Attack Detection System Research Articles

Deep learning techniques for biometric security: A systematic review of presentation attack detection systems

Biometric technology, including finger vein, fingerprint, iris, and face recognition, is widely used to enhance security in various devices. In the past decade, significant progress has been made in improving biometric systems, thanks to advancements in deep convolutional neural networks (DCNN) and computer vision (CV), along with large-scale training datasets. However, these systems have become targets of various attacks, with presentation attacks (PAs) being prevalent and easily executed. PAs involve displaying videos, images, or full-face masks to trick biometric systems and gain unauthorized access. Many authors are currently focusing on detecting these presentation attacks (PAD) and have developed several methods, particularly those based on deep learning (DL), which have shown superior performance compared to other techniques. This survey article focuses on manuscripts related to deep learning presentation attack detection, spoof attack detection using deep learning, and anti-spoofing deep learning methods for biometric finger vein, fingerprint, iris, and face recognition. The studies were primarily sourced from four digital research libraries: ACM, Science Direct, Springer, and IEEE Xplore. The article presents a comprehensive review of DL-based PAD systems, examining recent literature on DL-based PAD methods in finger vein, fingerprint, iris, and face detection systems. Through extensive research of the literature, recent algorithms and their solutions for relevant PAD approaches are thoroughly analyzed. Additionally, the article provides a performance analysis and highlights the most promising research findings. The discussion section addresses current issues, opportunities for advancement, and potential solutions associated with deep learning-based PAD methods. This study is valuable to various community users seeking to understand the significance of this technology and its recent applicability in the development of biometric technology for deep learning.

Clustering based Intrusion Detection System for effective Detection of known and Zero-day Attacks

Developing effective security measures is the most challenging task now a days and hence calls for the development of intelligent intrusion detection systems. Most of the existing intrusion detection systems perform best at detecting known attacks but fail to detect zero-day attacks due to the lack of labeled examples. Authors in this paper, comes with a clustering-based IDS framework that can effectively detect both known and zero-day attacks by following unsupervised machine learning techniques. This research uses NSL-KDD dataset for the motive of experimentation and the experimental results exhibit best performance with an accuracy of 78%.

XSS Attack Detection using Machine Learning Algorithms

This project focuses on the development of an XSS attack detection system using machine learning algorithms. The research involves the careful curation of diverse datasets encompassing XSS attacks and benign data. Key features are extracted, emphasizing HTML structure and JavaScript patterns. The study evaluates the efficacy of k- Nearest Neighbors, Logistic Regression, Random Forest, and Support Vector Machines (SVM) in detecting XSS threats. The training phase optimizes model accuracy, and performance metrics such as Precision, Recall, and F1 Score assess the model's effectiveness. Results provide a comparative analysis of machine learning algorithms, offering insights for future implementations. The study contributes to strengthening web security, showcasing the potential of machine learning in XSS attack detection.

Sliding principal component and dynamic reward reinforcement learning based IIoT attack detection

The Internet of Things (IoT) involves the gathering of all those devices that connect to the Internet with the purpose of collecting and sharing data. The application of IoT in the different sectors, including health, industry has also picked up the threads to augment over the past few years. The IoT and, by integrity, the IIoT, are found to be highly susceptible to different types of threats and attacks owing to the networks nature that in turn leads to even poor outcomes (i.e., increasing error rate). Hence, it is critical to design attack detection systems that can provide the security of IIoT networks. To overcome this research work of IIoT attack detection in large amount of evolutions is failed to determine the certain attacks resulting in a minimum detection performance, reinforcement learning-based attack detection method called sliding principal component and dynamic reward reinforcement learning (SPC–DRRL) for detecting various IIoT network attacks is introduced. In the first stage of this research methodology, preprocessing of raw TON_IoT dataset is performed by employing min–max normalization scaling function to obtain normalized values with same scale. Next, with the processed sample data as output, to extract data from multi-sources (i.e., different service profiles from the dataset), a robust log likelihood sliding principal component-based feature extraction algorithm is applied with an arbitrary size sliding window to extract computationally-efficient features. Finally, dynamic reward reinforcement learning-based IIoT attack detection model is presented to control the error rate involved in the design. Here, with the design of dynamic reward function and introducing incident repository that not only generates the reward function in an arbitrary fashion but also stores the action results in the incident repository for the next training, therefore reducing the attack detection error rate. Moreover, an IIoT attack detection system based on SPC–DRRL is constructed. Finally, we verify the algorithm on the ToN_IoT dataset of University of New South Wales Australia. The experimental results show that the IIoT attack detection time and overhead along with the error rate are reduced considerably with higher accuracy than that of traditional reinforcement learning methods.

Detection of SSH Password Guessing Attacks using Classification Algorithms

The usage of SSH protocol has gained popularity among users due to its secure nature in recent times. Nevertheless, the SSH protocol can be susceptible to exploitation by hackers, who can access SSH servers without permission by exploiting vulnerabilities. SSH attacks cannot be completely detected using state-of-the-art security solutions like Firewall, Intrusion Detec- tion Systems, and so on. Malicious SSH traffic is created by malware and contains password guessing attacks. These attacks can result in compromising the security of servers and lead to the theft of private data. We aim to develop a robust and accurate SSH attack detection system that uses classification algorithms that can effectively differentiate between malicious SSH traffic and legitimate SSH traffic. In this paper, we have selected 14 classification algorithms like CNN, LSTM, Logistic regression, Deep Belief Networks, Auto Encoders, and so on. The process involves organising and preparing the data, extracting relevant features, and application of an ensemble learning approach with the selected classification algorithms. XGBoost is employed for model integration. The ensemble model achieves improved accuracy, successfully classifying between legitimate SSH traffic and SSH password guessing attacks.

