Network Attack Detection Research Articles

Attack detection and prevention in IoT-SCADA networks using NK-classifier

Attack detection and prevention in IoT-SCADA networks using NK-classifier

ELBA-IoT: An Ensemble Learning Model for Botnet Attack Detection in IoT Networks

Due to the prompt expansion and development of intelligent systems and autonomous, energy-aware sensing devices, the Internet of Things (IoT) has remarkably grown and obstructed nearly all applications in our daily life. However, constraints in computation, storage, and communication capabilities of IoT devices has led to an increase in IoT-based botnet attacks. To mitigate this threat, there is a need for a lightweight and anomaly-based detection system that can build profiles for normal and malicious activities over IoT networks. In this paper, we propose an ensemble learning model for botnet attack detection in IoT networks called ELBA-IoT that profiles behavior features of IoT networks and uses ensemble learning to identify anomalous network traffic from compromised IoT devices. In addition, our IoT-based botnet detection approach characterizes the evaluation of three different machine learning techniques that belong to decision tree techniques (AdaBoosted, RUSBoosted, and bagged). To evaluate ELBA-IoT, we used the N-BaIoT-2021 dataset, which comprises records of both normal IoT network traffic and botnet attack traffic of infected IoT devices. The experimental results demonstrate that our proposed ELBA-IoT can detect the botnet attacks launched from the compromised IoT devices with high detection accuracy (99.6%) and low inference overhead (40 µ-seconds). We also contrast ELBA-IoT results with other state-of-the-art results and demonstrate that ELBA-IoT is superior.

Multi-Aspect Based Approach to Attack Detection in IoT Clouds.

This article covers the issues of constructing tools for detecting network attacks targeting devices in IoT clouds. The detection is performed within the framework of cloud infrastructure, which receives data flows that are limited in size and content, and characterize the current network interaction of the analyzed IoT devices. The detection is based on the construction of training models and uses machine learning methods, such as AdaBoostClassifier, RandomForestClassifier, MultinomialNB, etc. The proposed combined multi-aspect approach to attack detection relies on session-based spaces, host-based spaces, and other spaces of features extracted from incoming traffic. An attack-specific ensemble of various machine learning methods is applied to improve the detection quality indicators. The performed experiments have confirmed the correctness of the constructed models and their effectiveness, expressed in terms of the precision, recall, and f1-measure indicators for each analyzed type of attack, using a series of existing samples of benign and attacking traffic.

Detection of Network Attacks in a Heterogeneous Industrial Network Based on Machine Learning

The paper discusses the issues of improving algorithms for detecting network attacks in a heterogeneous industrial Internet of Things network based on machine learning technologies for subsequent integration with the subsystems of the center for monitoring and responding to information security incidents. A structural diagram of a network attack detection system and an algorithm for intelligent analysis of network traffic parameters in the task of detecting malicious network activity have been developed. Variants of constructing ensembles of classifiers based on machine learning models and heterogeneous neural network models are analyzed. The F1-measure score when working with test samples reaches 96 %. The possibility of embedding the obtained models as modules of network equipment to increase the efficiency of the analysis of network traffic of industrial systems or use as part of a network intrusion detection system is considered. The efficiency of the obtained solutions in assessing the quality of network attack detection on the original datasets is comparable for the tested models. The most promising for use in specialized signal processors of network equipment is a classifier based on a committee of random trees, since it provides good quality detection of network attacks and does not require significant computing resources when launching a model with coefficients selected during training. Monitoring the state of information and network infrastructure is implemented on the basis of a deployed solution based on the ELK stack. A virtual testing ground has been developed to assess the effectiveness of ML-models for detecting network attacks. Further research is aimed at developing a methodology for testing models in various scenarios for the implementation of targeted multi-step network attacks.

