Search

In the era of advanced cyber developments, intrusions becomes a common event in any network. Although there are research studies and developers found ways to improve the detection models, there is some problem that persists in the intrusion models such as extracting key features from a large dataset, and delayed detection is a critical issue that needs to be addressed. Hence the proposed study aimed to develop a model that could extract key features from the dataset and use them effectively in the detection of threats. The study incorporates two approaches, one is feature extraction by the K-Nearest Neighbourhood, and feature selection by the K-Best approach. And the other is the balanced Gini-Entropy approach for the Random Forest (RF) classifier. This combined approach by KNN, K-best, and RF is referred to as (KK-RF). This combined approach of feature extraction, selection, and classification results in an effective threat detection model with high accuracy of about 99.61%. Moreover the proposed model has achieved precision and the recall rates of 97.3 and 96.6% respectively. Concurrently, the model attained markable F1-score of 96.6 respectively. Also, from the comparison results, it is observed that the proposed model had higher performance. [ABSTRACT FROM AUTHOR]

This study develops an active security control strategy for Cyber-Physical Systems (CPSs) that are subject to attacks known as Denial-of-Service (DoS), which can target both channels from the controller to the actuator and from the controller to the sensor. Due to attack cost restrictions, the linked channels are subject to a limit on the number of continuous DoS attacks. A proactive security control method is then developed to combat two-channel DoS attacks, depending on a method for identifying IoT intrusions. Using the CICIDS dataset for attack detection, we examined the effectiveness of the Deep Convolutional Network Model (DCNM), a suggested deep learning model. The addressed CPS can be asymptotically stable against DoS assaults under the security controller's active security control technique without sacrificing control performance. Recent tests and simulations show how effective the security control strategy is active. The proposed model gives better trade-off compared to existing approaches like Deep Belief Networks (DBN), Recurrent Neural Networks (RNN), Support Vector Machines (SVM), Supervised Neural Networks (SNN) and Feed Forward Neural Networks (FNN). The proposed model gives 99.3%, 99.5%, 99.5%, 99.6%, 99%, 98.9%, 99% accuracy with normal attack detection, botnet attack detection, Brute force attack detection, DoS attack detection, Infiltration attack detection, Portscan attack detection and web attack detection respectively. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has gained popularity and is widely used in modern society. The growth in the sizes of IoT networks with more internet-connected devices has led to concerns regarding privacy and security. In particular, related to the routing protocol for low-power and lossy networks (RPL), which lacks robust security functions, many IoT devices in RPL networks are resource-constrained, with limited computing power, bandwidth, memory, and battery life. This causes them to face various vulnerabilities and potential attacks, such as DIO neighbor suppression attacks. This type of attack specifically targets neighboring nodes through DIO messages and poses a significant security threat to RPL-based IoT networks. Recent studies have proposed methods for detecting and mitigating this attack; however, they produce high false-positive and false-negative rates in detection tasks and cannot fully protect RPL networks against this attack type. In this paper, we propose a novel fuzzy logic-based intrusion detection scheme to secure the RPL protocol (FLSec-RPL) to protect against this attack. Our method is built of three key phases consecutively: (1) it tracks attack activity variables to determine potential malicious behaviors; (2) it performs fuzzy logic-based intrusion detection to identify malicious neighbor nodes; and (3) it provides a detection validation and blocking mechanism to ensure that both malicious and suspected malicious nodes are accurately detected and blocked. To evaluate the effectiveness of our method, we conduct comprehensive experiments across diverse scenarios, including Static-RPL and Mobile-RPL networks. We compare the performance of our proposed method with that of the state-of-the-art methods. The results demonstrate that our method outperforms existing methods in terms of the detection accuracy, F1 score, power consumption, end-to-end delay, and packet delivery ratio metrics. [ABSTRACT FROM AUTHOR]

Communication-based train control (CBTC) system is a typical cyber-physical system with open wireless communication that is vulnerable to attacks. To protect the security of wireless communication in the CBTC system, machine learning-based intrusion detection system (IDS) has been extensively researched. However, the performance of a machine learning-based IDS highly depends on feature design, and the spatial and temporal correlation of network data attributes makes it difficult to design features manually. Meanwhile, this type of IDS can only detect known attacks that are contained in the training dataset and fail to detect new attacks (i.e., zero-day attacks). To cope with the above issue, we propose a novel IDS based on transfer learning for the CBTC system. The proposed IDS leverages an optimized one-dimensional convolutional neural network block and long short-term memory to automatically extract spatial and temporal features from the original data. Furthermore, a knowledge transfer method is utilized to transfer the features to enable zero-day attack detection. We evaluate the proposed IDS on a dataset representing the CBTC system network data. The results show that the proposed IDS can achieve 99.32% accuracy for known attacks and 93.21% average F1-Score for zero-day attacks. [ABSTRACT FROM AUTHOR]

The openness and interconnectedness of industrial control systems (ICSs) is increasing, leading to a heightened risk of network-based attacks. Although research on industrial intrusion detection is ongoing, current methods often overlook the unique characteristics of industrial control flows. This study introduced an industrial network intrusion detection algorithm based on the improved gray wolf optimizer (IGWO) gated recurrent unit (GRU) model. Starting with the temporal aspects of industrial control network traffic, a simple GRU was chosen as the network model. By integrating the gray wolf optimizer (GWO) with autonomous learning methods, the algorithm could address the slow convergence caused by large volumes of industrial control network traffic. In response to the slow convergence of the GWO and its low optimization accuracy, this study developed the improved gray wolf optimizer (IGWO). By simulating an intrusion detection system (IDS) using datasets from the Natural Gas Pipeline Control System and Secure Water Treatment (SWaT) datasets, the experimental results demonstrated that the IGWO-GRU algorithm exhibited considerable advantages in terms of accuracy, false alarm rate, and false report rate, thereby enhancing the security capabilities of ICSs. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) tunes modern technologies, including wireless sensors and cloud computing, to create a homogeneous and highly effective environment. Therefore, IoT has emerged in various fields of life, such as healthcare, industry, and agriculture. Agriculture is among the primary components of developing nations' financial states and is vital in maintaining human life. However, the human capacity to reproduce far exceeds the capability of our planet to secure the food required for our lives. Hence, the emergence of IoT in this industry has seen essential advancements to help boost agriculture production and quality. In addition, this emergence exposes the smart agriculture environment to considerable cyber threats. This paper presents a network intrusion detection system (NIDS) to mitigate smart agriculture security vulnerabilities. We developed our framework using radial basis functions neural networks (RBFNN) to detect and classify intrusions in the IoT network. To get our model to perform in its best form, we applied crowd wisdom tree-based machine learning (ML) techniques to select relevant features from the datasets, such as random Forrest (RF), AdaBoost (ADA), extra trees (ET), LightGBM (LGBM), and XGBoost (XGB). We implemented a single-class support vector machine (1-CSVM) to detect and remove outliers. We evaluated our model using NF-Bot-IoT and NF-ToN-IoT datasets. It scored 99.25% accuracy (ACC) and 82.97% Matthews correlation coefficient (MCC) and 90.05% MCC and 96.92% ACC on preprocessed NF-Bot-IoT and NF-ToN-IoT, respectively. Our model showed outstanding performance in overcoming the NF-Bot-IoT dataset imbalance. [ABSTRACT FROM AUTHOR]

