Abnormal Packets Research Articles

A Data Alignment Method for Network Packet Capture Based on DBSCAN

This paper investigates the issues of packet alignment and consistency among PLC devices based on industrial network environments, aiming to ensure the integrity and accuracy of packets from sender to receiver. To achieve this goal, we propose an anomaly detection method that combines the DBSCAN clustering algorithm with the 3-sigma principle to identify and handle abnormal packets that may occur during transmission. By comparing the data between the sending and receiving ends, and analyzing based on timestamps and data content, we validate the alignment of packets in the network environment. Experimental results demonstrate that the proposed method effectively detects and corrects packet loss or delay jitter, thereby enhancing the reliability of communication between PLC devices and the consistency of data transmission. The scheme presented in this paper enables quicker and more precise identification of packet loss and delays, adapting well to various network load conditions. Further experimental analysis indicates that this method excels in reducing both false positive and false negative rates, and it exhibits good scalability, making it applicable to data alignment and consistency verification in other industrial automation scenarios. Ultimately, this novel solution provides stability and accuracy for data transmission among devices in a network environment.

Two-Phase Industrial Control System Anomaly Detection Using Communication Patterns and Deep Learning

Several cases of Industrial Internet of Things (IIoT) attacks with zero-day vulnerabilities have been reported. To prevent these attacks, it is necessary to apply an abnormal behavior detection method; however, there are three main problems that make it hard. First, there are various industrial communication protocols. Instead of IT environments, many unstandardized protocols, which are usually defined by vendors, are used. Second, legacy devices are commonly used, not only EOS (End-of-service), but also EoL (End-of-Life). And last, the analysis of collected data is necessary for defining normal behavior. This behavior should be separately defined in each IIoT. Therefore, it is difficult to apply abnormal behavior detection in environments where economic and human investment is difficult. To solve these problems, we propose a deep learning based abnormal behavior detection technique that utilizes IIoT communication patterns. The proposed method uses a deep learning technique to train periodic data acquisition sequences, which is one of the common characteristics of IIoT. The trained model determined the sequence of packet is normal. The proposed technique can be applied without an additional analysis. The proposed method is expected to prevent security threats by proactively detecting cyberattacks. To verify the proposed method, a dataset was collected from the Korea Electric Power Control System. The model that defines normal behavior based on the application layer exhibits an accuracy of 79.6%. The other model, defining normal behavior based on the transport layer, has an accuracy of 80.9%. In these two models, most false positives and false negatives only occur when the abnormal packet is in a sequence.

EP-CuMAC: Energy and performance-efficient integrity protection for narrow-band IoT

Narrowband Internet of Things (NB-IoT) is a LPWAN radio standard developed by 3GPP to provide devices with longer battery life and broader coverage. Many authors have proposed algorithms to maximise battery life by optimising devices’ Active periods. However, more research is required to develop integrity-protection algorithms for NB-IoT and study their impact on battery life. NB-IoT, being bandwidth-constrained, transmits data as truncated packets at discrete intervals to maximise battery life. However, truncated MACs reduce cryptographic strength leading to brute-force attacks. Cumulative MAC (CuMAC), generating 256-bit authentication tags by aggregating truncated MACs, alleviates this limitation. However, CuMAC is prone to replay attacks and reduced performance due to re-transmissions, resulting in delayed responses, packet loss and battery overhead. In this paper, we propose Energy-Performance CuMAC (EP-CuMAC) by modifying CuMAC to overcome inherent flaws and suit NB-IoT’s requirements. Feedback-based mechanism is developed to improve channel quality by regulating abnormal packet delays and SINR. Machine and deep learning algorithms predict and authenticate lost messages and tags to minimise re-transmissions. EP-CuMAC re-transmits the aggregated lost packets and new messages in upcoming Active state to reduce re-transmissions. Energy-performance-security trade-offs of EP-CuMAC are studied for various encryption parameters using ns-3 and Raspberry Pi. Although EP-CuMAC consumes approximately 17.73%, 33.33% and 45.59% power, memory and execution time, respectively and thrice the re-transmitted aggregated-packet authentication time compared to CuMAC, it has 68.42% enhanced packet delivery ratio and 66.66% higher security against replay attacks. Our analysis reveals that EP-CuMAC can effectively replace CuMAC as lightweight and performance-efficient alternative for NB-IoT.

