Attack Detection Approach Research Articles

Exploring the ALNS method for improved cybersecurity: A deep learning approach for attack detection in IoT and IIoT environments

With the emergence of the Internet of Things (IoT) and the Industrial Internet of Things (IIoT), the flow of data across the world is experiencing a rapid expansion. Unfortunately, this exponential growth is accompanied by a proportional increase in cyber threats, jeopardizing the security and integrity of computer systems. In this context, intrusion detection becomes a necessity to protect networks and systems against potential attacks, ensuring their proper functioning and reliability. In this paper, we propose a deep learning-based model for attack detection. This model utilizes a convolutional neural network to train the datasets, which are first cleaned and preprocessed. The model inputs are selected using an optimization method called adaptive large neighborhood search. The results obtained for the four datasets used - CICIDS2017, Edge-IIoTset, ToN-IoT windows7, and ToN-IoT windows10 - demonstrate the model’s effectiveness for both multi-class and binary classification cases. In the binary case, the accuracy reaches 99.85%, 100%, 99.97%, and 100%, respectively, and in the multi-class case, it stands at 99.81%, 94.98%, 99.92%, and 99.84%, respectively.

A Data-Driven Approach for Classifying and Predicting DDoS Attacks with Machine Learning

The importance of IoT security is growing as a result of the growing number of IoT devices and their many applications. Distributed denial of service (DDoS) assaults on IoT systems have become more frequent, sophisticated, and of a different kind, according to recent research on network security, making DDoS one of the most formidable dangers. Real, lucrative, and efficient cybercrimes are carried out using DDoS attacks. One of the most dangerous types of assaults in network security is the DDoS attack. ML-based DDoS-detection systems continue to face obstacles that negatively impact their accuracy. AI, which incorporates ML to detect cyberattacks, is the most often utilised approach for these goals. In this study, it is suggested that DDoS assaults in Software-Defined Networking be identified and countered using ML approaches. The F1-score, recall, accuracy, and precision of many ML techniques, including Cat Boost and Extra Tree classifier, are compared in the suggested model. DDoS-Net is designed to handle data imbalance effectively and incorporates thorough feature analysis to enhance the model's detection capabilities. Evaluation on the UNSW-NB15 dataset demonstrates the exceptional performance of DDoS-Net. The highest accuracy achieved by the machine learning algorithms Cat Boost and Extra Tree classifier is 90.78% and 90.27% respectively using the most familiar dataset. This work presents a strong and precise approach for DDoS attack detection, which greatly improves the cybersecurity environment and strengthens digital infrastructures against these ubiquitous threats.

Distributed Denial of Service Attack Detection and Prevention Using Pipit Fox-Attentional Deep Learning in Software-Defined Networking

The Software-Defined Network (SDN) remains the innovative model that assists in satisfying the new application requirements of future networks. However, destructive attacks, particularly Distributed Denial of Service (DDoS) attacks, are aimed primarily at the SDN control panel, presenting a significant risk to network security. The traditional approaches for DDoS attack detection exhibit several limitations including interpretability challenges, overfitting problems, and false predictions. To mitigate these drawbacks, the research proposed a Pipit Flying Fox Optimized Deep Neural Network (PPF-DNN) and Intelligent Pipit Forage Optimized-Attentional Convolutional Neural Network (IPFO-ACNN) model. The channel attention is employed to enable the network to focus selectively on relevant information, improving the model’s sensitivity to subtle anomalies associated with DDoS attacks. By dynamically adjusting the attention weights across channels, the mechanism enhances the capability of the model to discriminate the normal network traffic and malicious patterns, which results in improved precision and reduced false positives. This approach harnesses the power of CNN to automatically extract hierarchical features from network data, enhancing the efficacy of the ACNN model in attack detection. IPFO and PPF algorithms integrate the unique strengths of bio-inspired algorithms, creating a synergistic approach for efficient model parameter tuning. In the case of Training Percentage (TP) 80, the accuracy, sensitivity, and specificity of the IPFO-ACNN model are evaluated as 98.87%, 99.24% and 97.91%, respectively. Similarly, the PPF-DNN model’s performance is assessed as 98.49%, 92.50% and 98.55%, which presents a promising avenue for bolstering network security infrastructure, ensuring more robust DDoS detection and mitigation capabilities in an increasingly complex cyber threat landscape.