Network Attacks Detection Depend on Majority Voting – Weighted Average for Feature Selection and Various Machine Learning Approaches

Due to the enormous growth in Internet usage and computer networks in recent years, new risks and challenges have arisen to network security. Among lots of security problems, network attack is a significant one. For instance, Distributed Denial of Service (DDoS) attacks have become appealing to intruders, and these have presented destructive threats to network infrastructures. Thus, Intrusion Detection Systems (IDSs) and Machine Learning (ML) approaches play a key role to detect such attacks effectively and efficiently. An essential part of several classification issues is the feature selection phase because to detect DDoS attacks depends on how one selects the minimal and relevant features in the network traffics. Unlike recent studies, in this work, a real-life SNMP-MIB dataset is used, as well as, we suggest an Ensemble-Weighted average approach (EnWaFS) that excludes the irrelevant features. An EnWaFS approach consists of two methods, first, Ensemble features by using a majority-voting method that mixed the outcomes of three feature selection approaches, second, a weighted average method that gives one weight for each feature and diminishes also the number of attributes. To evaluate an EnWaFS approach, we have performed four Machine Learning classifiers Neural network (Multi-Layer Perceptron), Vector Support Machine (SVM), Naïve Bayes (NB), and Random Forest (RF) utilizing the optimal set of attributes. The results reveal that our EnWaFS approach can efficiently decrease the number of attributes from 34 to 12 and also, from four ML classifiers were used, the RF technique achieved better performance due to the accuracy, sensitivity (recall), F-1 measure, precision, true-positive-rate, and the false-positive-rate which is decreased.

Cybersecurity in Deep Learning Techniques: Detecting Network Attacks

Deep learning techniques have been found to be useful in a variety of fields. Cybersecurity is one such area. In cybersecurity, both Machine Learning and Deep Learning classification algorithms can be used to monitor and prevent network attacks. Additionally, it can be utilized to identify system irregularities that may signal an ongoing attack. Cybersecurity experts can utilize machine learning and deep learning to help make systems safer. Eleven classification techniques, including eight machine learning algorithms (Decision Tree, Random Forest, and Gradient Boosting) and one statistical technique, were employed to examine the popular HTTP DATASET CSIC 2010. (K-Means). Along with XGBoost, AdaBoost, Multilayer Perceptrons, and Voting, three deep learning algorithms are Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and LSTM plus CNN. To evaluate the performance of such models, precision, accuracy, f1-score, and recall are often used metrics. The results showed that when comparing the three deep learning algorithms by the aforementioned metrics, the LSTM with CNN produced the best performance outcomes in this paper. These findings will show that our use of this algorithm allows us to detect multiple attacks and defend against any external or internal threat to the network.

An Effective Classifier Model for Imbalanced Network Attack Data

Recently, machine learning algorithms have been used in the detection and classification of network attacks. The performance of the algorithms has been evaluated by using benchmark network intrusion datasets such as DARPA98, KDD’99, NSL-KDD, UNSW-NB15, and Caida DDoS. However, these datasets have two major challenges: imbalanced data and high-dimensional data. Obtaining high accuracy for all attack types in the dataset allows for high accuracy in imbalanced datasets. On the other hand, having a large number of features increases the runtime load on the algorithms. A novel model is proposed in this paper to overcome these two concerns. The number of features in the model, which has been tested at CICIDS2017, is initially optimized by using genetic algorithms. This optimum feature set has been used to classify network attacks with six well-known classifiers according to high f1-score and g-mean value in minimum time. Afterwards, a multi-layer perceptron based ensemble learning approach has been applied to improve the models’ overall performance. The experimental results show that the suggested model is acceptable for feature selection as well as classifying network attacks in an imbalanced dataset, with a high f1-score (0.91) and g-mean (0.99) value. Furthermore, it has outperformed base classifier models and voting procedures.