Abnormal network packets identification using header information collected from Honeywall architecture

ABSTRACT Most devices are now connected through the Internet, so cybersecurity issues have raised concerns. This study proposes network services in a virtual environment to collect, analyze and identify network attacks with various techniques. Our contributions include multi-fold. First, we deployed Honeynet architecture to collect network packets, including actual cyber-attacks performed by real hackers and crackers. In the second contribution, we have leveraged some techniques to normalize data and extract header information with 29 features from 200,000 samples of many types of network attacks for abnormal packet identification with machine learning algorithms. Furthermore, we introduce an Adaptive Cybersecurity (AC) system to detect attacks and provide warnings. The system can automatically collect more data for further analysis to improve performance. Our proposed method performs better than Snort in detecting dangerous malicious attacks. Finally, we have experimented with different cyber-attack approaches to exploit the ten website security risks recommended by the Open Web Application Security Project (OWASP). From the research results, the system is expected to be able to detect cybercriminal attacks and provide early warnings to prevent a potential cyber-attack.

CapBad: Content-Agnostic, Payload-Based Anomaly Detector for Industrial Control Protocols

Efficient anomaly detection methods are urgently needed to prevent attacks in the application layer of the Industrial Internet of Things (IIoT). The existing intrusion detection systems have certain limitations in detecting abnormal packets exploited by the application-layer attacks. In this article, a content-agnostic-payload-based anomaly detector named the CapBad is proposed to detect malicious packets in the application layer of the IIoT system. Specifically, a phase-aware hidden semi-Markov model (pHSMM) is used to model the industrial control protocol packets and automatically learn the packets’ payload characteristics. The packet types are then inferred based on the packet likelihoods obtained by the pHSMM. In addition, the probabilistic suffix tree is employed to analyze the packets’ contextual similarity to the historical packets. The abnormal packets are finally detected by comparing their contextual similarity with that of the historical normal packets. The proposed algorithm is verified by simulations, and the results show that the CapBad has an excellent performance in detecting abnormal packets in the application layer.

Automatic whitelist generation system for ethernet based in-vehicle network

Owing to the development of industrial internet of things (IIoT) technology, the connectivity and complexity of vehicles have also increased, and new communication technologies have been introduced to in-vehicle networks (IVN). In order to achieve a sufficient level of IIoT cybersecurity, strict ground rules must exist in the critical infrastructures (CI). Traditionally, many legacy communication techniques such as controller area networks (CAN), and FlexRay have been proposed and used for IVN and CI. However, these legacy protocols cannot accommodate advanced IIoT technologies that require high connectivity; hence, Ethernet for vehicles has been introduced in recent years. The phenomenon of introducing Ethernet to IVN is an irreversible industrial trend, such as Ethernet-based Smart Factory, Smart City, and industrial control system based on IIoT. Some automotive Ethernet protocols such as MOST150 and BroadR-Reach have been commercialized primarily for infotainment and are being expanded for providing IIoT services. However, security studies pertaining to automotive Ethernet are incomplete. Even though the amount of data that must be processed by security solutions in the Ethernet environment is increasing, vehicles must be guaranteed ‘hard real-time’. In this study, to reflect the characteristics of IVN security such as real-time, extensibility, and certainty, we establish an IVN simulation environment based on several Ethernet protocols and propose an automatic whitelist generation system. The whitelist performs filtering based on certain criteria, and after it is defined, the time consumed for packet preprocessing is extremely small. The proposed system is designed to create a whitelist through learning to ensure extensibility in an IVN environment composed of heterogeneous networks. The proposed system operates in two stages: the first step automatically generates three types of whitelists, i.e., global, local, and connection, by learning the network; the second step performs filtering by applying the generated rule. The whitelists generated through the proposed system filter out abnormal packets or sections based on the alert levels. The proposed system is expected to cope flexibly with various potential cyber threats on IVNs in the future.