A PCA-based algorithm for online false data injection and jamming attacks detection in cyber-physical systems

Cyber-physical systems face cyberattacks that hinder performance, increase cost, or even collapse the system. Thus, rapid and accurate attack detection is crucial for quick activation of defense mechanisms. Model-based attack detection approaches are known for their precision; however, the unavailability of the exact system model poses a challenge. In response, model-free approaches have gained increased attention as a practical alternative. In this paper, an online model-free algorithm for detecting false data injection and jamming attacks on CPSs is proposed. The method leverages principal component analysis to reconstruct the expected observations in a reduced dimension space, emphasizing the most effective principal components. Then, deciding on attacked or normal operation relies on analyzing either the Euclidean distance or the cosine similarity of the discrepancy between the expected and actual observations. The proposed metrics effectively expose subtle deviations from expected behavior, as any alteration in these components augments the distance between the observed and reconstructed values. The proposed method was compared with the conventional cumulative sum discriminator and Kalman-based algorithm, using an IEEE-14, IEEE-30, and IEEE-118 bus systems. The results demonstrate the superiority of the proposed algorithm in terms of various evaluation metrics, including F-score, precision, recall, and miss detection ratio.

A novel approach for APT attack detection based on an advanced computing

To enhance the effectiveness of the Advanced Persistent Threat (APT) detection process, this research proposes a new approach to build and analyze the behavior profiles of APT attacks in network traffic. To achieve this goal, this study carries out two main objectives, including (i) building the behavior profile of APT IP in network traffic using a new intelligent computation method; (ii) analyzing and evaluating the behavior profile of APT IP based on a deep graph network. Specifically, to build the behavior profile of APT IP, this article describes using a combination of two different data mining methods: Bidirectional Long Short-Term Memory (Bi) and Attention (A). Based on the obtained behavior profile, the Dynamic Graph Convolutional Neural Network (DGCNN) is proposed to extract the characteristics of APT IP and classify them. With the flexible combination of different components in the model, the important information and behavior of APT attacks are demonstrated, not only enhancing the accuracy of detecting attack campaigns but also reducing false predictions. The experimental results in the paper show that the method proposed in this study has brought better results than other approaches on all measurements. In particular, the accuracy of APT attack prediction results (Precision) reached from 84 to 91%, higher than other studies of over 7%. These experimental results have proven that the proposed BiADG model for detecting APT attacks in this study is proper and reasonable. In addition, those experimental results have not only proven the effectiveness and superiority of the proposed method in detecting APT attacks but have also opened up a new approach for other cyber-attack detections such as distributed denial of service, botnets, malware, phishing, etc.

SSRL-UAVs: A Self-Supervised Deep Representation Learning Approach for GPS Spoofing Attack Detection in Small Unmanned Aerial Vehicles

Self-Supervised Representation Learning (SSRL) has become a potent strategy for addressing the growing threat of Global Positioning System (GPS) spoofing to small Unmanned Aerial Vehicles (UAVs) by capturing more abstract and high-level contributing features. This study focuses on enhancing attack detection capabilities by incorporating SSRL techniques. An innovative hybrid architecture integrates Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models to detect attacks on small UAVs alongside two additional architectures, LSTM-Recurrent Neural Network (RNN) and Deep Neural Network (DNN), for detecting GPS spoofing attacks. The proposed model leverages SSRL, autonomously extracting meaningful features without the need for many labelled instances. Key configurations include LSTM-GRU, with 64 neurons in the input and concatenate layers and 32 neurons in the second layer. Ablation analysis explores various parameter settings, with the model achieving an impressive 99.9% accuracy after 10 epoch iterations, effectively countering GPS spoofing attacks. To further enhance this approach, transfer learning techniques are also incorporated, which help to improve the adaptability and generalisation of the SSRL model. By saving and applying pre-trained weights to a new dataset, we leverage prior knowledge to improve performance. This integration of SSRL and transfer learning yields a validation accuracy of 79.0%, demonstrating enhanced generalisation to new data and reduced training time. The combined approach underscores the robustness and efficiency of GPS spoofing detection in UAVs.