A lightweight intrusion detection system based on RSSI for sybil attack detection in wireless sensor networks

As the prevalence of Wireless Sensor Networks (WSNs) grows in the many mission-critical applications such as military and civil domains, the need for network security has become a critical concern. The inherently vulnerable characteristics of WSNs appoint them susceptible to various types of attacks. A particularly harmful attack against sensor and ad hoc networks is known as the Sybil attack, where a node illegitimately claims multiple identities. Sybil attacks can severely deteriorate the network performance and compromise the security by disrupting many networking protocols. This paper presents a lightweight Intrusion detection system (IDS) based on received signal strength indicator (RSSI) readings of messages to protect WSNs against Sybil attack. Our idea in the proposed method is based on the local calculation (within each node and without the need for communications) the RSSI ratio from the suspected nodes to the Sybil attack. The obtained results demonstrate that Proposed System achieves high detection accuracy, low false alarm rate and low energy consumption appointing it a promising IDS candidate for wireless sensor networks.

Low-rate DDoS attack Detection using Deep Learning for SDN-enabled IoT Networks

Software Defined Networks (SDN) can logically route traffic and utilize underutilized network resources, which has enabled the deployment of SDN-enabled Internet of Things (IoT) architecture in many industrial systems. SDN also removes bottlenecks and helps process IoT data efficiently without overloading the network. An SDN-based IoT in an evolving environment is vulnerable to various types of distributed denial of service (DDoS) attacks. Many research papers focus on high-rate DDoS attacks, while few address low-rate DDoS attacks in SDN-based IoT networks. There’s a need to enhance the accuracy of LDDoS attack detection in SDN-based IoT networks and OpenFlow communication channel. In this paper, we propose LDDoS attack detection approach based on deep learning (DL) model that consists of an activation function of the Long-Short Term Memory (LSTM) to detect different types of LDDoS attacks in IoT networks by analyzing the characteristic values of different types of LDDoS attacks and natural traffic, improve the accuracy of LDDoS attack detection, and reduce the malicious traffic flow. The experiment result shows that the model achieved an accuracy of 98.88%. In addition, the model has been tested and validated using benchmark Edge IIoTset dataset which consist of cyber security attacks.

Anomaly Based Detection of Network Attacks: A New Approach

Anomaly Based Detection of Network Attacks: A New Approach

TESTING THE ORGANIZATION'S CORPORATE NETWORK FOR UNAUTHORIZED ACCESS

In today's world, the number of cyber attacks is increasing every year. These attacks lead to massive loss of confidential data, disruption of critical infrastructure. The number of cyberattacks has only increased since the beginning of the pandemic and carries with it significant financial and reputational risks for any company. The work considers possible methods of testing the security of the organization's corporate network against unauthorized penetration. Simulation of testing for unauthorized access to selected information resources was carried out and possible attacks after obtaining such access were characterized. The most typical methods of exploitation of possible vulnerabilities in corporate networks are given. The Kali Linux distribution was chosen because it contains many tools for penetration testing, which allows for periodic testing of networks and nodes, as well as corporate network security audits in order to identify existing vulnerabilities, configuration flaws and close them before they can be used by attackers. During the study, it was found that each system is unique in its own way due to the use of different types of signatures and applications. Such a representation requires in-depth knowledge of attacks and system-specific documentation from the developer to configure the system itself to monitor specific applications. Conducted simulations of the process of detecting network attacks based on the Kali Linux OS utilities showed that this tool is a practical choice for a security administrator and allows him to detect threats to the information system in a timely manner and conduct effective monitoring of the operating environment in real time. Thanks to the utilities of the proposed system, on the basis of which a network attack on the object of protection is implemented, it is possible to eliminate a certain type of vulnerability of the information system or its constituent parts, which will make it impossible to implement many types of attacks. The directions of further research can be aimed at the development of network utilities to implement the protection of various types of operating systems against unauthorized interventions and their subsequent integration into the system of utilities for the appropriate operating environment, as well as to increase the effectiveness of monitoring the information system as a whole for the purpose of detecting various types of vulnerabilities on its assets , which will improve its protection against many types of network attacks.