Task-Oriented Network Abnormal Behavior Detection Method

Since network systems have become increasingly large and complex, the limitations of traditional abnormal packet detection have gradually emerged. The existing detection methods mainly rely on the recognition of packet features, which lack the association of specific applications and result in hysteresis and inaccurate judgement. In this paper, a task-oriented abnormal packet behavior detection method is proposed, which creatively collects action identifications during the execution of network tasks and inserts security labels into communication packets. Specifically, this paper defines the network tasks as a collection of state and action sequences to achieve the fine-grained division of the execution of network tasks, performs Hash value matching based on random communication string and action identification sequence for packet authentication, and proposes a mechanism of action identification sequence matching and abnormal behavior decision-making based on a finite state machine, according to the fine-grained monitoring of task execution action sequence. Furthermore, to verify the validity of the anomaly detection method proposed in this paper, a prototype based on the FTP communication platform is constructed, on which the simulation experiments, including the DDOS attack and backdoor attack, are conducted. The experimental results show that the proposed task-oriented abnormal behavior detection method can effectively intercept network malicious data packets and realize the active security defense for network systems.

Enriched intuitionistic fuzzy rule pruning using butterfly optimization for rule pruning in intrusion detection

The process of detecting and reacting to hostile activities against the computer and network resources is known as intrusion detection. Rather of relying just on expertise and experience, a systematic and automated IDS creation process is required. This drives researchers to look into data mining-based intrusion detection frameworks. Though there are many algorithms are developed for detection intrusion, the issue of inconsistency in rule-based classification model is controlling the volume of data and removing irrelevant rules are the major problems focused in this work to improve the process of IDS. This paper proposed a framework which handles the hesitancy in classifying the unknown traffic pattern data packets by designing evolutionary algorithm optimized intuitionistic fuzzy inference system. The Intuitionistic fuzzy inference system represents each instances of KDD cup 99 dataset with the degree of membership and non-membership. With these two degrees, the hesitancy degree is computed to overcome the issue of inconsistency and uncertainty in analysing the unknown pattern of abnormal packets. In conventional Intuitionistic fuzzy System (IFS), the rules generated by the inference engine is applied for classification directly without determine the validation of it.

SoC-based abnormal ethernet packet detector with automatic rule-set generator

SoC-based abnormal ethernet packet detector with automatic rule-set generator

SoC-based abnormal ethernet packet detector with automatic rule-set generator

SoC-based abnormal ethernet packet detector with automatic rule-set generator

A New Approach for Network Steganography Detection based on Deep Learning Techniques

One of the techniques that current cyber-attack methods often use to steal and transmit data out is to hide secret data in packets. This is the network steganography technique. Because millions of packets are sent and received every hour in internet activity, so it is very difficult to detect the theft and transmission of system data out using this form. Recent approaches often seek ways to compute and extract abnormal behaviors of packets to detect a steganography protocol or technique. However, such methods have the difficult problem of not being able to detect abnormal packets when an attacker uses other steganography techniques. To solve the above problem, this paper proposes a network steganography detection method using deep learning techniques. The highlight of this study is some new proposed features based on different components of the packet. By combining these many components, this proposal will not only provide the ability to detect many steganography techniques in the network, but also improve the ability to accurately detect abnormal packets. Besides, this study proposes to use deep learning for the task of detecting normal and abnormal packets. The authors want to take advantage of the big data analysis and processing capabilities of deep learning models in order to improve the ability to analyze and detect network steganography techniques. The experimental results in Section IVD have proved the effectiveness of this proposed method compared with other approaches.

A Precise Model to Secure Systems on Ethernet Against Man-In-The-Middle Attack

Internet protocol (IP) is a part of the Transmission Control Protocol (TCP) /IP suite that operates below the network layer of the Open Systems Interconnection (OSI) reference model and is employed as an interface between the network and data link layer. The address resolution protocol (ARP) is a protocol used by IP for mapping an IP address to the corresponding media access control address that is a hardware address harnessed to identify the source and destination of each frame sent on the Ethernet. The man-in-the-middle (MITM) attack is a kind of the Ethernet attack that can be carried out depending on ARP cache-memory poisoning to intercept communications between two systems on Ethernet, and it could, without difficulty, be applied when the attacker is in control of a router along normal point of traffic. To secure systems on Ethernet as well as to prevent ARP cache-memory poisoning, it is necessary to have a good prevention model of MITM attacks. In this article, using the client/server-based intrusion detection system (CSIDS), a precise model to prevent ARP poisoning attacks is proposed and implemented. Our analysis is adequately characterized by implementing a real-time analysis for the received ARP packets, and in the case of detection of a suspicious ARP packet, a resolution message will be exchanged between system parts on the same network. To evaluate the ability of detection and prevention of CSIDS, we design and implement a novel protocol. At the same time, we compare the performance between CSIDS with the standard operations of ARP. Our experimental results reveal that our methodology completely protects hosts against cache poisoning attacks. We further show the effectiveness of our technique in identifying the abnormal ARP packets.