Towards a Deep Learning Approach for IoT Attack Detection Based on a New Generative Adversarial Network Architecture and Gated Recurrent Unit

Towards a Deep Learning Approach for IoT Attack Detection Based on a New Generative Adversarial Network Architecture and Gated Recurrent Unit

Advanced Persistent Threat Attack Detection Systems: A Review of Approaches, Challenges, and Trends

Advanced persistent threat (APT) attacks present a significant challenge for any organization, as they are difficult to detect due to their elusive nature and characteristics. In this paper, we conduct a comprehensive literature review to investigate the various APT attack detection systems and approaches and classify them based on their threat model and detection method. Our findings reveal common obstacles in APT attack detection, such as correctly attributing anomalous behavior to APT attack activities, limited availability of public datasets and inadequate evaluation methods, challenges with detection procedures, and misinterpretation of requirements. Based on our findings, we propose a reference architecture to enhance the comparability of existing systems and provide a framework for classifying detection systems. In addition, we look in detail at the problems encountered in current evaluations and other scientific gaps, such as a neglected consideration of integrating the systems into existing security architectures and their adaptability and durability. While no one-size-fits-all solution exists for APT attack detection, this review shows that graph-based approaches hold promising potential. However, further research is required for real-world usability, considering the systems’ adaptability and explainability.

An effective attack detection framework using multi-scale depth-wise separable 1DCNN via fused grasshopper-based lemur optimizer in IoT routing system

A secured IoT routing model against different attacks has been implemented to detect attacks like replay attacks, version attacks, and rank attacks. These attacks cause certain issues like energy depletion, minimized packet delivery, and loop creation. By mitigating these issues, an advanced attack detection approach for secured IoT routing techniques with a deep structured scheme is promoted to attain an efficient attack detection rate over the routing network. In the starting stage, the aggregation of data is done with the help of IoT networks. Then, the selected weighted features are subjected to the Multiscale Depthwise Separable 1-Dimensional Convolutional Neural Networks (MDS-1DCNN) approach for attack detection, in which the parameters in the 1-DCNN are tuned with the aid of Fused Grasshopper-aided Lemur Optimization Algorithm (FG-LOA). The parameter optimization of the FG-LOA algorithm is used to enlarge the efficacy of the approach. Especially, the MDS-1DCNN model is used to detect different attacks in the detection phase. The attack nodes are mitigated during the routing process using the developed FG-LOA by formulating the fitness function based on certain variables such as shortest distance, energy, path loss and delay, and so on in the routing process. Finally, the performances are examined through the comparison with different traditional methods. From the validation of outcomes, the accuracy value of the developed attack detection model is 96.87%, which seems to be better than other comparative techniques. Also, the delay analysis of the routing model based on FG-LOA is 17.3%, 12.24%, 10.41%, and 15.68% more efficient than the classical techniques like DHOA, HBA, GOA, and LOA, respectively. Hence, the effectualness of the offered approach is more enriched than the baseline approaches and also it has mitigated diverse attacks using secured IoT routing and different attack models.

An improved man-in-the-middle (MITM) attack detections using convolutional neural networks

The increasing reliance on digital communication networks has made information security a critical concern for individuals, organizations, and governments worldwide. Man-in-the-middle (MITM) attacks are significant, prevalent, and damaging concerning cyber-attacks. Detecting MitM attacks is complex due to their stealthy nature and the sophisticated methods employed by attackers. There is the need for researchers to address this issue using current and novel methods like artificial intelligence. In this paper, an improved MitM attack detection approach using the Convolutional Neural Network (CNN) deep learning algorithm is developed, resulting in an overall detection accuracy of 0.986%. The results confirms that the proposed model is very efficient in comparision to other proposed solutions by other authors.