The Industrial IoT system often struggles to identify malignant traffic and may cause disruption in the flow of work or even hazardous situations. The previously described techniques to identify such intrusions work well but not enough to be implemented in such environments where it is very difficult to identify malignant traffic in loads of benign ones. Hence, an intrusion detection system is needed that works well with very highly unbalanced datasets. Therefore, we developed a transformer model that gives a high accuracy and combined it with a boosting module that decreases false negatives, which is highly required. This model is applied to the UNSW-2018-IoT-Botnet dataset, which is publicly available in the cloudstor network. Thus, the classified traffic identified as malignant is eliminated from the system using prevention techniques. The paper also extends the model to classify among five different traffics for the same dataset, in which some of the traffics are very difficult to distinguish, such as DoS and DDoS traffic. The experiments on such data sets have shown much better results, which proves that the model classifies well and can be implemented practically as well. [ABSTRACT FROM AUTHOR]

Summary: Intrustion Detection System (IDS) refers to the gear or software that monitors a network or system for malicious activity or policy violations. Periodically, the system records any intrusion action or breach, which frequently modifies the administrator. Cyber Physical System (CPS) is particularly called as networked connected system, in which the system components are spatially distributed and integrated via the communication network. The control mechanism ensures computation significance; however, the system does affect attacks. Researchers are trying to handle this issue via the existing anomaly datasets. In this way, this paper follows an intrusion detection system under three major stages including extraction of features, selection of feature, and detection. The primary stage is the extraction of Statistical features like standard deviation, mean, mode, variance, and median, as well as higher‐order statistical features like moment, percentile, improved correlation, kurtosis, mutual information, skewness, flow‐based features, and information gain‐based features. The curse of dimensionality becomes a significant problem in this scenario, so it is crucial to choose the right features. Improved Linear Discriminant Analysis (LDA) is utilized to choose the right features. The selected features are subjected to a Hybrid classifier for final detection. Here, models like CNN (Convolutional Neural Network) and Bi‐GRU (Bidirectional Gated Recurrent Unit) are combined. A new Bernoulli Map Estimated Arithmetic Optimization Algorithm (BMEAOA) is added to train the system by adjusting the ideal weights of the two classifiers, leading to improved detection outcomes. Ultimately, the effectiveness is assessed in comparison to the other traditional techniques. [ABSTRACT FROM AUTHOR]

In addressing the challenge of diminished intrusion detection accuracy resulting from the abundance of redundant and irrelevant features in high-dimensional network data, an improved multi-factorial optimization bat algorithm (IMFBA) was introduced for precise data feature selection, with the ultimate goal of improving network intrusion detection accuracy. Within the multi-factorial optimization framework, global and local feature selection tasks were formulated. Information exchange between these tasks was facilitated by selection and vertical cultural transmission operators, strategically designed based on the bat algorithm. The global feature selection task was accelerated in identifying optimal solution spaces, thereby enhancing the algorithm's convergence speed and stability. By incorporating the reverse learning strategy and differential evolution into the bat algorithm, the initial solution selection stage and individual updating process were refined to address the absence of a mutation mechanism, fostering solution diversity and aiding the algorithm in escaping local optima. An adaptive parameter adjustment strategy was introduced, determining weightings for guiding individual updates based on potential optimal solution quality. This could mitigate the risk of knowledge negative transfer during multi-task feature selection, achieving a balance between global exploration and local exploitation. The feature subsets selected by IMFBA demonstrate classification accuracy of 95.37% and 85.14% on the KDD CUP 99 and NSL-KDD intrusion detection datasets, respectively. This reflected increased by 3.01 percentage points and 9.78 percentage points compared to the complete dataset. Experiment results confirm the efficacy of EMFBA in selecting higher-quality feature subsets and, consequently, enhancing network intrusion detection accuracy. [ABSTRACT FROM AUTHOR]

Sixth-generation (6G) wireless networks are anticipated to undergo trials and installations as early as 2030, offering unprecedented capacity, dependability, and efficiency. However, attention is shifting towards the development of 6G networks to meet the demands of emerging applications. The transition to 6G brings new challenges, particularly in the realm of intrusion detection, where the sophistication of attacks necessitates advanced security solutions. To eliminate this challenge, a novel Hybrid Intrusion DEtection system for the 6G network (HIDE-6G) has been proposed to detect intrusion in the 6G network. The proposed method leverages advanced techniques such as Principal Component Analysis (PCA) for dimensionality reduction, a Spotted Hyena Optimization Algorithm for feature selection, and a Capsule Network-based Deep Autoencoder (CapsDA) for effective anomaly detection. The performance of the HIDE-6G is estimated using the NSL-KDD and CICIDS 2019 datasets, demonstrating superior results compared to existing techniques such as AD6GN, IDSoft, and LA-HLRW. According to the comparison analysis, the proposed HIDE-6G technique's detection rate is 6.10%, 22.27%, and 20.7% greater than the existing HADES-IoT, H3SC-DLIDS, and F-BIDS techniques respectively. [ABSTRACT FROM AUTHOR]

Authentication of clients and their applications to cloud services is a major concern. Network security and the identification of hostile activities are greatly aided by intrusion detection systems (IDS). In general, optimisation strategies can be applied to improve IDS model performance. Convolutional neural networks (CNN) and other deep learning (DL) algorithms is utilised to enhance IDS’s capability to identify and categories intrusions. IDSs can identify prior attacks, adapt to changing threats, and minimise false positives by utilising these strategies. In this work, a lightweight CNN is proposed for intrusion detection in cloud environment. The main contribution of this research is to use particle swarm optimization (PSO), ametaheuristic algorithm to find the CNNs optimal parameters that comprise the number of convolutional layers, the size of the filter utilized in the convolutional procedure, the number of convolutional filters, and the batch size. Heuristicbased searches are useful for solving these kinds of problems. The experimental outcomes demonstrate that the proposed method reaches 91.70% of accuracy, 91.82% of precision, 91.99% of recall and 91.90% of F1-score. Cloud providers can gain from improved security measures by incorporating the proposed IDS paradigm into cloud settings, thereby minimizing unauthorized access and any data breaches. [ABSTRACT FROM AUTHOR]

Particularly in Internet of Things (IoT) scenarios, the rapid growth and diversity of network traffic pose a growing challenge to network intrusion detection systems (NIDs). In this work, we perform a comparative analysis of lightweight machine learning models, such as logistic regression (LR) and k-nearest neighbors (KNNs), alongside other machine learning models, such as decision trees (DTs), support vector machines (SVMs), multilayer perceptron (MLP), and random forests (RFs) with deep learning architectures, specifically a convolutional neural network (CNN) coupled with bidirectional long short-term memory (BiLSTM), for intrusion detection. We assess these models' scalability, performance, and robustness using the NSL-KDD and UNSW-NB15 benchmark datasets. We evaluate important metrics, such as accuracy, precision, recall, F1-score, and false alarm rate, to offer insights into the effectiveness of each model in securing network systems within IoT deployments. Notably, the study emphasizes the utilization of lightweight machine learning models, highlighting their efficiency in achieving high detection accuracy while maintaining lower computational costs. Furthermore, standard deviation metrics have been incorporated into the accuracy evaluations, enhancing the reliability and comprehensiveness of our results. Using the CNN-BiLSTM model, we achieved noteworthy accuracies of 99.89% and 98.95% on the NSL-KDD and UNSW-NB15 datasets, respectively. However, the CNN-BiLSTM model outperforms lightweight traditional machine learning methods by a margin ranging from 1.5% to 3.5%. This study contributes to the ongoing efforts to enhance network security in IoT scenarios by exploring a trade-off between traditional machine learning and deep learning techniques. [ABSTRACT FROM AUTHOR]

