Active Defense Technology Research Articles

PatchesNet: PatchTST-based multi-scale network security situation prediction

Internet of Things (IoT) technology increases connectivity between devices; however, IoT device networks are less secure, making them highly susceptible to attack. Most of the network security defense techniques are passive defense with inevitable delays. For instance, in the case of intrusion detection systems, during the time interval between detecting an attack and implementing defenses, the attacker may inflict damage on the target. Therefore, the adoption of active defense techniques becomes particularly important. Network Security Situation Prediction (NSSP) is an active defense technology capable of predicting future states of network security. Currently, most methods in the NSSP field focus on single-step prediction, while research related to multi-step prediction is scarce. Hence, this paper presents an NSSP method based on the PatchTST framework(PatchesNet), which exhibits good multi-step predictive performance. The method uses Variational Mode Decomposition (VMD) to deal with sequence instability. Multi-scale Patch delivery (MSP), Multi-scale Second Decomposition (MSD), and Period Embedding (PeE) are used to obtain more sequence features. Correlation Fusion (CF) can reduce the noise effect on prediction. Experiments are conducted on three datasets. The results demonstrate that PatchesNet exhibits favorable performance, relatively reducing the MSE and MAE by 39.243% and 26.033%, respectively, compared to the previous state-of-the-art method.

Deep learning with blockchain based cyber security threat intelligence and situational awareness system for intrusion alert prediction

Network security situation assessment (NSSA) is imperative and active defense technology in the network security situation. By examining NSSA data, one can examine the threat of network security and examine the network attack phase and hence fully grasp the complete network security situation. With the quick design of 5 G, the cloud model and Internet of things (IoT), the network platform is increasingly complicated and resulting in diversity of network threats which discover the accuracy. Thus, a new blockchain based cyber-security threat intelligence (CTI) and situational awareness system is devised for intrusion alert prediction. A blockchain-based CTI model is considered where data acquired are allowed to linear normalization. Here, the cyber situational awareness engine is used for alert segregation, which is implemented with entropy weighting power k means algorithm wherein weights generated during alert segregation are updated using Adaptive Transit Search (ATS). Then, the feature selection is implemented using hybrid Soergel and Lorentzian. The selected features are fed to Deep Maxout Network (DMN) for performing intrusion alert prediction. Finally, the cyber attack mitigation is carried out by blacklisting based on predicted result. The modified DMN outperformed with highest F-measure of 95.2%, precision of 96.9% and recall of 94.7%.

Computer Security Active Defense Technology Based on Bayesian Model

Abstract The existing active defense technology based on game theory is mainly based on static games. This method can not adapt to the dynamic change of the attacker’s attacking intent and tactics. Based on the non-cooperative and non-zero-sum dynamic game theory, a complete Bayesian system of emotional game bodies is established. Use the “virtual node” to transform the attack and defense chart into a tree structure of the attack and defense game. An attack and defense strategy suitable for integrity and incompleteness is given. The experimental simulation results show that the seven comprehensibilities and usability of Nash equilibrium solutions optimized by Bayesian subgames are well obtained

A Port-Hopping Technology against Remote Attacks and Its Effectiveness Evaluation

Traditional network defense approaches are insufficient to deal with new types of network threats. Active defense approaches based on software-defined networks helps to solve this problem, which includes random port-hopping technology. Existing port-hopping approaches have problems such as the inability to completely hide the service port and the complicated hopping mechanism. What is more, there is no strict demonstration of the security effectiveness evaluation of random port hopping and its influencing factors. In this paper, a hidden services port-hopping approach and several models are proposed to solve these existing problems. Firstly, the algorithm, protocol, and flow update process of the method are presented. Secondly, according to the conceptual model of network attack and the network attack and defense model, the mathematical model of network attack is proposed to evaluate the security effectiveness of random port hopping. Furthermore, the resource layer and attack surface are redefined and the conceptual model of random port hopping is proposed to reveal the security mechanism of random port hopping more figuratively. After that, the factors that influence the security effectiveness of random port hopping are analyzed. Finally, both experiments and theoretical analysis show that hidden services port hopping is an effective active defense technology and the factors that influence the probability of a successful attack include the time interval of port hopping, the size of port-hopping space, and the number of vulnerable ports.

