Attack Detection Process Research Articles

IoT Security Using Machine Learning Methods with Features Correlation

The Internet of Things (IoT) is an innovative technology that makes our environment smarter, with IoT devices as an integral part of home automation. Smart home systems are becoming increasingly popular as an IoT service in the home that connects via a network. Due to the security weakness of many devices, the malware is targeting IoT devices. After being infected with malicious attacks on smart devices, they act like bots that the intruders can control. Machine learning methods can assist in improving the attack detection process for these devices. However, the irrelevant features raise the computation time as well as affect the detection accuracy in the processing with many features. We proposed a machine learning-based IoT security framework using feature correlation. The feature extraction scheme, one-hot feature encoding, correlation feature selection, and attack detection implement an active detection mechanism. The results show that the implemented framework is not only for effective detection but also for lightweight performance. The proposed system outperforms the results with the selected features, which have almost 100% detection accuracy. It is also approved that the proposed system using CART is more suitable in terms of processing time and detection accuracy.

Hybrid stacked autoencoder with dwarf mongoose optimization for Phishing attack detection in internet of things environment

With the fast development of the Internet of Things (IoTs), phishing attacks are transferring to this domain because of the number of IoT devices and private data they can handle. IoT phishing suggests the malicious practice of targeting IoT devices and their users to steal sensitive data, gain unauthorized access, or compromise the safety and functionality of these devices. Phishing attacks in the framework of IoT take several procedures, comprising SMS phishing, email phishing, or even physical attacks on the devices themselves. Deep learning (DL) approaches are executed to improve the prevention and detection of IoT phishing attacks. Consequently, this article introduces a Dwarf Mongoose Optimization with deep learning for Phishing Attack Detection (DMODL-PAD) method in an IoT platform. The objective of the DMODL-PAD method is to utilize feature selection (FS) with a hyperparameter tuning strategy for automated phishing attack detection in the IoT platform. The DMODL-PAD method involves the DMO model, unlike the FS method. Afterwards, a hybrid stacked autoencoder (HSAE) model can execute the phishing attack detection process. The DMODL-PAD method uses a jellyfish search optimizer (JSO) for the hyperparameter tuning process. The experimentation validation of the DMODL-PAD technique has been examined under a benchmark database. The extensive outcomes portrayed the superior detection results of the DMODL-PAD technique over other recent methods. These results ensured that the DMODL-PAD technique could effectually detect phishing attacks from the IoT environment.

Cyber attack detection and mitigation process in cloud via deep hybrid model with selected feature set

Cyber attack detection and mitigation process in cloud via deep hybrid model with selected feature set

Enhancing Cybersecurity in Financial Services using Single Value Neutrosophic Fuzzy Soft Expert Set

Cybersecurity has become a primary concern as the financial sectors generally handle increasing cyber-attacks and an increasing danger of financial crime. Recently, ransomware attacks have intensified, affecting enterprises, and crucial infrastructure worldwide. Ransomware employs sophisticated encryption techniques to encrypt data on the targeted device, then requests payment for decrypting the data. Artificial intelligence (AI) approaches involving ML were progressively employed in the domain of cybersecurity and significantly subsidized to preventing and detecting variety of threats. On the other hand, the several researchers that employed ML to identify ransomware are still constrained by the accuracy of models, the complication of malware, the high false-positive rate, and the lack of setting up the appropriate analysis environment. Therefore, there is a need to design efficient ransomware detection based on ML algorithms. This work introduces a modified Single Value Neutrosophic Fuzzy Soft Expert Set (M-SVNFSES) technique for cyberattack detection. The main purpose of the M-SVNFSES system is to detect and recognize the existence of cyberattacks in the financial sectors. In the M-SVNFSES technique, min-max normalization is used as an initial pre-processing stage. For the identification of cyberattacks in the financial sectors, the M-SVNFSES technique uses the SVNFSES model. To enhance its performance, the M-SVNFSES technique makes use of a bat optimization algorithm (BOA). The performance of the M-SVNFSES methodology was extensively studied using financial datasets. The experimental outcomes depicted that the M-SVNFSES method reaches optimal detection performance in attack detection process