As the IoT market continues to rapidly expand, ensuring the security of IoT systems becomes increasingly critical. This paper aims to identify emerging trends and technologies in IoT intrusion detection. A bibliometric analysis of research trends in IoT intrusion detection, leveraging data from the Web of Science (WoS) repository, is conducted to understand the landscape of publications in this field. The analysis reveals a significant increase in publications on intrusion detection in IoT, indicating growing research interest. Research articles are the leading category of publications, and the analysis also highlights the collaborative linkages among authors, institutions, and nations. Co-occurrence analysis and citation analysis provide insights into the relationships among keywords and the impact of publications. The study also identifies keyword and publication citation burst detection, with recommendations for future research focusing on advanced machine learning techniques to enhance intrusion/anomaly detection. This comprehensive analysis offers valuable guidance for diverse and extensive applications in IoT intrusion detection. [ABSTRACT FROM AUTHOR]

As the number and cleverness of cyber-attacks keep increasing rapidly, it's more important than ever to have good ways to detect and prevent them. Recognizing cyber threats quickly and accurately is crucial because they can cause severe damage to individuals and businesses. This paper takes a close look at how we can use artificial intelligence (AI), including machine learning (ML) and deep learning (DL), alongside metaheuristic algorithms to detect cyber-attacks better. We've thoroughly examined over sixty recent studies to measure how effective these AI tools are at identifying and fighting a wide range of cyber threats. Our research includes a diverse array of cyberattacks such as malware attacks, network intrusions, spam, and others, showing that ML and DL methods, together with metaheuristic algorithms, significantly improve how well we can find and respond to cyber threats. We compare these AI methods to find out what they're good at and where they could improve, especially as we face new and changing cyber-attacks. This paper presents a straightforward framework for assessing AI Methods in cyber threat detection. Given the increasing complexity of cyber threats, enhancing AI methods and regularly ensuring strong protection is critical. We evaluate the effectiveness and the limitations of current ML and DL proposed models, in addition to the metaheuristic algorithms. Recognizing these limitations is vital for guiding future enhancements. We're pushing for smart and flexible solutions that can adapt to new challenges. The findings from our research suggest that the future of protecting against cyber-attacks will rely on continuously updating AI methods to stay ahead of hackers' latest tricks. [ABSTRACT FROM AUTHOR]

Intrusion detection in industrial control systems (ICS) is crucial for maintaining the security of physical information systems. However, the existing models predominantly rely on black-box approaches, which exhibit limitations in result credibility and the ability to adapt to complex and dynamic environments. Consequently, this paper proposes an online updatable extended belief rule base model (O-EBRB) for intrusion detection in ICS. Firstly, an industrial intrusion detection model rooted in the extended belief rule base (EBRB) is established. This model excels in concurrently processing both quantitative and qualitative data, ensuring the reliability of its outcomes. Subsequently, a novel domain-based rule update methodology for integrating new observation data is proposed. By incorporating or merging fresh data into the original model, it enhances the model's adaptability in dynamic settings. Finally, employing the domain-based rule weight calculation approach, the model continues to effectively compute model parameters even with the continuous expansion of rules. Through extensive experimentation on two real-world industrial intrusion detection datasets, the results demonstrate the effectiveness of the proposed model in handling information and its robust performance in dynamic environments. [ABSTRACT FROM AUTHOR]

Embedded systems, including the Internet of things (IoT), play a crucial role in the functioning of critical infrastructure. However, these devices face significant challenges such as memory footprint, technical challenges, privacy concerns, performance trade-offs and vulnerability to cyber-attacks. One approach to address these concerns is minimising computational overhead and adopting lightweight intrusion detection techniques. In this study, we propose a highly efficient model called optimized common features selection and deep-autoencoder (OCFSDA) for lightweight intrusion detection in IoT environments. The proposed OCFSDA model incorporates feature selection, data compression, pruning, and deparameterization. We deployed the model on a Raspberry Pi4 using the TFLite interpreter by leveraging optimisation and inferencing with semi-supervised learning. Using the MQTT-IoT-IDS2020 and CIC-IDS2017 datasets, our experimental results demonstrate a remarkable reduction in the computation cost in terms of time and memory use. Notably, the model achieved an overall average accuracies of 99% and 97%, along with comparable performance on other important metrics such as precision, recall, and F1-score. Moreover, the model accomplished the classification tasks within 0.30 and 0.12 s using only 2KB of memory. [ABSTRACT FROM AUTHOR]

In order to further reduce the probability of multiple networks being attacked, different types of network security situation prediction models have received widespread attention and in depth research from scholars both domestically and internationally. With the rapid development of situational awareness modeling technology, various novel technical solutions such as neural networks, time series, and support vector machines have been introduced into the prediction model of network security situations, deeply optimizing and improving the means and methods of situational prediction models, thereby further improving the accuracy of situational prediction models. This study reviews and sorts out the research history and development process of network security situation prediction technology, elaborates on the main principles and current development status of situation prediction models, analyzes the shortcomings and deficiencies of current technical solutions, and points out the future research directions of network security situation prediction model technology. [ABSTRACT FROM AUTHOR]

Wireless sensor networks (WSNs) play a very important role in providing real-time data access for big data and internet of things applications. Despite this, WSNs’ open deployment makes them highly susceptible to various malicious attacks, energy constraints, and decentralized governance. For mission-critical applications in WSNs, it is crucial to identify rogue sensor devices and remove the sensed data they contain. The resource-constrained nature of sensor devices prevents the direct application of standard cryptography and authentication techniques in WSNs. Low latency and energy-efficient methods are therefore needed. An efficient and safe routing system is created in this study. Initially the outliers are detected from deployed nodes using stacking based ensemble learning approach. Deep neural network (DNN) and long short term memory (LSTM) are two different basic classifiers and multilayer perceptron (MLP) is utilized as a Meta classifier in the ensemble method. The normal nodes are considered for further process. Then, distance, density and residual energy based cluster head selection and cluster formations are done. Sunflower optimization algorithm (SOA) is employed in this approach for routing purpose to improve energy efficiency and load balancing. Superior transmission routing can potentially obtained by taking the shortest way. This proposed method achieves 95% accuracy for the intrusion detection phase and 92% is the packet delivery ratio for energy efficient routing. Consequently, the proposed method is the most effective option for load balancing with intrusion detection. [ABSTRACT FROM AUTHOR]