Toward Attack-Resistant Route Mutation for VANETs: An Online and Adaptive Multiagent Reinforcement Learning Approach

Vehicular Ad hoc Networks (VANETs) are prone to packet drop attacks because of their inherent distributed architecture and dynamic topology. Existing security schemes mainly focus on multi-path and trust-based routing. Unfortunately, the former causes high energy consumption and the latter requires trust assessment, which is not easy to implement in practice. Route mutation (RM) is emerging as an active defense technology that changes routes periodically. Traditional RM is conceived for fixed network topologies, and needs a centralized controller, so that it cannot be applied to VANETs. Therefore, the present contribution investigates RM in VANETs by proposing a Grid-based extended Joint Action Learning approach (Grid-eJAL). To the best of our knowledge, this is the first contribution that designs an online and adaptive multi-agent reinforcement learning (MARL) for RM to mitigate attacks in VANETs. Differently from existing MARL schemes, Grid-eJAL allows vehicles to share parameters to accelerate the convergence speed of learning. In Grid-eJAL, the area of interest is split in equally sized grids and, when a vehicle transmits packets, the next hop with the minimum angle of mobility is selected within the grid considered as optimal by the learning policy. The convergence of Grid-eJAL is proved theoretically. Finally, extensive simulation results highlight the effectiveness of Grid-eJAL compared to representative state-of-the-art solutions.

The sound of intrusion: A novel network intrusion detection system

A network intrusion detection system is an essential part of network security research. It detects intrusion behaviors through active defense technology and takes emergency measures such as alerting and terminating intrusions. To this end, with the rapid development of learning technology, various machine-learning-based and deep-learning-based approaches have been developed, but there is a limitation in the detection accuracy. We believe that dealing with network traffic as if they are vibrations, waves, or sounds would allow us to detect intruders better. In this work, we envisioned a novel Network Intrusion Detection System called “the sound of intrusion”. The proposed system transforms the traffic flow features into waves and utilizes advanced audio/speech recognition deep-learning-based techniques to detect intruders. We used several deep-learning-based techniques including long short-term memory, deep belief networks, and convolutional neural networks. The proposed approach has been validated using two well-known and recent benchmark datasets namely NSLKDD and CIC-IDS2017. It achieves the highest detection accuracy, 84.82%, and 99.41%, with the lowest false alarm rate of 0.12% and 0.004% on two common network intrusion detection systems datasets, namely NSL-KDD and CICIDS2017, respectively. It demonstrates improvements over existing approaches, and shows a strong potential for use as a modern Network Intrusion Detection System.

A Trust Management Method Against Abnormal Behavior of Industrial Control Networks Under Active Defense Architecture

Trusted computing is a typical active defense technology. Trust management is a core support technology of trusted computing. However, when trust management is applied in the industrial control systems, how to identify malicious behavior effectively, model trust relationships, and make a decision based on behavior trustworthiness, meanwhile how to ensure deployed trust mechanism does not affect the control network’s availability, is a significant issue that has not been solved in the previous literature. This paper proposes a trust management method against abnormal behavior of industrial control networks under active defense architecture. Firstly, we review the difficulties of trust management when applied to industrial control networks and analyze abnormal behaviors of the control operations under unknown threats. Then we extract trust information, model the trust relationship of abnormal behaviors, and establish a trust update and decision-making mechanism under the availability constraints of industrial control networks. Furthermore, we provide a deployment method of the proposed trust management in a distributed control network. Finally, we take five typical abnormal operations on control instruction in an industrial control network as an example and perform a detailed analysis and experimental verification of the proposed method. The results prove that the proposed trust management method has good immunity to abnormal behaviors of the control flow and can be deployed in an industrial control system with availability constraints.

Research on the Intrusion Detection Model of Underwater Sensor Networks

The characteristics of underwater nodes, the harshness of the underwater environment, and the openness of the deployment area make underwater sensor networks vulnerable to various network attacks; in order to defend against potential threats and attacks, intrusion detection, as an active defense technology, can detect different attacks before they occur; currently, the technology is less used in underwater sensor networks and has a low detection rate for some types of attacks and cannot effectively detect the problem of multiple attack types. To address this problem, this paper proposes an intrusion detection model for underwater sensor networks for multiple types of attacks. Firstly, cluster head nodes use neighborhood rough sets for feature extraction, and the reduced dimensional data is transmitted to sink nodes to reduce the node computation. Further, the synthetic minority oversampling technique (SMOTE) is used to balance the data set, increase the number of minority class samples, and improve the detection rate of minority class attacks. Finally, determine whether a node is trusted according to the trust value of the cluster head node, and train the classifier using the random forest algorithm to detect the type of attack; it suffers to achieve intrusion detection of multiple types of attacks. Simulation results show that the model can not only improve the performance of intrusion detection of multitype attacks but also achieve an accuracy of over 99% for the detection of imbalance classes.