DDoS Attack Detection in WSN using Modified Invasive Weed Optimization with Extreme Learning Machine

Wireless sensor networks (WSN) are the wide-spread methodology for its distribution of the vast amount of devoted sensor nodes (SNs) that is employed for sensing the atmosphere and gather information. The gathered information was transmitted to the sink nodes via intermediate nodes. Meanwhile, the SN data are prone to the internet, and they are vulnerable to diverse security risks, involving distributed denial of service (DDoS) outbreaks that might interrupt network operation and compromises data integrity. In recent times, developed machine learning (ML) approaches can be applied for the discovery of DDoS attacks and accomplish security in WSN. To achieve this, this study presents a modified invasive weed optimization with extreme learning machine (MIWO-ELM) model for DDoS outbreak recognition in the WSN atmosphere. In the presented MIWO-ELM technique, an initial stage of data pre-processing is conducted. The ELM model can be applied for precise DDoS attack detection and classification process. At last, the MIWO method can be exploited for the parameter tuning of the ELM model which leads to improved performance of the classification. The experimental analysis of the MIWO-ELM method takes place using WSN dataset. The comprehensive simulation outputs show the remarkable performance of the MIWO-ELM method compared to other recent approaches.

Cyber security: performance analysis and challenges for cyber attacks detection

Nowadays, with the occurrence of new attacks and raised challenges have been facing the security of computer systems. Cyber security techniques have become essential for information technology services to detect and react against cyber-attacks. The strategy of cyber security enables visibility of various types of attacks and vulnerabilities throughout computer networks, whilst also provides detecting cyber-attacks and effective ways of identifying and preventing them. This study mainly focuses on the performance analysis and challenges faced by cyber security using the latest techniques. It also provides a review of the attack detection process including the robust effectiveness of intelligent techniques. Finally, summarize and discuss some methods to increase attack detection performance utilizing deep learning (DL) architectures.

Digital twin-driven SDN for smart grid: A deep learning integrated blockchain for cybersecurity

Internet of Things (IoT)-enabled Smart Grid (SG) network is envisioned as the next-generation network for intelligent and efficient electric power transmission. In SG environment, the Smart Meters (SMs) mostly exchange services and data from Service Providers (SPs) via insecure public channel. This makes the entire SG ecosystem vulnerable to various security threats. Motivated from the aforementioned challenges, we incorporate Digital Twin (DT) technology, Software-Defined Networking (SDN), Deep Learning (DL) and blockchain into the design of a novel SG network. Specifically, a secure communication channel is first designed using an authentication method based on blockchain technology that has the ability to withstand a number of well-known assaults. Second, a new DL architecture that includes a self-attention mechanism, a Bidirectional-Gated Recurrent Unit (Bi-GRU) model, fully connected layers, and a softmax classifier is designed to enhance the attack detection process in SG environments. To deliver low latency and real-time services, the SDN is next employed as the network’s backbone to send requests from SMs to a global SDN controller. DT technology is finally integrated into the SDN control plane, which stores the operating states and behavior models of SMs and communicates with SMs. The efficiency of the proposed framework is demonstrated by the blockchain implementation used in the SG network to assess computing time for the various numbers of transactions per block. Finally, the numerical results based on the N-BaIoT dataset shows better intrusion detection.

Analysis of Intrusion Detection Systems in UNSW-NB15 and NSL-KDD Datasets with Machine Learning Algorithms

Recently, the need for Network-based systems and smart devices has been increasing rapidly. The use of smart devices in almost every field, the provision of services by private and public institutions over network servers, cloud technologies and database systems are almost completely remotely controlled. Due to these increasing requirements for network systems, malicious software and users, unfortunately, are increasing their interest in these areas. Some organizations are exposed to almost hundreds or even thousands of network attacks daily. Therefore, it is not enough to solve the attacks with a virus program or a firewall. Detection and correct analysis of network attacks is vital for the operation of the entire system. With deep learning and machine learning, attack detection and classification can be done successfully. In this study, a comprehensive attack detection process was performed on UNSW-NB15 and NSL-KDD datasets with existing machine learning algorithms. In the UNSW-NB115 dataset, 98.6% and 98.3% accuracy were obtained for two-class and multi-class, respectively, and 97.8% and 93.4% accuracy in the NSL-KDD dataset. The results prove that machine learning algorithms are lateral to the solution in intrusion detection systems.