Accurate identification of malicious traffic is crucial for implementing effective defense counter-measures and has led to extensive research efforts. However, the continuously evolving techniques employed by adversaries have introduced the issues of concept drift, which significantly affects the performance of existing methods. To tackle this challenge, some researchers have focused on improving the separability of malicious traffic representation and designing drift detectors to reduce the number of false positives. Nevertheless, these methods often overlook the importance of enhancing the generalization and intraclass consistency in the representation. Additionally, the detectors are not sufficiently sensitive to the variations among different malicious traffic classes, which results in poor performance and limited robustness. In this paper, we propose intraclass consistency enhanced variational autoencoder with Class-Perception detector (ICE-CP) to identify malicious traffic under concept drift. It comprises two key modules during training: intraclass consistency enhanced (ICE) representation learning and Class-Perception (CP) detector construction. In the first module, we employ a variational autoencoder (VAE) in conjunction with Kullback-Leibler (KL)-divergence and cross-entropy loss to model the distribution of each input malicious traffic flow. This approach simultaneously enhances the generalization, interclass consistency, and intraclass differences in the learned representation. Consequently, we obtain a compact representation and a trained classifier for non-drifting malicious traffic. In the second module, we design the CP detector, which generates a centroid and threshold for each malicious traffic class separately based on the learned representation, depicting the boundaries between drifting and non-drifting malicious traffic. During testing, we utilize the trained classifier to predict malicious traffic classes for the testing samples. Then, we use the CP detector to detect the potential drifting samples using the centroid and threshold defined for each class. We evaluate ICE-CP and some advanced methods on various real-world malicious traffic datasets. The results show that our method outperforms others in identifying malicious traffic and detecting potential drifting samples, demonstrating outstanding robustness among different concept drift settings. [ABSTRACT FROM AUTHOR]

Advanced machine learning and artificial intelligence-based malware identification and categorization activities in real time are the primary emphasis of Malware Analysis and Intrusion identification in Cyber Physical Systems, along with the time sequence output of observed activity. Malware and other cyber threats have prompted the development of numerous static and behavior based detection approaches. These cyber security solutions show promise on large datasets, but they aren't reliable or resilient enough for real-world detection. Problems like virus detection and the identification of malevolent behavior highlight the critical need for improved cyber security solutions based on artificial intelligence. For those who utilize the internet, malware has become an enormous issue. The application is executed in a secure virtual environment and its actions are tracked in real-time to facilitate dynamic malware detection. A lot of people utilize API sequence analysis to find out if the software that is currently running is dangerous. While existing systems do consider API names and usage frequencies, feature mining of API sequence falls short, making it possible for some malware to evade detection. The two mainstays of dynamic analysis now in use either modify the virus itself or use an elevated component to execute the analysis. In contrast to the latter, which usually causes a discernible performance overhead, the former is instantly identifiable by even the most sophisticated malware. One of the most important steps in avoiding cyber assaults is developing new cyber security methods to detect hostile nodes before they communicate. Traditional dynamic malware detection models need to monitor the nodes more keenly for deep pattern analysis and eradicating nodes that cause malicious actions in the network. This research proposes a Dynamic Malware Pattern Analysis with Rapid Node Behaviour Analysis using Self Replication Model (DMPA-RNBA-SRM) for Network Intrusion Detection in the network. The normal patterns will be allowed into the network and the patterns of the nodes that are unusual are not allowed temporarily. The Pattern analysis and updating is performed and the detected patterns are analyzed and if they are malicious in nature, they will not be allowed into the network. The self replication model will be triggered when a unusual pattern is detected and required actions are performed in the network. The proposed model dynamic pattern analysis and detection is high when compared to traditional models. [ABSTRACT FROM AUTHOR]

This study uses deep learning methods to explore the Internet of Things (IoT) network intrusion detection method based on the CIC-IoT-2023 dataset. This dataset contains extensive data on real-life IoT environments. Based on this, this study proposes an effective intrusion detection method. Apply seven deep learning models, including Transformer, to analyze network traffic characteristics and identify abnormal behavior and potential intrusions through binary and multivariate classifications. Compared with other papers, we not only use a Transformer model, but we also consider the model's performance in the multi-class classification. Although the accuracy of the Transformer model used in the binary classification is lower than that of DNN and CNN + LSTM hybrid models, it achieves better results in the multi-class classification. The accuracy of binary classification of our model is 0.74% higher than that of papers that also use Transformer on TON-IOT. In the multi-class classification, our best-performing model combination is Transformer, which reaches 99.40% accuracy. Its accuracy is 3.8%, 0.65%, and 0.29% higher than the 95.60%, 98.75%, and 99.11% figures recorded in papers using the same dataset, respectively. [ABSTRACT FROM AUTHOR]

Intrusion detection based on federated learning allows the sharing of more high-quality attack samples to improve the intrusion detection performance of local models while preserving the privacy of local data. Most research on federated learning intrusion detection requires local models to be homogeneous. However, in practical scenarios, local models often include both homogeneous and heterogeneous models due to differences in hardware capabilities and business requirements among nodes. Additionally, there is still room for improvement in the accuracy of recognizing novel attacks in existing researches. To address the challenges mentioned above, we propose a Group-based Federated Knowledge Distillation Intrusion Detection approach. First, through a step-by-step grouping method, we achieve the grouping effect of intra-group homogeneity and inter-group heterogeneity, laying the foundation for reducing the aggregation difficulty in intra-group homogenous aggregation and inter-group heterogeneous aggregation. Second, in intra-group homogenous aggregation, a dual-objective optimization model is employed to quantify the learning quality of local models. Weight coefficients are assigned based on the learning quality to perform weighted aggregation. Lastly, in inter-group heterogeneous aggregation, the group leader model's learning quality is used to classify and aggregate local soft labels, generating global soft labels. Group leader models utilize global soft labels for knowledge distillation to acquire knowledge from heterogeneous models. Experimental results on NSL-KDD and UNSW-NB datasets demonstrate the superiority of our proposed method over other algorithms. [ABSTRACT FROM AUTHOR]

An increase in the number of small electronics is anticipated, requiring the preparation of an adequate powering method. A triboelectric nanogenerator, capable of scavenging ambient mechanical energy, is proposed as an efficient means to reduce power consumption for self-sustainable sensors, although its electrical output needs enhancement to broaden its technological applicability. In this work, a magnetic composite comprising iron oxide and polyaniline was synthesized to augment triboelectricity through the modulation of magnetic field intensity using physical chemistry. The crystallinity of the composite, chemical bonding, and structure of the surface are analyzed. The surface potential of the composite, embedded into polydimethylsiloxane, is quantitatively evaluated by using Kelvin probe force microscopy. By amalgamating magnetic flux density and triboelectric outputs, the optimization of the triboelectric layer is achieved, yielding output values of 93.86 V, 6.9 µA, and 127.5 µW. Following a reduction in surface adhesion after the powder coating process, a wind-based triboelectric nanogenerator is fabricated. Its excellent sensitivity to wind and exceptional long-term endurance are assessed, confirming its suitability as a sensor. The practicality of employing this device in intrusion detection, leveraging a wireless door-opening sensor, is demonstrated using synthesized composite materials. [ABSTRACT FROM AUTHOR]