Global Analysis of Active Defense Technologies for Unmanned Aerial Vehicle

The main purpose of this article is to enhance the systematicness, comprehensiveness, and profundity of the counter-unmanned aerial system (C-UAS) theoretical system, laying a theoretical foundation for the development of C-UAS technologies and weapons, thereby further improving the ability to deal with air threats such as unmanned aerial vehicles in the future. In the discussion process, it mines information, reveals inherent laws, and thereby puts forward the concept of “active defense technology” in the C-UAS mission. Simultaneously, it carries out a comprehensive summary and systematic classification of various technologies. Then, it analyzes every technology from its main characteristics, theoretical breakthroughs, practical applications in detail and in-depth, and comprehensively compares their respective advantages and limitations. Meanwhile, it focuses on the analysis of directed energy countermeasures. Horizontally, it makes an almost complete summary of the current high-energy laser weapon on a global scale; longitudinally, it cards the actual combat cases of directed energy weapons in C-UAS missions with time as a clue. Furthermore, to better integrate with reality, it conducts an extensive market survey of 581 C-UAS systems from 282 manufacturers in 39 countries around the world based on literature and practice, making them a statistical analysis from four aspects. On this basis, it classifies and summarizes the most advanced weapon systems according to different technologies. Finally, it put forward several prominent and bottleneck problems faced in the current research from three aspects of confrontation, maturity, and law. Correspondingly, it prospects several future development directions and proposes several constructive suggestions from technology and tactic.

Application of Trusted Computing Technology in Active Defense of Smart Substation

Nowadays, most security systems mainly use firewall, intrusion detection, virus killing and other technologies to defend against external attacks. This passive defense mode has low efficiency and high false positive rate, and active defense technology can solve these problems to the greatest extent. At present, the intelligent substation is in the development stage with weak security. After a large number of terminals are connected, although the operation efficiency of the whole station is improved, it also brings more risks. This paper takes the access security of terminal equipment in intelligent substation as the research object. By mining the security vulnerabilities of substation, an active defense method based on trusted computing is proposed, the applicability and efficiency of trusted computing technology in the field of substation active defense are proved and the effectiveness of the method is verified to realize the trust guarantee of the whole process of terminal access to intelligent substation.

Analysis and Application of intelligent Power Control System Cyber Security Situation Awareness Based on Wavelet Neural Network

In recent years, international industrial control network security incidents have occurred frequently. As a core component of the industrial control field, intelligent power control systems are increasingly threatened by external network attacks. Based on the current research status of power industrial control network security, closely combining the development of active monitoring and defense technology in the public network field and the problems encountered by network security operators in actual work, this paper uses data mining methods to study the power control system network security situation awareness technology. Combing operational data collection and integrated processing, situation index screening and extraction, we use wavelet neural network analysis method to train the sampled data set, and finally calculate the true value of the network security status through deep intelligent learning. Finally, we conclude that the artificial intelligence algorithm based on wavelet neural network can be used for power control system network security situation awareness. In actual work, it can predict the situation value for a period of time in the future and assist network security personnel in judgment and decision-making.

Research on Application of Idc Virtualization Security Technology Based on Host Whitelist Protection

In recent years, virtualization technology has been widely used in various operators, but in the IDC virtual resource pool exists malicious scanning, DOS attack, SQL injection, virus Trojan, and based on various vulnerabilities of the invasion behavior. Therefore, there is an urgent need for a virtualization security protection software for IDC. Based on the development and utilization of host whitelist active defense technology, this paper firstly briefly explains the significance of IDC virtualization security technology of host whitelist protection, and at the same time discusses the security method, technology, and implementation scheme of IDC virtualization security technology of host whitelist protection, for the reference of readers.