Pelican Optimization Algorithm with Federated Learning Driven Attack Detection model in Internet of Things environment

The Internet of Things (IoT) is comprised of millions of physical devices interconnected with the Internet through network that performs a task independently with less human interference. Despite the benefits of IoT, it is vulnerable to malicious attacks. Therefore, machine learning (ML) inspired decision-making is hardly preferred due to drawbacks (the requirement that every training dataset is stored on the central database), computation cost related to the training of massive amounts of information on the unified server, and security issues related to transferring attained statistics from IoT sensor to the server. The Federated Learning (FL) algorithm is the adaptable and most prominent way to resolve the shortcoming of ML-based techniques. The study proposes a Pelican Optimization Algorithm with Federated Learning Driven Attack Detection and classification (POAFL-DDC) technique in the IoT. The POAFL-DDC technique operates on decentralized on-device data for attack detection in the IoT. By substituting update weight with the central FL server, the data is placed on the local IoT device whereas federating training cycles on the DL model. For attack detection process, deep belief network (DBN) model is used in this work. In this study, the POA is utilized to optimize the DBN hyperparameters. The experimental validation of the POAFL-DDC algorithm is tested on TON_IOT dataset and the results are examined in terms of different measures. The experimental outcomes demonstrated that the POAFL-DDC technique reaches superior results over other models.

Enhanced Cyber Attack Detection Process for Internet of Health Things (IoHT) Devices Using Deep Neural Network

Internet of Health Things plays a vital role in day-to-day life by providing electronic healthcare services and has the capacity to increase the quality of patient care. Internet of Health Things (IoHT) devices and applications have been growing rapidly in recent years, becoming extensively vulnerable to cyber-attacks since the devices are small and heterogeneous. In addition, it is doubly significant when IoHT involves devices used in healthcare domain. Consequently, it is essential to develop a resilient cyber-attack detection system in the Internet of Health Things environment for mitigating the security risks and preventing Internet of Health Things devices from becoming exposed to cyber-attacks. Artificial intelligence plays a primary role in anomaly detection. In this paper, a deep neural network-based cyber-attack detection system is built by employing artificial intelligence on latest ECU-IoHT dataset to uncover cyber-attacks in Internet of Health Things environment. The proposed deep neural network system achieves average higher performance accuracy of 99.85%, an average area under receiver operator characteristic curve 0.99 and the false positive rate is 0.01. It is evident from the experimental result that the proposed system attains higher detection rate than the existing methods.

Optimized deep neural network based DDoS attack detection and bait mitigation process in software defined network

SummaryThe software‐defined network (SDN) is a new network design with an operating system that allows better network quality control. The controller's primary role in an SDN network is to divide the control and forwarding planes in order to provide essential network power. The backup controller in an SDN may confront a variety of obstacles during a DDoS attack. It disrupts the flow of the network by attacking the service nodes hence obstructing the legitimate users from getting service. To overcome these issues, this work introduces a DDoS attack detection model that will aid in removing the attacker from the network. Initially, the input data is sent into the detection phase, which identifies the existence and kind of attacks. The presence of an attack is determined based on the data flow, and statistical features. With the reference of the extracted features, the optimized deep neural network (DNN) will decide the existence of attacker in the network. To make the decision more precise, the training of DNN will be carried out by self‐improved moth flame optimization (SIMFO) Algorithm via tuning the optimal weights. Once an attacker's presence has been identified, it is critical to remove the attacker's node from the network.