A Scalable and Energy-Efficient Anomaly Detection Scheme in Wireless SDN-Based mMTC Networks for IoT

As a typical Internet-of-Things (IoT) scenario, massive machine-type communications (mMTC) services are expected to grow exponentially and create a multibillion-dollar industry spanning a broad range of vertical sectors. In literature, wireless software-defined network (SDN) is viewed as a promising approach to facilitate the degree of reconfigurability on extended sets of mMTC devices via centralized software updates. However, most of the current anomaly detection scheme (ADS) in SDN suffers from the high risk of overwhelming of the controller as well as excessive energy consumption if directly applied in the network with enormous devices. To address the scalability issues in centralized ADS, we propose a localized ADS scheme, called scalable and energy-efficient anomaly detection scheme (SEE-ADS), comprising of a detection activation module, a lightweight predetection module, a heavyweight anomaly detection module, and a dynamic strategy selection module. Through the cooperation among these modules, the proposed ADS is capable of detecting attacks dynamically and effectively without the risk of energy depletion via discontinuous activation of the heavyweight detection. The lower complexity is fulfilled by developing a localized and adaptive heavyweight detection module, called a localized evolving semisupervised learning-based anomaly detection scheme (LESLA). Besides, the proposed scheme makes full use of feedback from the previous heavyweight activation and the indication of predetection on each packet. The simulation results show that the proposed scheme greatly reduces the overall energy consumption over heavyweight detection. Furthermore, the proposed scheme shows higher sensitivity on abnormal packets and similar false alarm compared with the literature work.

A working human abnormal operation recognition approach based on the deep multi-instance sorting model

Modeling abnormal behavior detection in the intelligent video monitoring system for recognition or detection of special event has attracted significant research interest in recent years. In order to achieve more effective recognition of abnormal behavior detection of the intelligent video surveillance system, this paper proposes a working human abnormal operation recognition approach based on deep multi-instance sorting model. Firstly, the uncut long video is sparse to obtain normal and abnormal behavior video segments, and the RGB and optical flow features in the segment are extracted by the deep convolution network. Video feature vectors are obtained by the consensus function and feature extractor. Then, multi-instance sorting learning is used to assign abnormality scores between 0 and 1 to feature vectors. When the abnormal values of abnormal packets are higher than those of normal packets, the abnormality score is returned and the high abnormality score is determined as an abnormal behavior. The experiments on the open THUMOS14 data set and our own XAGCWD data set using CUDA GPU accelerated computing to demonstrate that our approach improves the recognition accuracy about 10.8% and high accuracy of abnormal detection. The main purpose of this research is to apply the model proposed in this paper to the intelligent workshop behavior monitoring system to effectively realize the safety management of workshop personnel.

Performance Analysis of Cross-layer Efficient Selfishness Prevention Routing Protocol for the Dynamic CR Networks

As wireless communication is very dependent on the use of spectrum, increased demand for and practical application of new wireless services generally leads to spectrum shortages. A remarkable feature of protocols in the cognitive radio is to, to detect the selfish behaviour of node and discard the abnormal packets. However, minimize transmission latency and enhance energy efficiency are two main issues in multi-hop Cognitive Radio Networks (CRN) where it is difficult to gain knowledge of topology and spectrum statistics. The misconduct of selfish nodes such as not participating in the routing process, delaying RREQ packet intentionally, removing the data packet, not responding or sending hello messages. This misconduct of the selfish nodes will affect efficiency, trustworthiness, and fairness. This paper proposes the cognitive radio dynamic nature, associate with that of selfish nodes, the cross-layer efficient Selfish Prevention Routing Protocol (ESPRP). All the above characteristics are simulated with help of NS-2.35 simulator, and our proposed protocol attains good enactment in terms of lower delays, higher throughput and better packet delivery ratios for collaborative node traffic related to traditional routing protocols in the cognitive radio.