The increase in number of people using the Internet leads to increased cyberattack opportunities. Advanced Persistent Threats, or APTs, are among the most dangerous targeted cyberattacks. APT attacks utilize various advanced tools and techniques for attacking targets with specific goals. Even countries with advanced technologies, like the US, Russia, the UK, and India, are susceptible to this targeted attack. APT is a sophisticated attack that involves multiple stages and specific strategies. Besides, TTP (Tools, Techniques, and Procedures) involved in the APT attack are commonly new and developed by an attacker to evade the security system. However, APTs are generally implemented in multiple stages. If one of the stages is detected, we may apply a defense mechanism for subsequent stages, leading to the entire APT attack failure. The detection at the early stage of APT and the prediction of the next step in the APT kill chain are ongoing challenges. This survey paper will provide knowledge about APT attacks and their essential steps. This follows the case study of known APT attacks, which will give clear information about the APT attack process—in later sections, highlighting the various detection methods defined by different researchers along with the limitations of the work. Data used in this article comes from the various annual reports published by security experts and blogs and information released by the enterprise networks targeted by the attack. [ABSTRACT FROM AUTHOR]

The field of computer networking is experiencing rapid growth, accompanied by the swift advancement of internet tools. As a result, people are becoming more aware of the importance of network security. One of the primary concerns in ensuring security is the authority over domains, and network owners are striving to establish a common language to exchange security information and respond quickly to emerging threats. Given the increasing prevalence of various types of attacks, network security has become a significant challenge in the realm of computing. To address this, a multi-level distributed approach incorporating vulnerability identification, dimensioning, and countermeasures based on attack graphs has been developed. Implementing reconfigurable virtual systems as countermeasures significantly improves attack detection and mitigates the impact of attacks. Password-based authentication, for instance, can be susceptible to password cracking techniques, social engineering attacks, or data breaches that expose user credentials. Similarly, ensuring privacy during data transmission through encryption helps protect data from unauthorized access, but it does not guarantee the prevention of other types of attacks such as malware infiltration or insider threats. This research explores various techniques to achieve effective attack detection. Multiple research methods have been utilized and evaluated to identify the most suitable approach for network security and attack detection in the context of cloud computing. The analysis and implementation of diverse research studies demonstrate that the based signature intrusion detection method outperforms others in terms of precision, recall, F-measure, accuracy, reliability, and time complexity. [ABSTRACT FROM AUTHOR]

Information security must be maintained because the amount of data in the world today is growing exponentially. The issues related to security are growing as big data usage increases. Finding ways to identify intrusions into networks and information systems is one of the major issues in this subject. It is imperative and important to enhance intrusion detection skills in order to address malevolent behavior in large data. This paper presents a scalable approach to harmful data detection. Three variables have been considered in this strategy and model: scalability, user review, and temporal progress. High volumes of data can be processed using this technology. Time is split into time periods for data training in this system, and each time interval uses users' review information to train the data. Large volumes of data require sophisticated strategies to handle, and scalability in storage allows for faster processing and fewer computations. This approach is a kind of hardware–software hybrid solution for malware detection. A fresh approach to feature extraction has also been applied. In the suggested method, the bacteria algorithm in conjunction with the immune system algorithm has been utilized for the prediction operation, and the modified support vector machine algorithm and optical density have been utilized for classification. Based on the findings, the suggested combination algorithm outperforms other comparable techniques with a 21% detection rate, a 62% false alarm rate, a 15% accuracy rate, and a 73% training duration. [ABSTRACT FROM AUTHOR]

The development of intrusion detection systems (IDS) for the in-vehicle Controller Area Network (CAN) bus is one of the main efforts being taken to secure the in-vehicle network against various cyberattacks, which have the potential to cause vehicles to malfunction and result in dangerous accidents. These CAN IDS are evaluated in disparate experimental conditions that vary in terms of the workload used, the features used, the metrics reported, etc., which makes direct comparison difficult. Therefore, there have been several benchmarking frameworks and comparative studies designed to evaluate CAN IDS in similar experimental conditions to understand their relative performance and facilitate the selection of the best CAN IDS for implementation in automotive networks. This work provides a comprehensive survey of CAN IDS benchmarking frameworks and comparative studies in the current literature. A CAN IDS evaluation design space is also proposed in this work, which draws from the wider CAN IDS literature. This is not only expected to serve as a guide for designing CAN IDS evaluation experiments but is also used for categorising current benchmarking efforts. The surveyed works have been discussed on the basis of the five aspects in the design space – namely, IDS type, attack model, evaluation type, workload generation, and evaluation metrics – and recommendations for future work have been identified. [ABSTRACT FROM AUTHOR]

With the rapid expansion and ubiquitous presence of the Internet of Things (IoT), the proliferation of IoT devices has reached unprecedented levels, heightening concerns about IoT security. Intrusion detection based on deep learning has become a crucial approach for safeguarding IoT ecosystems. However, challenges remain in IoT intrusion detection research, including inadequate feature representation at the classifier level and poor correlation among extracted traffic features, leading to diminished classification accuracy. To address these issues, we propose a novel transformer-based IoT intrusion detection model, MBConv-ViT (MobileNet Convolution and Vision Transformer), which enhances the correlation of extracted features by fusing local and global features. By leveraging the high correlation of traffic flow, our model can identify subtle differences in IoT traffic flow, thereby achieving precise classification of attack traffic. Experiments based on the open datasets TON-IoT and Bot-IoT demonstrate that the accuracy of the MBConv-ViT model, respectively, 97.14% and 99.99%, is more effective than several existing typical models. [ABSTRACT FROM AUTHOR]

Intrusion detection averts a network from probable intrusions by inspecting network traffic to ensure its integrity, availability, and confidentiality. Though IDS seems to eliminate malicious traffic, intruders have endeavored to use different approaches for undertaking attacks. Hence, effective intrusion detection is vital to detect attacks. Concurrently, the evolvement of machine learning (ML), attacks could be identified by evaluating the patterns and learning from them. Considering this, conventional works have attempted to perform intrusion detection. Nevertheless, they lacked about high false alarm rate (FAR) and low accuracy rate due to inefficient feature selection. To resolve these existing pitfalls, this research proposed a modified whale algorithm (MWA) based on nonlinear information gain to select significant and relevant features. This algorithm assures huge initialization to improve local search ability as the agent’s positions are usually near the optimal solution. It is also utilized for an adaptive search for an optimal combination of features. Following this, the research proposes Morlet particle swarm optimization hyperparameter optimization (MPSO-HO) to improve the convergence rate of the algorithm by consenting it to produce from the local optimization by improving its capability. Standard metrics assess the proposed system to confirm the optimal performance of the proposed system. Outcomes explore the effective ability of the proposed system in intrusion detection. [ABSTRACT FROM AUTHOR]

