalous network traffic in the cloud environment. (2) Surveillance: Employing the PELT algorithm to detect change points within the network traffic data, enabling the identification of anomalies and potential security threats with improved precision compared to existing approaches. (3) Training Set: Labeled network traffic data forms the training set used to train the SVM classifier to distinguish between normal and anomalous behaviour patterns. (4) Testing Set: The testing set evaluates ACIDS-PELT's performance by measuring its accuracy, precision, and recall in detecting security threats within the cloud environment. We evaluate the performance of ACIDS-PELT using the NSL-KDD benchmark dataset. The results demonstrate that ACIDS-PELT outperforms existing cloud intrusion detection techniques in terms of accuracy, precision, and recall. This superiority stems from ACIDS-PELT's ability to overcome limitations associated with approximation and imprecision in change point detection while offering a more accurate and precise approach to detecting security threats in dynamic cloud environments. [ABSTRACT FROM AUTHOR]

Vehicular ad hoc networks have emerged as the main building block for the future cooperative intelligent transportation system (cITS) to improve road safety and traffic efficiency and to provide passenger comfort. However, vehicular networks are decentralized, characterized by high mobility and dynamicity, and vehicles move in a hostile environment; such characteristics make VANET applications suffer many security and communication issues. Recently, blockchain has been suggested to solve several VANET issues including the dissemination of trustworthy life-threatening information. However, existing dissemination schemes are inefficient for safety messages and are vulnerable to malicious nodes and rely on the majority of honest assumptions. In the VANET context, adversaries may collude to broadcast false information causing serious safety threats. This study proposes an intelligent proof-of-trustworthiness-based secure safety message dissemination scheme (PoTMDS) to efficiently share only trustworthy messages. The consistency and plausibility of the message were evaluated based on a predictive model developed using a convolutional neural network and signal properties such as the received signal strength and angle of arrival. A blockchain-based data dissemination scheme was developed to share critical messages. Each vehicle calculates the proof of trustworthiness of the disseminated messages by comparing the received message with the output of the prediction model. The results showed that the proposed scheme reduced the consensus delay by 58% and improved the detection accuracy by 7.8%. Therefore, the proposed scheme can have an important role in improving the applications of future cITS. [ABSTRACT FROM AUTHOR]

Ransomware is an ill-famed malware that has received recognition because of its lethal and irrevocable effects on its victims. The irreparable loss caused due to ransomware requires the timely detection of these attacks. Several studies including surveys and reviews are conducted on the evolution, taxonomy, trends, threats, and countermeasures of ransomware. Some of these studies were specifically dedicated to IoT and android platforms. However, there is not a single study in the available literature that addresses the significance of dynamic analysis for the ransomware detection studies for all the targeted platforms. This study also provides the information about the datasets collection from its sources, which were utilized in the ransomware detection studies of the diverse platforms. This study is also distinct in terms of providing a survey about the ransomware detection studies utilizing machine learning, deep learning, and blend of both techniques while capitalizing on the advantages of dynamic analysis for the ransomware detection. The presented work considers the ransomware detection studies conducted from 2019 to 2021. This study provides an ample list of future directions which will pave the way for future research. [ABSTRACT FROM AUTHOR]

With an increasing number of services connected to the internet, including cloud computing and Internet of Things (IoT) systems, the prevention of cyberattacks has become more challenging due to the high dimensionality of the network traffic data and access points. Recently, researchers have suggested deep learning (DL) algorithms to define intrusion features through training empirical data and learning anomaly patterns of attacks. However, due to the high dynamics and imbalanced nature of the data, the existing DL classifiers are not completely effective at distinguishing between abnormal and normal behavior line connections for modern networks. Therefore, it is important to design a self-adaptive model for an intrusion detection system (IDS) to improve the detection of attacks. Consequently, in this paper, a novel hybrid weighted deep belief network (HW-DBN) algorithm is proposed for building an efficient and reliable IDS (DeepIoT.IDS) model to detect existing and novel cyberattacks. The HW-DBN algorithm integrates an improved Gaussian-Bernoulli restricted Boltzmann machine (Deep GB-RBM) feature learning operator with a weighted deep neural networks (WDNN) classifier. The CICIDS2017 dataset is selected to evaluate the DeepIoT.IDS model as it contains multiple types of attacks, complex data patterns, noise values, and imbalanced classes. We have compared the performance of the DeepIoT.IDS model with three recent models. The results show the DeepIoT.IDS model outperforms the three other models by achieving a higher detection accuracy of 99.38% and 99.99% for web attack and bot attack scenarios, respectively. Furthermore, it can detect the occurrence of low-frequency attacks that are undetectable by other models. [ABSTRACT FROM AUTHOR]

Ransomware is malicious software that encrypts the user-related files and data and holds them to ransom. Such attacks have become one of the serious threats to cyberspace. The avoidance techniques that ransomware employs such as obfuscation and/or packing makes it difficult to analyze such programs statically. Although many ransomware detection studies have been conducted, they are limited to a small portion of the attack's characteristics. To this end, this paper proposed a framework for the behavioral-based dynamic analysis of high survivable ransomware (HSR) with integrated valuable feature sets. Term Frequency-Inverse document frequency (TF-IDF) was employed to select the most useful features from the analyzed samples. Support Vector Machine (SVM) and Artificial Neural Network (ANN) were utilized to develop and implement a machine learning-based detection model able to recognize certain behavioral traits of high survivable ransomware attacks. Experimental evaluation indicates that the proposed framework achieved an area under the ROC curve of 0.987 and a few false positive rates 0.007. The experimental results indicate that the proposed framework can detect high survivable ransomware in the early stage accurately. [ABSTRACT FROM AUTHOR]

Life-saving decisions in vehicular ad hoc networks (VANETs) depend on the availability of highly accurate, up-to-date, and reliable data exchanged by neighboring vehicles. However, spreading inaccurate, unreliable, and false data by intruders create traffic illusions that may cause loss of lives and assets. Although several solutions for misbehavior detection have been proposed to address these issues, those solutions lack adequate representation and the adaptability to vehicular context. The use of predefined static thresholds and lack of comprehensive context representation have rendered the existing solutions limited to specific scenarios and attack types, which impedes their generalizability. This paper addresses these limitations by proposing an ensemble-based hybrid context-aware misbehavior detection system (EHCA-MDS) model. EHCA-MDS has been developed in four phases, as follows. The static thresholds have been replaced by dynamic ones created on the fly by analyzing the spatial and temporal properties of the mobility information collected from neighboring vehicles. Kalman filter-based algorithms were used to collect the mobility information of neighboring vehicles. Three sets of features were then derived, each of which has a different perspective, namely data consistency, data plausibility, and vehicle behavior. These features were used to construct a dynamic context reference using the Hampel filter. The Hampel-based z-score was used to evaluate the vehicles based on their behavioral activities, data consistency, and plausibility. For comprehensive features representation, multifaceted, non-parametric-based statistical classifiers were constructed and updated online using a Hampel filter-based algorithm. For accurate representation, the output of the statistical classifiers, vehicles' scores, context reference parameters, and the derived features were used as input to an ensemble learning-based algorithm. Such representation helps to identify the misbehaving vehicles more effectively. The proposed EHCA-MDS model was evaluated in the presence of different types of misbehaving vehicles under different context scenarios through extensive simulations, utilizing a real-world traffic dataset. The results show that the accuracy and robustness of the proposed EHCA-MDS under different vehicular dynamic context scenarios were higher than existing solutions, which confirms its feasibility and effectiveness to improve the performance of VANET critical applications. [ABSTRACT FROM AUTHOR]