A new feature popularity framework for detecting cyberattacks using popular features

We propose a novel feature popularity framework, and introduce this new framework to the cybersecurity domain. Feature popularity has not yet been used in machine learning or data mining, and we implement it with three web attacks from the CSE-CIC-IDS2018 dataset: Brute Force, SQL Injection, and XSS web attacks. Feature popularity is based upon ensemble Feature Selection Techniques (FSTs) and allows us to more easily understand common and important features between different cyberattacks. Three filter-based and four supervised learning-based FSTs are used to generate feature subsets for each of our three different web attack datasets, and then our feature popularity frameworks are applied. Classification performance for feature popularity is mostly similar as compared to when “all features” are evaluated (with feature popularity subsets having better performance in 5 out of 15 experiments). Our feature popularity technique effectively builds an ensemble of ensembles by first building an ensemble of FSTs for each dataset, and then building another ensemble across a dataset agreement dimension. The Jaccard similarity is also employed with our feature popularity framework in order to better identify which attack classes should (or should not) be grouped together when applying feature popularity. The four most popular features across all three web attacks from this experiment are: Flow_Bytes_s, Flow_IAT_Max, Fwd_IAT_Std, and Fwd_IAT_Total. When only using these four features as input to our models, classification performance is not seriously degraded. This feature popularity framework granted us new and previously unseen insights into the web attack detection process with CSE-CIC-IDS2018 big data, even though we had intensely studied it previously. We realized these four particular features cannot properly identify our three web attacks, as they operate mainly from the time dimension and NetFlow features from layers 3 and 4 of the OSI model. Conversely, our three web attacks operate in the application layer (7) of the OSI model and should not leave signatures in these four features. Feature popularity produces easier to explain models which provide domain experts better visibility into the problem, and can also reduce the complexity of implementing models in real-world systems.

FACVO-DNFN: Deep learning-based feature fusion and Distributed Denial of Service attack detection in cloud computing

Cloud computing offers a broad range of resource pools for conserving a huge quantity of information. Due to the intrusion of attackers, the information that exists in the cloud is threatened. Distributed Denial of Service (DDoS) attack is the main reason for attacks in the cloud. In this study, a Fractional Anti Corona Virus Optimization-based Deep Neuro-Fuzzy Network (FACVO-based DNFN) is devised for detecting DDoS in the cloud. The production of log files, feature fusion, data augmentation, and DDoS attack detection is the processing stages involved in this phase of the DDoS attack detection process. The feature fusion is carried out by RV coefficient and Deep Quantum Neural Network (Deep QNN), and the data augmentation is performed. Then, the Anti Corona Virus Optimization (ACVO) method and Fractional Calculus (FC) are both incorporated to create the FACVO algorithm. The DNFN is trained by the created FACVO algorithm, which identifies the DDoS attack. The proposed approach achieved testing accuracy, TPR, TNR, and precision values of 0.9304, 0.9088, 0.9293, and 0.8745 for using the NSL-KDD dataset without attack, and 0.9200, 0.8991, 0.9015, and 0.8648 for using the BoT-IoT dataset without attack.

Permissioned Blockchain and Deep Learning for Secure and Efficient Data Sharing in Industrial Healthcare Systems

The industrial healthcaresystem has enabled the possibility of realizing advanced real-time monitoring of patients and enriched the quality of medical services through data sharing among intelligent wearable devices and sensors. However, this connectivity brings the intrinsic vulnerabilities related to security and privacy due to the need of continuous communication and monitoring over public network (insecure channel). Motivated from the aforementioned discussions, we integrate permissioned blockchain and smart contract with deep learning (DL) techniques to design a novel secure and efficient data sharing framework named PBDL. Specifically, PBDL first has a blockchain scheme to register, verify (using zero-knowledge proof), and validate the communicating entities using the smart contract-based consensus mechanism. Second, the authenticated data are used to propose a novel DL scheme that combines stacked sparse variational autoencoder (SSVAE) with self-attention-based bidirectional long short term memory (SA-BiLSTM). In this scheme, SSVAE encodes or transforms the healthcare data into new format, and SA-BiLSTM identifies and improves the attack detection process. The security analysis and experimental results using IoT-Botnet and ToN-IoT datasets confirm the superiority of the PBDL framework over existing state-of-the-art techniques.