Ensuring a secure online environment hinges on the timely detection of network attacks. Nevertheless, existing detection methods often grapple with the delicate balance between speed and accuracy. In this paper, we introduce a novel intrusion detection algorithm that marries quantum particle swarm optimization with an extreme learning machine (QPSO-ELM). Firstly, we present a feature selection algorithm grounded in partitioned gains to distill vital features from data samples, thereby diminishing feature count to amplify both model training speed and accuracy. Subsequently, we unveil an intrusion detection scheme underpinned by QPSO-ELM, capable of achieving exceptional levels of training and detection speed, all while maintaining high accuracy. Finally, we fine-tune the trained model using the proposed hidden layer node selection algorithm, reducing the detection model size without compromising detection accuracy, thus further elevating its speed. The experiment results indicate that compared to the current baseline, our proposed intrusion detection scheme achieves the best results in terms of accuracy, precision, recall, and detection latency. Furthermore, the ablation experiment results demonstrate the effectiveness of our proposed method in improving both detection speed and detection accuracy. [ABSTRACT FROM AUTHOR]

With the rapid development of Industry 4.0, the importance of cyber security for industrial control systems has become increasingly prominent. The complexity and diversity of industrial control systems result in data with high dimensionality and strong correlation, posing significant challenges in obtaining labeled data. However, current intrusion detection methods often demand large amounts of labeled data for effective training. To address this limitation, this paper proposes a semi-supervised anomaly detection framework, called SFSD, which leverages feature selection and deviation networks to detect anomalies in industrial control systems. Specifically, we introduce a feature selection algorithm (IG-PCA) that utilizes information gain and principal component analysis to reduce the dimensionality of features in industrial control data by eliminating redundant features. Then, we propose a semi-supervised learning method based on an improved deviation network, which utilizes an anomaly scoring network to learn end-to-end anomaly scores for the training data, thus assigning anomaly scores to each training data. Finally, using a limited amount of anomaly-labeled data, we design a specific deviation loss function to optimize the anomaly scoring network, enabling a significant score bias between positive and negative samples. Experimental results demonstrate that the proposed SFSD outperforms existing semi-supervised anomaly detection frameworks by improving the accuracy and detection rate by an average of 1–2%. Moreover, SFSD requires less training time compared to existing frameworks, resulting in a training time reduction of approximately 10% or more. [ABSTRACT FROM AUTHOR]

Machine Learning and Data Mining algorithms are used extensively to enhance the performance of Intrusion Detection Systems. The number of training instances and the dimensionality of data are crucial factors affecting the performance of the model built during the training of any supervised learning algorithms. A sufficient proportion of instances having relevant features from all classes of attacks and normal traffic are considered most desirable while building the classification model that classifies the network traffic into attack and normal. This paper proposes a methodology to improve the accuracy of the model by giving importance to the relevant features that can contribute to model building. The feature selection using correlation‐based and information gain‐based techniques during training and testing contributes much to the detection of stealthier attacks and minority attacks. Then the features of the less detected attacks are identified as the second phase of the filter that is used to improve the performance. The relevant features of stealthy attacks are identified based on the correlation of corresponding features of the attack and normal data as the attacks are made stealthy mostly by making it resemble the normal traffic. Finally, the attacks that are rarely found in the training data are oversampled to improve their detection. CICIDS 2017 data set is employed as it comprises stealthier attacks generated using modern tools. NSL KDD data set is also used for evaluation to compare the proposed work with existing literature as it is used in most of the available literature. The results show superior performance with an accuracy of 99.8%, false positive rate of 0.2%, and a detection rate and 99.8%. [ABSTRACT FROM AUTHOR]

Cybersecurity has received greater attention in modern times due to the emergence of IoT (Internet-of-Things) and CNs (Computer Networks). Because of the massive increase in Internet access, various malicious malware have emerged and pose significant computer security threats. The numerous computing processes across the network have a high risk of being tampered with or exploited, which necessitates developing effective intrusion detection systems. Therefore, it is essential to build an effective cybersecurity model to detect the different anomalies or cyber-attacks in the network. This work introduces a new method known as Wavelet Deep Convolutional Neural Network (WDCNN) to classify cyber-attacks. The presented network combines WDCNN with Enhanced Rain Optimization Algorithm (EROA) to minimize the loss in the network. This proposed algorithm is designed to detect attacks in large-scale data and reduces the complexities of detection with maximum detection accuracy. The proposed method is implemented in PYTHON. The classification process is completed with the help of the two most famous datasets, KDD cup 1999 and CICMalDroid 2020. The performance of WDCNN_EROA can be assessed using parameters like specificity, accuracy, precision F-measure and recall. The results showed that the proposed method is about 98.72% accurate for the first dataset and 98.64% for the second dataset. [ABSTRACT FROM AUTHOR]

The problems of asymmetry in information features and redundant features in datasets, and the asymmetry of network traffic distribution in the field of network intrusion detection, have been identified as a cause of low accuracy and poor generalization of traditional machine learning detection methods in intrusion detection systems (IDSs). In response, a network intrusion detection method based on the integration of bootstrap aggregating (bagging) is proposed. The extreme random tree (ERT) algorithm was employed to calculate the weights of each feature, determine the feature subsets of different machine learning models, then randomly sample the training samples based on the bootstrap sampling method, and integrated classification and regression trees (CART), support vector machine (SVM), and k-nearest neighbor (KNN) as the base estimators of bagging. A comparison of integration methods revealed that the KNN-Bagging integration model exhibited optimal performance. Subsequently, the Bayesian optimization (BO) algorithm was employed for hyper-parameter tuning of the base estimators' KNN. Finally, the base estimators were integrated through a hard voting approach. The proposed BO-KNN-Bagging model was evaluated on the NSL-KDD dataset, achieving an accuracy of 82.48%. This result was superior to those obtained by traditional machine learning algorithms and demonstrated enhanced performance compared with other methods. [ABSTRACT FROM AUTHOR]

The quantity of normal samples is commonly significantly greater than that of malicious samples, resulting in an imbalance in network security data. When dealing with imbalanced samples, the classification model requires careful sampling and attribute selection methods to cope with bias towards majority classes. Simple data sampling methods and incomplete feature selection techniques cannot improve the accuracy of intrusion detection models. In addition, a single intrusion detection model cannot accurately classify all attack types in the face of massive imbalanced security data. Nevertheless, the existing model integration methods based on stacking or voting technologies suffer from high coupling that undermines their stability and reliability. To address these issues, we propose a Multiple Integration Model (MIM) to implement feature selection and attack classification. First, MIM uses random Oversampling, random Undersampling and Washing Methods (OUWM) to reconstruct the data. Then, a modified simulated annealing algorithm is employed to generate candidate features. Finally, an integrated model based on Light Gradient Boosting Machine (LightGBM), eXtreme Gradient Boosting (XGBoost) and gradient Boosting with Categorical features support (CatBoost) is designed to achieve intrusion detection and attack classification. MIM leverages a Rule-based and Priority-based Ensemble Strategy (RPES) to combine the high accuracy of the former and the high effectiveness of the latter two, improving the stability and reliability of the integration model. We evaluate the effectiveness of our approach on two publicly available intrusion detection datasets, as well as a dataset created by researchers from the University of New Brunswick and another dataset collected by the Australian Center for Cyber Security. In our experiments, MIM significantly outperforms several existing intrusion detection models in terms of accuracy. Specifically, compared to two recently proposed methods, namely, the reinforcement learning method based on the adaptive sample distribution dual-experience replay pool mechanism (ASD2ER) and the method that combines Auto Encoder, Principal Component Analysis, and Long Short-Term Memory (AE+PCA+LSTM), MIM exhibited a respective enhancement in intrusion detection accuracy by 1.35% and 1.16%. [ABSTRACT FROM AUTHOR]