A Lightweight Intelligent Intrusion Detection Model for Wireless Sensor Networks

The wide application of wireless sensor networks (WSN) brings challenges to the maintenance of their security, integrity, and confidentiality. As an important active defense technology, intrusion detection plays an effective defense line for WSN. In view of the uniqueness of WSN, it is necessary to balance the tradeoff between reliable data transmission and limited sensor energy, as well as the conflict between the detection effect and the lack of network resources. This paper proposes a lightweight Intelligent Intrusion Detection Model for WSN. Combining k-nearest neighbor algorithm (kNN) and sine cosine algorithm (SCA) can significantly improve the classification accuracy and greatly reduce the false alarm rate, thereby intelligently detecting a variety of attacks including unknown attacks. In order to control the complexity of the model, the compact mechanism is applied to SCA (CSCA) to save the calculation time and space, and the polymorphic mutation (PM) strategy is used to compensate for the loss of optimization accuracy. The proposed PM-CSCA algorithm performs well in the benchmark functions test. In the simulation test based on NSL-KDD and UNSW-NB15 data sets, the designed intrusion detection algorithm achieved satisfactory results. In addition, the model can be deployed in an architecture based on cloud computing and fog computing to further improve the real-time, energy-saving, and efficiency of intrusion detection.

RETRACTED ARTICLE: Forest management and resource monitoring based on AMI intrusion detection algorithm and artificial intelligence

Smart grid is the combination of computer network and traditional power system to realize the intelligence of power grid. AMI is an advanced measurement system, which connects the power system and users, realizes the two-way interaction of data and information between power supply enterprises and users, and promotes the development of smart grid. Therefore, the safe use of AMI system is the key to the development of smart grid. With the increasingly close connection between smart grid and computer network, the number of network attacks against AMI system continues to increase. However, the current security defense technology of AMI system is passive defense technology represented by protocol and encryption, which can not resist the invasion of unknown network attacks. The active defense technology represented by intrusion detection is an important barrier of AMI security defense. Now, AMI intrusion detection algorithm based on machine learning is often proposed. This paper will focus on the above problems in the process of AMI intrusion detection. Because the data size is small and the data function is not complete, the detection accuracy of DBN-OS-RKELM algorithm is low. An improved generalized regression neural network (GRNN) intrusion detection algorithm DBN-FOA-GRNN is proposed. The algorithm uses the generalized regression neural network (GRNN) with excellent nonlinear mapping function and high convergence rate. In order to improve the performance of GRNN intrusion detection, population optimization algorithm (FOA) is used to optimize the unique random parameter of GRNN to reduce the possibility of falling into local optimum. This paper uses the public intrusion detection data set NSL-KDD to verify and analyze the algorithm. Experimental results show that the two intrusion detection algorithms proposed in this paper have some improvement in detection effect compared with the traditional machine learning methods. The combination of the two algorithms can solve the problem of intrusion detection of various data, and meet the requirements of AMI intrusion detection.

Research on Optimization of Array Honeypot Defense Strategies Based on Evolutionary Game Theory

Honeypot has been regarded as an active defense technology that can deceive attackers by simulating real systems. However, honeypot is actually a static network trap with fixed disposition, which is easily identified by anti-honeypot technology. Thus, honeypot is a “passive” active defense technology. Dynamic honeypot makes up for the shortcomings of honeypot, which dynamically adjusts defense strategies with the attack of hackers. Therefore, the confrontation between defenders and attackers is a strategic game. This paper focuses on the non-cooperative evolutionary game mechanism of bounded rationality, aiming to improve the security of the array honeypot system through the evolutionarily stable strategies derived from the evolutionary game model. First, we construct a three-party evolutionary game model of array honeypot, which is composed of defenders, attackers and legitimate users. Secondly, we formally describe the strategies and revenues of players in the game, and build the three-party game payoff matrices. Then the evolutionarily stable strategy is obtained by analyzing the Replicator Dynamics of various parties. In addition, we discuss the equilibrium condition to get the influence of the number of servers N on the stability of strategy evolution. MATLAB and Gambit simulation experiment results show that deduced evolutionarily stable strategies are valid in resisting attackers.