A Deep Fusion Model For Automated Industrial Iot Cyber Attack Detection And Mitigation

Industrial Internet of Things (IIoT) is a new field of study that connects digital devices and services to physical systems. The IIoT has been utilized to create massive amounts of data from various sensors, and it has run into several problems. The IIoT has been subjected to a variety of hacks, putting its ability to provide enterprises with flawless operations in jeopardy. Businesses suffer financial and reputational losses as a result of such threats, as well as the theft of critical data. As a result, numerous Network Intrusion Detection Systems (NIDSs) have been created to combat and safeguard IIoT systems, but gathering data that can be utilized in the construction of an intelligent NIDS is a tough operation; consequently, identifying current and new assaults poses major issues. In this research work, a novel IIOT attack detection framework and mitigation model is designed by following four major phases “(a) pre-processing, (b) feature extraction, (c) feature selection and (d) attack detection”. Initially, the collected raw data (input) is subjected to pre-processing phase, wherein the data cleaning and data standardization operations take place. Subsequently, the features like “higher-order statistical features (Skewness, Kurtosis, Variance and Moments), technical indicator based features, mutual information, Improved Principal Component Analysis (IPCA)” based features are extracted from the pre-processed data. Further, from the extracted features, the most optimal features are selected using a new hybrid optimization model referred as Hunger Customized Individual Activity Model (HCIA) that hybrids the concepts of standard (Teamwork Optimization Algorithm (TOA) and Hunger Games Search (HGS)). The attack detection is carried out using the projected deep fusion model framework that encapsulates the Bi-GRU and Quantum Deep Neural Network (QDNN), respectively. The Bi-GRU and QDNN in the deep fusion model framework is trained with the optimal features selected using a new hybrid optimization model. The outcome acquired from Bi-GRU and QDNN is combined, and it will be the final detected outcome that portrays the presence/ absence of attacks in IIoT network. When an attack is being identified, the mitigation of such attack takes place via the Improved BIAT Framework. Further, the projected model is evaluated over the existing models to show its supremacy in the attack detection and mitigation process.

An approach for DoS attack detection in cloud computing using sine cosine anti coronavirus optimized deep maxout network

PurposeThe Denial of Service (DoS) attack is a category of intrusion that devours various services and resources of the organization by the dispersal of unusable traffic, so that reliable users are not capable of getting benefit from the services. In general, the DoS attackers preserve their independence by collaborating several victim machines and following authentic network traffic, which makes it more complex to detect the attack. Thus, these issues and demerits faced by existing DoS attack recognition schemes in cloud are specified as a major challenge to inventing a new attack recognition method.Design/methodology/approachThis paper aims to detect DoS attack detection scheme, termed as sine cosine anti coronavirus optimization (SCACVO)-driven deep maxout network (DMN). The recorded log file is considered in this method for the attack detection process. Significant features are chosen based on Pearson correlation in the feature selection phase. The over sampling scheme is applied in the data augmentation phase, and then the attack detection is done using DMN. The DMN is trained by the SCACVO algorithm, which is formed by combining sine cosine optimization and anti-corona virus optimization techniques.FindingsThe SCACVO-based DMN offers maximum testing accuracy, true positive rate and true negative rate of 0.9412, 0.9541 and 0.9178, respectively.Originality/valueThe DoS attack detection using the proposed model is accurate and improves the effectiveness of the detection.

Semi-supervised approach for detecting distributed denial of service in SD-honeypot network environment

Distributed Denial of Service (DDoS) attacks is the most common type of cyber-attack. Therefore, an appropriate mechanism is needed to overcome those problems. This paper proposed an integration method between the honeypot sensor and software defined network (SDN) (SD-honeypot network). In terms of the attack detection process, the honeypot server utilized the Semi-supervised learning method in the attack classification process by combining the Pseudo-labelling model (support vector machine (SVM) algorithm) and the subsequent classification with the Adaptive Boosting method. The dataset used in this paper is monitoring data taken by the Suricata sensor. The research experiment was conducted by examining several variables, namely the accuracy, precision, and recall pointed at 99%, 66%, and 66%, respectively. The central processing unit (CPU) usage during classification was relatively small, which was around 14%. The average time of flow rule mitigation installation was 40s. In addition, the packet/prediction loss occurred during the attack, which caused several packets in the attack not to be classified was pointed at 43%.