Reducing energy consumption of wireless sensor networks using rules and extreme learning machine algorithm

Wireless sensor networks consist of a collection of sensors to monitor physical or environmental events. Nowadays, the sensor networks are used in important applications like military, health and civilian monitoring. Since it is a wireless medium, deployed in remote locations and resource-constrained nature, the sensor networks are easily vulnerable to attacks. The attack creates significant damages to the sensor networks. To avoid these problems, intrusion detection system (IDS) is implemented at the base station to filter any abnormal packets. In the proposed system, a survey is made on the attacks and rules to detect the attacks. Filtering the attacks using rule-based IDS at the sensor nodes would reduce the amount of packet transmission to the base station which, in turn, would reduce the energy consumption of the sensor network. Extreme learning machine (ELM) algorithm is implemented at the base station to detect the abnormal packets. The experimental result shows the performance of different classification techniques and cross-layer rules over the NSL-KDD and real-time datasets. The detection rate of the ELM algorithm is higher compared to other systems.

Hybrid-Augmented Device Fingerprinting for Intrusion Detection in Industrial Control System Networks

An increasing number of wireless intelligent equipment is applied to ICS networks. However, it is virtually impossible to use regular encryption methods and security patches to enhance the security level of legacy equipment in ICS networks due to weak computing and storage capabilities of the equipment. To address these concerns, a hybrid-augmented device fingerprinting approach is developed to enhance traditional intrusion detection mechanisms in the ICS network. Taking the advantage of the simplicity of the program process and stability of hardware configurations, we first measure inter-layer data response processing time, and then analyze network traffic to filter abnormal packets to achieve the intrusion classification and detection in ICS networks. The device fingerprinting- based intrusion classification and detection approach is evaluated using the data collected from a lab-level micro-grid, and forgery attacks and intrusions are launched against the proposed method to investigate its robustness and effectiveness.

TSCBA-A Mitigation System for ARP Cache Poisoning Attacks

Abstract Address Resolution Protocol (ARP) cache poisoning results in numerous attacks. A novel mitigation system for ARP cache poisoning presented here avoids ARP cache poisoning attacks by introducing timestamps and counters in the ARP messages and ARP data tables. The system is evaluated based on criteria specified by the researchers and abnormal packets.

Designing of Efficient Technique Blocking Abnormal Packets through Correlation Analysis in the Healthcare Environment

Background/Objectives: The development of IT medical technology has formed the environment where the effective management and analysis of medical information. Methods/Statistical Analysis: We must explore the ways to secure the security measures because the leak of personal medical information will cause a great risk of leading to the exposure of personal information. In this paper, as a way to defend against malicious attacks in the smart medical environment where the electronic medical devices and wired and wireless networks are combine. Findings: It is aimed to design an abnormal packet screening techniques through correlation analysis of abnormal conducts in the medical security gateway so that it can be safe from server attacks, medical information interception, any counterfeit and falsification thereof. Application/Improvements: It is expected to be utilized in a wide variety of platforms and infrastructure as an essential function enable to respond to threats in future medical security gateway.

PHACK: An Efficient Scheme for Selective Forwarding Attack Detection in WSNs.

In this paper, a Per-Hop Acknowledgement (PHACK)-based scheme is proposed for each packet transmission to detect selective forwarding attacks. In our scheme, the sink and each node along the forwarding path generate an acknowledgement (ACK) message for each received packet to confirm the normal packet transmission. The scheme, in which each ACK is returned to the source node along a different routing path, can significantly increase the resilience against attacks because it prevents an attacker from compromising nodes in the return routing path, which can otherwise interrupt the return of nodes’ ACK packets. For this case, the PHACK scheme also has better potential to detect abnormal packet loss and identify suspect nodes as well as better resilience against attacks. Another pivotal issue is the network lifetime of the PHACK scheme, as it generates more acknowledgements than previous ACK-based schemes. We demonstrate that the network lifetime of the PHACK scheme is not lower than that of other ACK-based schemes because the scheme just increases the energy consumption in non-hotspot areas and does not increase the energy consumption in hotspot areas. Moreover, the PHACK scheme greatly simplifies the protocol and is easy to implement. Both theoretical and simulation results are given to demonstrate the effectiveness of the proposed scheme in terms of high detection probability and the ability to identify suspect nodes.