New Active Defense Technology under the Background of Power Information Network Security

With the rapid development of the national power industry, the security of power information network has been widely concerned by the society, and the related impact has also been prominent. At this stage, the development of power information technology is more and more inseparable from the network, so network security has become more and more important, if the network has a serious threat in practical application, the loss caused will be unbearable. In the process of controlling the network security of power information industry, one of the most important and effective methods is active defense. Based on this, this paper puts forward the research of active defense technology under the background of power information network security, expounds the defects of firewall technology and intrusion trap technology in passive network security defense technology, and introduces the pitfalls of active defense new technology In addition, the paper discusses the new active defense technology and its application in power information network security, and puts forward reasonable suggestions. Therefore, the use of information technology to solve the hidden danger of power network security is important.

Modeling and Performance Analysis of Satellite Network Moving Target Defense System with Petri Nets

With the development of satellite communication networks and the increase of satellite services, security problems have gradually become some of the most concerning issues. Researchers have made great efforts, including conventional safety methods such as secure transmission, anti-jamming, secure access, and especially the new generation of active defense technology represented by MTD. However, few scholars have theoretically studied the influence of active defense technique on the performance of satellite networks. Formal modeling and performance analysis have not been given sufficient attention. In this paper, we focus on the performance evaluation of satellite network moving target defense system. Firstly, two Stochastic Petri Nets (SPN) models are constructed to analyze the performance of satellite network in traditional and active defense states, respectively. Secondly, the steady-state probability of each marking in SPN models is obtained by using the isomorphism relation between SPN and Markov Chains (MC), and further key performance indicators such as average time delay, throughput, and the utilization of bandwidth are reasoned theoretically. Finally, the proposed two SPN models are simulated based on the PIPE platform. In addition, the effect of parameters on the selected performance indexes is analyzed by varying the values of different parameters. The simulation results prove the correctness of the theoretical reasoning and draw the key factors affecting the performance of satellite network, which can provide an important theoretical basis for the design and performance optimization of the satellite network moving target defense system.

Research on lightweight web intrusion active defense key technology and visual measurement model based on dynamic ip black list

In view of the existing passive detection and prevention methods and lack of commercial products are expensive and complex deployment problem of a simple and fast active defense technology of WEB dynamic real-time active defense, in order to solve the problem of attack and defense for WEB server. Firstly, based on reverse proxy massive WAF logs, the mathematical model of user access behavior is established, and the behavior characteristics of malicious WEB attacks are studied through data mining analysis. Then, a threat factor algorithm and a dynamic IP blacklist generation algorithm are designed based on these features and a custom rule base. Finally, based on visual measurement model, D3 WEB visualization technology is used to monitor and measure WEB intrusion. The technology reduces the false alarm and false positive rate of active defense, improves the defense effect and execution efficiency, and ensures the quality of normal network communication.

Network Security Model Based on Active and Passive Defense Hybrid Strategy

This paper studies a new network information security system and its evaluation method based on the security threat situation network security model. This paper expounds the application of active defense system and passive defense system in network security, and uses advanced technical support platform and network security model. In this paper, the active defense system and the passive defense system are organically combined to form a new model of computer network security with characteristics. At the same time, based on the idea of security threat situation evaluation, this paper extends the traditional PDRR security model and proposes a network active defense security model and defense in depth security strategy. On this basis, a hybrid architecture of active and passive defense is proposed. The architecture integrates some new network active defense technologies, and constructs a comprehensive and deep network defense system together with network passive defense means. The experimental results show that the proposed defense model improves the security defense efficiency and effective defense rate of the traditional PDRR security model.

Research on Cyberspace Mimic Defense Based on Dynamic Heterogeneous Redundancy Mechanism

With the rapid growth of network technology, the methods and types of cyber-attacks are increasing rapidly. Traditional static passive defense technologies focus on external security and known threats to the target system and cannot resist advanced persistent threats. To solve the situation that cyberspace security is easy to attack and difficult to defend, Chinese experts on cyberspace security proposed an innovative theory called mimic defense, it is an active defense technology that employs “Dynamic, Heterogeneous, Redundant” architecture to defense attacks. This article first briefly describes the classic network defense technology and Moving Target Defense (MTD). Next, it mainly explains in detail the principles of the mimic defense based on the DHR architecture and analyzes the attack surface of DHR architecture. This article also includes applications of mimic defense technology, such as mimic routers, and mimic web defense systems. Finally, it briefly summarizes the existing research on mimic defense, expounds the problems that need to be solved in mimic defense, and looks forward to the future development of mimic defense.