An Optimisation driven Deep Residual Network for Sybil attack detection with reputation and trust-based misbehaviour detection in VANET

ABSTRACT Vehicular Ad hoc Network (VANET) has recently gained significant attention as a means of enhancing the mobility, efficiency, and safety of applications in the intelligent transportation system. However, because of its high-speed mobility, wireless connectivity, and extensive node coverage, security is a more difficult procedure. The Sybil security threat on VANET is a growing problem today. The Road Side Unit (RSU) failed to synchronise its clock with the legal vehicle, then unplanned vehicles are predicted, thereby incorrect messages are transferred to them. In this paper, Competitive Dolphin Echolocation Optimisation (CDEO)-based Deep Residual Network is proposed for Sybil attack and RSU misbehaviour detection. Here, the effective routing process is performed using Fractional Glow-Worm Swarm Optimisation (FGWSO)-based traffic-aware routing protocol. In the base station, the Sybil attack detection is done. The Sybil attack detection process is done using a Deep residual network, which is trained by the proposed CDEO algorithm. The CDEO algorithm is devised by incorporating Dolphin Echolocation Optimisation (DEO) technique and Competitive Swarm Optimiser (CSO). Additionally, using the Deep residual network, the RSU misbehaviour detection is done. The performance of the developed method is compared with certain performance metrics, like precision, F1-measure, and recall of 0.9197, 0.9121, and 0.9046.

Convolutional Neural Network-Based Automatic Diagnostic System for AL-DDoS Attacks Detection

Distributed denial of service (DDoS) attacks are one of the main threats to information security. The purpose of DDoS attacks at the network (IP) and transport (TCP) layers is to consume the network bandwidth and deny service to legitimate users of the target system. Application layer DDoS attacks (AL-DDoS) can be organized against many different applications. Many of these attacks target HTTP, in which case their goal is to deplete the resources of web services. Various schemes have been proposed to detect DDoS attacks on network and transport layers. There are very few works being done to detect AL-DDoS attacks. The development of an intelligent system automatically detecting AL-DDoS attacks in advance is very necessary. In this paper to detect AL-DDoS attacks a deep learning model based on the Convolutional Neural Network is proposed. To simulate the AL-DDoS attack detection process, while in testing of the model on CSE-CIC-IDS2018 DDoS and CSIC 2010 datasets, 0.9974 and 0.9059 accuracy values were obtained, respectively.

Bat-Inspired Optimization for Intrusion Detection Using an Ensemble Forecasting Method

An Intrusion detection system (IDS) is extensively used to identify cyber-attacks preferably in real-time and to achieve integrity, confidentiality, and availability of sensitive information. In this work, we develop a novel IDS using machine learning techniques to increase the performance of the attack detection process. In order to cope with high dimensional feature-rich traffic in large networks, we introduce a Bat-Inspired Optimization and Correlation-based Feature Selection (BIOCFS) algorithm and an ensemble classification approach. The BIOCFS is introduced to estimate the correlation of the identified features and to choose the ideal subset for training and testing phases. The Ensemble Classifier (EC) is used to integrate decisions from three different classifiers including Forest by Penalizing Attributes (FPA), Random Forest (RF), and C4.5 based on the rule of average probabilities. The integration of BIOCFS and EC approaches aids to handle multi-class and unbalanced datasets. The performance of the proposed algorithm is evaluated on a well-known dataset NSL-KDD. The experimental results prove that our combined BIOCFS-EC outdoes other relevant methods in the context of appropriate performance measures. More importantly, the proposed IDS decreases the time complexity of training and testing procedure from 39.43 and 2.25 s to 16.66 and 1.28 s, respectively. Also, the proposed approach achieves the maximum classification accuracy of 0.994, precision of 0.993, F-measure of 0.992, the attack detection ratio of 0.992 and the minimum false alarm ratio of 0.008% on the given dataset.