RETRACTED ARTICLE: A clustering approach for attack detection and data transmission in vehicular ad-hoc networks

ABSTRACT We, the Editors and Publisher of Network: Computation in Neural Systems, have retracted the following article: Barve, A., & Patheja, P. S. (2023). A clustering approach for attack detection and data transmission in vehicular ad-hoc networks. Network: Computation in Neural Systems, 1–26. https://doi.org/10.1080/0954898X.2023.2279973 Since publication, significant concerns have been raised about the fact that this article has substantial overlaps with the following article: Barve, A. & Patheja, P. S. (2023). A clustering approach for attack detection and data transmission in vehicular ad-hoc networks. Ad Hoc & Sensor Wireless Networks, 58. 1-2, p. 127-149. DOI: 10.32908/ahswn.v58.10375 Further investigations by the Publisher revealed that these overlaps are present in all sections of the article, including the figures and tables without appropriate acknowledgement. Upon query, the authors agree that the article is a duplicate submission. As this is a serious breach of our Editorial Policies, we are retracting the article from the journal. The corresponding author listed in this publication has been informed. We have been informed in our decision-making by our editorial policies and the COPE guidelines. The retracted article will remain online to maintain the scholarly record, but it will be digitally watermarked on each page as ‘Retracted’.

Retraction: A clustering approach for attack detection and data transmission in vehicular ad-hoc networks

Retraction: A clustering approach for attack detection and data transmission in vehicular ad-hoc networks

Enhancing university network management and security: a real-time monitoring, visualization & cyber attack detection approach using Paessler PRTG and Sophos Firewall

Enhancing university network management and security: a real-time monitoring, visualization & cyber attack detection approach using Paessler PRTG and Sophos Firewall

RPL-based attack detection approaches in IoT networks: review and taxonomy

The Routing Protocol for Low-Power and Lossy Networks (RPL) plays a crucial role in the Internet of Things (IoT) and Wireless Sensor Networks. However, ensuring the RPL protocol’s security is paramount due to its susceptibility to various attacks. These attacks disrupt data transmission and can substantially damage network topology by depleting critical resources. This paper presents a comprehensive survey addressing several key components in response to this challenge. Firstly, it categorizes potential attacks targeting the RPL protocol based on their impact on network performance and explores effective mechanisms to secure the protocol against them. The study identifies the most destructive and problematic threats affecting RPL functionality. Furthermore, it provides valuable insights into the security challenges of the RPL protocol and discusses their real-world implications for deploying and maintaining IoT and sensor networks. To underscore the uniqueness of the survey, we offer a qualitative comparison with other surveys in the same field. While this study acknowledges certain limitations, such as intentionally focusing only on reviewing RPL-specific attacks, it is a valuable reference for future researchers seeking to comprehend and mitigate attacks targeting RPL. It also suggests areas for further research in this domain.

An entropy and machine learning based approach for DDoS attacks detection in software defined networks

Software-defined networks (SDNs) have been growing rapidly due to their ability to provide an efficient network management approach compared to traditional methods. However, one of the major challenges facing SDNs is the threat of Distributed Denial of Service (DDoS) attacks, which can severely impact network availability. Detecting and mitigating such attacks is challenging, given the constantly evolving range of attack techniques. In this paper, a novel hybrid approach is proposed that combines statistical methods with machine-learning capabilities to address the detection and mitigation of DDoS attacks in SDN environments. The statistical phase of the approach utilizes an entropy-based detection mechanism, while the machine-learning phase employs a clustering mechanism to analyze the impact of active users on the entropy of the system. The k-means algorithm is used for clustering. The proposed approach was experimentally evaluated using three modern datasets, namely, CIC-IDS2017, CSE-CIC-2018, and CICIDS2019. The results demonstrate the effectiveness of the system in detecting and blocking sudden and rapid attacks, highlighting the potential of the proposed approach to significantly enhance security against DDoS attacks in SDN environments.