Unbalanced data in intrusion detection seriously affect the overall performance of intrusion detection methods. This paper proposes an intrusion detection algorithm based on unbalanced learning (ID-UL) for unbalanced learning. It uses two strategies to address the issues brought about by unbalanced data. First, the data grouping strategy based on integrated learning alleviates the extreme data imbalance and avoids the negative impact on imbalanced learning. Meanwhile, to avoid the possible negative impact brought by unbalanced data on the learning procedures of convolutional neural networks, the strategy of assigning weight to the loss function is adopted. Besides, a method for determining the weight value is designed to make the model supervise the learning of attack samples during the training process. Experimental results on the NSL-KDD dataset show that the method in this paper can effectively improve the detection of attack classes, and the overall detection accuracy reaches 81.48%. ID-UL has the same significant effect on other imbalanced datasets. [ABSTRACT FROM AUTHOR]

The novelty of this paper is in determining and using hyperparameters to improve the Extended Isolation Forest (EIF) algorithm, a relatively new algorithm, to detect malicious activities in network traffic. The EIF algorithm is a variation of the Isolation Forest algorithm, known for its efficacy in detecting anomalies in high-dimensional data. Our research assesses the performance of the EIF model on a newly created dataset composed of Zeek Connection Logs, UWF-ZeekDataFall22. To handle the enormous volume of data involved in this research, the Hadoop Distributed File System (HDFS) is employed for efficient and fault-tolerant storage, and the Apache Spark framework, a powerful open-source Big Data analytics platform, is utilized for machine learning (ML) tasks. The best results for the EIF algorithm came from the 0-extension level. We received an accuracy of 82.3% for the Resource Development tactic, 82.21% for the Reconnaissance tactic, and 78.3% for the Discovery tactic. [ABSTRACT FROM AUTHOR]

The growth of smart gadgets connected via the Internet of Things (IoT) in today's modern technology landscape has substantially improved our everyday lives. However, this convenience is juxtaposed with a concomitant surge in cyber threats capable of compromising the integrity of these interconnected systems. Conventional intrusion detection systems (IDS) prove inadequate for IoT due to the unique challenges they present. We propose and evaluate an intrusion detection system (IDS) based on a hybrid Convolutional Neural Network-Long Short-Term Memory (CNN-LSTM) model in this paper. The model is designed to capture both temporal and spatial patterns in network data, offering a robust solution for detecting malicious activities within IoT environments. The CNN-LSTM model displayed excellent accuracy, reaching 98% in both multi-class and binary classifications when trained on the UNSW-NB15 dataset. Furthermore, we explore the real-world applicability of the model through testing on Raspberry Pi, showcasing its effectiveness in IoT scenarios. The system is augmented with alert mechanisms, promptly notifying relevant parties upon intrusion detection. Our findings highlight the CNN-LSTM model's efficacy in strengthening IoT network security. [ABSTRACT FROM AUTHOR]

Connected devices in IoT systems usually have low computing and storage capacity and lack uniform standards and protocols, making them easy targets for cyberattacks. Implementing security measures like cryptographic authentication, access control, and firewalls for IoT devices is insufficient to fully address the inherent vulnerabilities and potential cyberattacks within the IoT environment. To improve the defensive capabilities of IoT systems, some research has focused on using deep learning techniques to provide new solutions for intrusion detection systems. However, some existing deep learning-based intrusion detection methods suffer from inadequate feature extraction and insufficient model generalization capability. To address the shortcomings of existing detection methods, we propose an intrusion detection model based on temporal convolutional residual modules. An attention mechanism is introduced to assess feature scores and enhance the model's ability to concentrate on critical features, thereby boosting its detection performance. We conducted extensive experiments on the ToN_IoT dataset and the UNSW-NB15 dataset, and the proposed model achieves accuracies of 99.55% and 89.23% on the ToN_IoT and UNSW-NB15 datasets, respectively, with improvements of 0.14% and 15.3% compared with the current state-of-the-art models. These results demonstrate the superior detection performance of the proposed model. [ABSTRACT FROM AUTHOR]

This paper proposes an adaptive Wedman intrusion detection algorithm (AID-DFS) for data fusion. Firstly, feature extraction of abnormal text detection is carried out using a BI-gated loop (Bi-GRU). Multi-branch convolutional recurrent neural network (CNN-RNN) extracts hierarchical features from abnormal images. The multi-mode dynamic fusion uses the intermodal and intramodal attention mechanisms. In this way, a joint representation of multiple modes is obtained. The visual perception mechanism is used to realize multichannel integration and strengthen the function of original information in multichannel. The experimental results show that the proposed method has 99.6% accuracy and 94.9% accuracy. Compared with other algorithms, the proposed method can improve the performance of the intrusion system by about 10.2%. [ABSTRACT FROM AUTHOR]

In order to protect the Internet of Vehicles system from the threat of network attacks and improve the accuracy of intrusion detection, a new intrusion detection method (AQVAE-RGSNet) was proposed for the characteristics of large data flow and unbalanced attack types in the vehicle network. Firstly, the adversarial quantized variational auto encoder was used to process the vehicle network data imbalance. And it was constructed by combining the vector quantized variational auto encoder-2 and the generative adversarial network with gradient penalty to alleviate the extremely unbalanced number of samples of abnormal attack types in the dataset. Afterwards, the ResNet and improved segmented residual neural network were used to learn the input sample data and predict its attack category. The experimental results indicated that AQVAE-RGSNet achieved F1 scores of 0. 998 6 and 0. 999 7 on the vehicle networking dataset CICDS2017 and CAN-intrusion-dataset, respectively. On the premise of ensuring the best training effect, it could identify attack threats more effectively in the vehicle network. [ABSTRACT FROM AUTHOR]

In the face of the effective popularity of the Internet of Things (IoT), but the frequent occurrence of cybersecurity incidents, various cybersecurity protection means have been proposed and applied. Among them, Intrusion Detection System (IDS) has been proven to be stable and efficient. However, traditional intrusion detection methods have shortcomings such as low detection accuracy and inability to effectively identify malicious attacks. To address the above problems, this paper fully considers the superiority of deep learning models in processing high-dimensional data, and reasonable data type conversion methods can extract deep features and detect classification using advanced computer vision techniques to improve classification accuracy. The Markov Transform Field (MTF) method is used to convert 1D network traffic data into 2D images, and then the converted 2D images are filtered by Unsharp Masking to enhance the image details by sharpening; to further improve the accuracy of data classification and detection, unlike using the existing high-performance baseline image classification models, a soft-voting integrated model, which integrates three deep learning models, MobileNet, VGGNet and ResNet, to finally obtain an effective IoT intrusion detection architecture: the MUS model. Four types of experiments are conducted on the publicly available intrusion detection dataset CICIDS2018 and the IoT network traffic dataset N_BaIoT, and the results demonstrate that the accuracy of attack traffic detection is greatly improved, which is not only applicable to the IoT intrusion detection environment, but also to different types of attacks and different network environments, which confirms the effectiveness of the work done. [ABSTRACT FROM AUTHOR]