MNN-XSS: Modular Neural Network Based Approach for XSS Attack Detection

The rapid growth and uptake of network-based communication technologies have made cybersecurity a significant challenge as the number of cyber-attacks is also increasing. A number of detection systems are used in an attempt to detect known attacks using signatures in network traffic. In recent years, researchers have used different machine learning methods to detect network attacks without relying on those signatures. The methods generally have a high false-positive rate which is not adequate for an industry-ready intrusion detection product. In this study, we propose and implement a new method that relies on a modular deep neural network for reducing the false positive rate in the XSS attack detection system. Experiments were performed using a dataset consists of 1000 malicious and 10000 benign sample. The model uses 50 features selected by using Pearson correlation method and will be used in the detection and preventions of XSS attacks. The results obtained from the experiments depict improvement in the detection accuracy as high as 99.96% compared to other approaches.

An Adaptive Network Security System for IoT-Enabled Maritime Transportation

With the rapid growth of the Internet of Things (IoT) applications in Maritime Transportation Systems (MTS), cyber-attacks and challenges in data safety have also increased extensively. Meanwhile, the IoT devices are resource-constrained and cannot implement the existing security systems, making them susceptible to various types of debilitating cyber-attacks. The dynamics in the attack processes in IoT-enabled MTS networks keep changing, which makes a traditional offline or batch ML-based attack detection systems intractable to apply. This paper provides a novel approach of using an adaptive incremental passive-aggressive machine learning (AI-PAML) method to create a network attack detection system (NADS) to protect the IoT devices in an MTS environment. In this paper, we propose an NADS that utilizes a multi-access edge computing (MEC) platform to provide computational resources to execute the proposed model at a network end. Since online learning models face data saturation problems, we present an improved approximate linear dependence and a modified hybrid forgetting mechanism to filter the inefficient data and keep the detection model up-to-date. The proposed data filtering ensures that the model does not experience a rapid increase in unwarranted data, which affects the model's attack detection rate. A Markov transition probability is applied to control the MEC selection and data offloading process by the IoT devices. The performance of the NADS is verified using selected benchmark datasets and a realistic IoT environment. Experimental results demonstrate that AI-PAML achieves remarkable performance in the NADS design for an MTS environment.

Snort ids system visualization interface for alert analysis

Over the past decades, the rapid Internet development and the growth in the number of its users have raised various security issues. Therefore, it is of great importance to ensure the security of the network in order to enable the safe exchange of confidential data, as well as their integrity. One of the most important components of network attack detection is an Intrusion Detection System (IDS). Snort IDS is a widely used intrusion detection system, which logs alerts after detecting potentially dangerous network packets. A major challenge in network monitoring is the high volume of generated IDS alerts. A necessary step in successful network protection is the analysis of the great amount of logged alerts in search of deviations from normal traffic that may indicate an intrusion. The goal of this paper is to design and implement a visualization interface for IDS alert analysis, which graphically presents alerts generated by Snort IDS. Also, the proposed system classifies the alerts according to the most important attack parameters, and allows the users to understand evolving network situations and easily detect possible traffic irregularities. An environment in which the system has been tested in real-time is described, and the results of attack detection and classification are given. One of the detected attacks is analyzed in detail, as well as the method of its detection and its possible consequences.

Dual Generative Adversarial Networks Based Unknown Encryption Ransomware Attack Detection