A recommendation attack detection approach integrating CNN with Bagging

Due to their open architecture, collaborative filtering recommender systems are susceptible to recommendation attacks, in which attackers inject fake rating data into the system to affect the accuracy of recommendation results. To detect these attacks, numerous detection methods have been designed and proven effective. However, in recent years, deep learning-based recommendation attack models such as GSA-GAN have shown higher concealment, posing new challenges to existing detection methods. Motivated by the need for improved detection, in this paper we propose a new approach called CNN-BAG, which integrates convolutional neural network (CNN) and Bagging (BAG) techniques. CNN-BAG can enhance the detection performance by simultaneously leveraging the deep learning capabilities of CNN and the ensemble learning strengths of Bagging. Firstly, we construct a deep neural network based on CNN as the base learner to automatically extract and learn features of recommendation attacks. Secondly, we use the Bagging algorithm to perform bootstrap sampling on the training data to generate multiple diverse training subsets. The above constructed base learners are then trained on these generated training subsets to produce multiple base classifiers for classifying recommendation attacks. Finally, we combine the base classifiers’ outputs using a majority voting method to obtain the final detection results. To assess the performance of CNN-BAG in detecting recommendation attacks, we compared it against several well-established detection methods on the Movielens-10M and Amazon datasets. Our experiments revealed that CNN-BAG is adept at identifying various attack types, including the deep learning-based recommendation attack models.

Machine Learning-Driven Detection of Cross-Site Scripting Attacks

The ever-growing web application landscape, fueled by technological advancements, introduces new vulnerabilities to cyberattacks. Cross-site scripting (XSS) attacks pose a significant threat, exploiting the difficulty of distinguishing between benign and malicious scripts within web applications. Traditional detection methods struggle with high false-positive (FP) and false-negative (FN) rates. This research proposes a novel machine learning (ML)-based approach for robust XSS attack detection. We evaluate various models including Random Forest (RF), Logistic Regression (LR), Support Vector Machines (SVMs), Decision Trees (DTs), Extreme Gradient Boosting (XGBoost), Multi-Layer Perceptron (MLP), Convolutional Neural Networks (CNNs), Artificial Neural Networks (ANNs), and ensemble learning. The models are trained on a real-world dataset categorized into benign and malicious traffic, incorporating feature selection methods like Information Gain (IG) and Analysis of Variance (ANOVA) for optimal performance. Our findings reveal exceptional accuracy, with the RF model achieving 99.78% and ensemble models exceeding 99.64%. These results surpass existing methods, demonstrating the effectiveness of the proposed approach in securing web applications while minimizing FPs and FNs. This research offers a significant contribution to the field of web application security by providing a highly accurate and robust ML-based solution for XSS attack detection.

An efficient attack detection and prevention approach for secure WSN mobile cloud environment

An efficient attack detection and prevention approach for secure WSN mobile cloud environment

A Novel Optimized Classification approach for Spam Message Cyber Attack Detection and Prevention using Machine Learning Approach

A Novel Optimized Classification approach for Spam Message Cyber Attack Detection and Prevention using Machine Learning Approach

A dual-head output network attack detection and classification approach for multi-energy systems

In today’s digital age, multi-energy systems (MES) have become an indispensable part of the social infrastructure, providing people with diversified energy support such as electricity, gas, water and so on. However, with the increasing popularity and networking of MES, the network security threats they face are becoming more and more serious, especially the threat of network attacks. This makes it essential to detect attacks on MES and precisely classify attack types in order to establish effective defense strategies. In this paper, a Dual-Head output network attack detection and classification method based on parallel CNN-BiLSTM network is proposed. The method adopts a parallel structure and can process different aspects of information at the same time, speeding up the training and inference process of the whole network, making the system respond more quickly to potential network attacks, and improving real-time and efficiency. The multi-model fusion structure can give full play to the advantages of CNN and BiLSTM in processing different types of data, so that the system can capture attack characteristics more comprehensively in many aspects, and improve the overall detection and classification performance. The dual-head output not only improves the system’s ability to accurately detect attacks, but also can effectively classify different types of attacks in detail, which helps to formulate more targeted defense strategies. In addition, in order to effectively evaluate our proposed method, the network traffic data required for the experiment were collected in an environment very similar to the actual operating environment of a multi-energy system. Finally, the experiment verifies that our method can not only realize effective detection of network attacks, but also accurately classify different types of attacks.