VPNs are vital for safeguarding communication routes in the continually changing cybersecurity world. However, increasing network attack complexity and variety require increasingly advanced algorithms to recognize and categorize VPN network data. We present a novel VPN network traffic flow classification method utilizing Artificial Neural Networks (ANN). This paper aims to provide a reliable system that can identify a virtual private network (VPN) traffic from intrusion attempts, data exfiltration, and denial-of-service assaults. We compile a broad dataset of labeled VPN traffic flows from various apps and usage patterns. Next, we create an ANN architecture that can handle encrypted communication and distinguish benign from dangerous actions. To effectively process and categorize encrypted packets, the neural network model has input, hidden, and output layers. We use advanced feature extraction approaches to improve the ANN's classification accuracy by leveraging network traffic's statistical and behavioral properties. We also use cutting-edge optimization methods to optimize network characteristics and performance. The suggested ANN-based categorization method is extensively tested and analyzed. Results show the model effectively classifies VPN traffic types. We also show that our ANN-based technique outperforms other approaches in precision, recall, and F1-score with 98.79% accuracy. This study improves VPN security and protects against new cyberthreats. Classifying VPN traffic flows effectively helps enterprises protect sensitive data, maintain network integrity, and respond quickly to security problems. This study advances network security and lays the groundwork for ANN-based cybersecurity solutions. [ABSTRACT FROM AUTHOR]

Internet of things (IoT) technology has empowered tangible objects to establish internet connections, facilitating data exchange with computational capabilities. With significant potential across sectors like healthcare, environmental monitoring, and industrial control, IoT represents a promising technological advancement. This study explores datasets from ToN-IoT's IoT devices, focusing on multi-class classification, including normal and attack classes, with an additional aim of identifying potential attack sub-classes. Datasets comprise various IoT devices, such as refrigerators, garage doors, global positioning systems (GPS) sensors, motion lights, modbus devices, thermostats, and weather sensors. Comparative analysis is conducted between two prominent multiclass classification models, extreme gradient boosting (XGBoost) and light gradient boosting machine (LightGBM), utilizing accuracy and computational time metrics as evaluation criteria. Research findings highlight that the LightGBM model achieves superior accuracy at 78%, surpassing XGBoost 74.31%. However, XGBoost demonstrates an advantage with a shorter computational time of 1.23 seconds, compared to LightGBM 6.79 seconds. This study not only provides insights into multiclass classification model selection but also underscores the crucial consideration of the trade-off between accuracy and computational efficiency in decision-making. Research contributes to advancing our understanding of IoT security through effective classification methodologies. The findings offer valuable information for researchers and practitioners, emphasizing the nuanced decisions needed when selecting models based on specific priorities like accuracy and computational efficiency. [ABSTRACT FROM AUTHOR]

This paper proposes an innovative approach capitalized on the distinctive characteristics of command and control (C&C) beacons, namely, time intervals and frequency between consecutive unique connections, to compress the network flow dataset. While previous studies on the same matter used single technique, we propose a multi-technique approach for efficient detection of DoH tunnels. We use a baseline public dataset, CIRA-CIC-DoHBrw-2020, containing over a million network flow properties and statistical features of DoH, tunnels, benign DoH and normal browsing (HTTPS) traffic. Each sample is represented by 33 features with a timestamp. Our methodology combines star graph and bar plot visualizations with supervised and unsupervised learning techniques. The approach underscores the importance of C&C beacon characteristic features in compressing a dataset and reducing a flow dimension while enabling efficient detection of DoH tunnels. Through compression, the original dataset size and dimensions are reduced by approximately 95 % and 94 % respectively. For supervised learning, RF emerges as the top-performing algorithm, attaining precision and recall scores of 100% each, with speed increase of ≈ 6796 times faster in training and ≈ 55 in testing. For anomaly detection models, OCSVM emerges as the most suitable choice for this purpose, with precision (88.89) and recall (100). Star graph and bar graph models also show a clear difference between normal traffic and DoH tunnels. The reduction in flow sample size and dimension, while maintaining accuracy, holds promise for edge networks with constrained resources and aids security analysts in interpreting complex ML models to identify Indicators of Compromise (IoC). [ABSTRACT FROM AUTHOR]

Abstract The Internet of Things (IoT) has gained popularity and is widely used in modern society. The growth in the sizes of IoT networks with more internet-connected devices has led to concerns regarding privacy and security. In particular, related to the routing protocol for low-power and lossy networks (RPL), which lacks robust security functions, many IoT devices in RPL networks are resource-constrained, with limited computing power, bandwidth, memory, and battery life. This causes them to face various vulnerabilities and potential attacks, such as DIO neighbor suppression attacks. This type of attack specifically targets neighboring nodes through DIO messages and poses a significant security threat to RPL-based IoT networks. Recent studies have proposed methods for detecting and mitigating this attack; however, they produce high false-positive and false-negative rates in detection tasks and cannot fully protect RPL networks against this attack type. In this paper, we propose a novel fuzzy logic-based intrusion detection scheme to secure the RPL protocol (FLSec-RPL) to protect against this attack. Our method is built of three key phases consecutively: (1) it tracks attack activity variables to determine potential malicious behaviors; (2) it performs fuzzy logic-based intrusion detection to identify malicious neighbor nodes; and (3) it provides a detection validation and blocking mechanism to ensure that both malicious and suspected malicious nodes are accurately detected and blocked. To evaluate the effectiveness of our method, we conduct comprehensive experiments across diverse scenarios, including Static-RPL and Mobile-RPL networks. We compare the performance of our proposed method with that of the state-of-the-art methods. The results demonstrate that our method outperforms existing methods in terms of the detection accuracy, F1 score, power consumption, end-to-end delay, and packet delivery ratio metrics.

Abstract As the number and cleverness of cyber-attacks keep increasing rapidly, it's more important than ever to have good ways to detect and prevent them. Recognizing cyber threats quickly and accurately is crucial because they can cause severe damage to individuals and businesses. This paper takes a close look at how we can use artificial intelligence (AI), including machine learning (ML) and deep learning (DL), alongside metaheuristic algorithms to detect cyber-attacks better. We've thoroughly examined over sixty recent studies to measure how effective these AI tools are at identifying and fighting a wide range of cyber threats. Our research includes a diverse array of cyberattacks such as malware attacks, network intrusions, spam, and others, showing that ML and DL methods, together with metaheuristic algorithms, significantly improve how well we can find and respond to cyber threats. We compare these AI methods to find out what they're good at and where they could improve, especially as we face new and changing cyber-attacks. This paper presents a straightforward framework for assessing AI Methods in cyber threat detection. Given the increasing complexity of cyber threats, enhancing AI methods and regularly ensuring strong protection is critical. We evaluate the effectiveness and the limitations of current ML and DL proposed models, in addition to the metaheuristic algorithms. Recognizing these limitations is vital for guiding future enhancements. We're pushing for smart and flexible solutions that can adapt to new challenges. The findings from our research suggest that the future of protecting against cyber-attacks will rely on continuously updating AI methods to stay ahead of hackers' latest tricks.