Aiming at unknown or variant ransomware attack encrypted with SSL (Secure Sockets Layer)/ TLS (Transport Layer Security) protocol, a detection framework named TGAN-IDS (Transferred Generating Adversarial Network-Intrusion Detection System) based on dual generative adversarial networks is presented in this paper. In this framework, DCGAN (Deep Convolutional Generative Adversarial Network) is adopted to train a generator which has good performance to generate adversarial sample, and is transferred to the generator of TGAN. A pre-training model named PreD is built based on CNN (Convolutional Neural Network), which has good performance to do binary classification, and is transferred to the discriminator of TGAN. The generator and discriminator of TGAN play games in training process until the discriminator has a strong ability to detection unknown attack, and then it is output as an anomaly detector. In order to suppress the deterioration of normal sample detection ability during adversarial training of TGAN, a reconstruction loss function is introduced into the target function of TGAN. Experiments on a mixed dataset which is constructed by CICIDS2017 and other ransomware datasets show comparing with other deep learning network, such as AlexNet, ResNet and DenseNet etc., TGAN-IDS performs well in the indicators of detection accuracy, recall or F1-score etc. Also experiments on KDD99, SWaT and WADI datasets show that TGAN-IDS is suitable for other unencrypted unknown network attack detection.

Intrusion detection in internet of things networks based on machine learning methods

Introduction: The growing amount of digital data generated, among others, by smart devices of the Internet of Things makes it important to study the application of machine learning methods to the detection of network traffic anomalies, namely the presence of network attacks. Purpose: To propose a unified approach to detecting attacks at different levels of IoT network architecture, based on machine learning methods. Results: It was shown that at the wireless sensor network level, attack detection is associated with the detection of anomalous behavior of IoT devices, when the deviation of an IoT device behavior from its profile exceeds a predetermined level. Smart IoT devices are profiled on the basis of statistical characteristics, such as the intensity and duration of packet transmission, the proportion of retransmitted packets, etc. At the level of a local or global wired IoT network, data is aggregated and then analyzed using machine learning methods. Trained classifiers can become a part of a network attack detection system, making decisions about compromising a node on the fly. Models of classifiers of network attacks were experimentally selected both at the level of a wireless sensor network and at the level of a local or global wired network. The best results in terms of completeness and accuracy estimates are demonstrated by the random forest method for a wired local and/or global network and by all the considered methods for a wireless sensor network. Practical relevance: The proposed models of classifiers can be used for developing intrusion detection systems in IoT networks.

A Hybrid Lightweight System for Early Attack Detection in the IoMT Fog.

Cyber-attack detection via on-gadget embedded models and cloud systems are widely used for the Internet of Medical Things (IoMT). The former has a limited computation ability, whereas the latter has a long detection time. Fog-based attack detection is alternatively used to overcome these problems. However, the current fog-based systems cannot handle the ever-increasing IoMT’s big data. Moreover, they are not lightweight and are designed for network attack detection only. In this work, a hybrid (for host and network) lightweight system is proposed for early attack detection in the IoMT fog. In an adaptive online setting, six different incremental classifiers were implemented, namely a novel Weighted Hoeffding Tree Ensemble (WHTE), Incremental K-Nearest Neighbors (IKNN), Incremental Naïve Bayes (INB), Hoeffding Tree Majority Class (HTMC), Hoeffding Tree Naïve Bayes (HTNB), and Hoeffding Tree Naïve Bayes Adaptive (HTNBA). The system was benchmarked with seven heterogeneous sensors and a NetFlow data infected with nine types of recent attack. The results showed that the proposed system worked well on the lightweight fog devices with ~100% accuracy, a low detection time, and a low memory usage of less than 6 MiB. The single-criteria comparative analysis showed that the WHTE ensemble was more accurate and was less sensitive to the concept drift.

Detecting Network Attacks on Software Configured Networks Using the Isolating Forest Algorithm

Detecting Network Attacks on Software Configured Networks Using the Isolating Forest Algorithm

Application of Synthetic Data Generation Methods to the Detection of Network Attacks on Internet of Things Devices

Application of Synthetic Data Generation Methods to the Detection of Network Attacks on Internet of Things Devices

Analysis of a Huge Amount of Network Traffic Based on Quantum Machine Learning

A method for analyzing network traffic based on quantum machine learning is presented. A method for network traffic encoding into quantum computer terms is developed. The experimental results show the superiority of the proposed approach over traditional machine learning methods for detecting network attacks.