Flow and unified information-based DDoS attack detection system for multi-topology IoT networks

Internet of Things (IoT) networks are vulnerable to Distributed Denial of Service (DDoS) attacks, which can degrade their Quality of Service (QoS). In general, DDoS attacks are classified into high- and low-volume attacks. Existing statistical-based methods for DDoS attack detection in IoT networks are effective only for high-volume or low-volume attacks, but not for both. The majority of research in this domain relies on single-dimensional analysis and static thresholds. In response to these limitations, this paper introduces a Flow and Unified Information-based DDoS (FLUID) attack detection system, a lightweight statistical approach, for DDoS attack detection in IoT networks. The FLUID system incorporates multi-dimensional analysis by integrating unified information and flow behavior to effectively identify both high- and low-volume DDoS attacks. FLUID utilizes entropy and distance metrics, such as Kullback–Leibler (KL) divergence and greedy bin-packing, as unified information measures to distinguish legitimate traffic from malicious activity. Additionally, it examines flow behavior to gain insights into network traffic patterns. Notably, the FLUID system maintains its lightweight nature through a streamlined set of network features and optimized computational efficiency. Evaluations on real-world IoT client/server and Event-Driven Architecture (EDA) testbeds with the ToN-IoT, CICIDS 2017, CICIDS 2019, and DoS/DDoS-MQTT-IoT datasets show that the FLUID system can achieve over 90% detection accuracy for both high- and low-volume DDoS attacks.

Fuzzy EKF-Based Intrusion Detection and Accurate State Estimation of Interconnected DC MGs With CPLs

With the advancement of digital technologies in complex and large-scale power systems, the issue of cyber-attack detection has become of paramount importance to maintain system reliability and performance. In this regard, accurate state estimation plays a key role and leads to proper supervisory decision-making. To detect cyber-attacks in direct current microgrids (DC MGs), a new centralized attack detection system based on the Kalman filter and clustering approach is proposed. On the other hand, appearing nonlinear loads such as constant power loads (CPLs) make the overall system behavior nonlinear and conventional linear Kalman filters ineffective. So, in this paper, an extended Kalman filter (EKF) is utilized. By constructing several output vectors and parallel EKFs, local state estimations are achieved. They are then used to detect attacks based on the residuals and localize them based on the fuzzy clustering approach. The local healthy estimations are aggregated to compute global estimations with low noise. The simulation results on a five-area interconnected DC MG subjected to data integrity and denial-of-service (DoS) attacks show that the proposed approach can detect attacks, evaluate how many attacks occur in the case of multiple attacks, localize the attacks, and obtain accurate state estimations.

Detection of DoS Attacks in Smart City Networks With Feature Distance Maps: A Statistical Approach

Smart cities are highly digitalized cities, with a high volume of data stored digitally, as well as a large number of physical objects and Internet of Things (IoT) devices. It is no surprise that security concerns increase as connected IoT devices become more prevalent. There has long been a perception that Denial of Service (DoS) attacks give rise to a notable menace to the security of smart city networks. A statistical method based on feature distance maps is suggested in this work for the identification of DoS attacks in smart city networks. This study aims to build a DoS attack detection model that has a low computational complexity and a low rate of false positives. The performance of the model is arbitrated using smart city network traffic dataset. In order to make processing easier, the features are normalized using Min-Max normalization. A subset of features suitable for attack detection can be evaluated with Pearson Correlation Coefficient. A feature distance map method is proposed for extracting correlations between features between records. Manhattan distance measures are used to generate the feature distance maps. The feature distance maps enhance the statistical analysis process. Hellinger distance measure is used to generate the normal traffic profile by calculating the degree of similarity between the feature distance map of each record and the normal traffic profile mean. On the basis of the proposed threshold, the Hellinger distance is used to evaluate whether an unknown traffic data belongs to normal or attack. Compared with Mahalanobis distance-based DoS detection, the Hellinger distance-based attack detection takes less time to execute. Based on the theoretical and experimental results, the proposed DoS attack detection system has a low computational complexity and a low false positive rate. Furthermore, the proposed approach outperforms the existing state-of-the-art feature ranking based DoS attack detection systems.

Enhancing DDoS Attack Detection in SDNs with GAN-Based Imbalanced Data Augmentation

Securing computer networks has become crucial due to the ongoing emergence of diverse network attacks. The popularity of Software Defined Networks (SDN) has risen because of its ability to enhance network agility, efficiency, and adaptability to recent networking challenges. However, it is essential to note that SDNs, which depend on centralized controllers, can be severely affected by Distributed Denial of Service (DDoS) attacks. The threat of DDoS attacks has grown exponentially, resulting in the evolution of robust Machine Learning-based DDoS attack detection systems within SDN. DDoS attack detection systems may deliver poor performance when trained on imbalanced datasets. Traditional techniques for handling imbalanced datasets need to be revised. Recent advances in generative adversarial networks (GANs) have revealed significant potential in generating synthetic data while preserving the probability distribution of the original data. This innovative procedure offers a promising solution to mitigate the challenges of imbalanced data in DDoS attack detection. To address challenges originating from imbalanced training datasets, we employed Generative Adversarial models to generate adversarial attacks from one viewpoint and evaluate their quality from another perspective. We chose Generative Adversarial Networks (GANs), Bidirectional GANs (Bi-GANs), and Wasserstein GANs (WGANs) based on extensive usage and reliability criteria in various domains. We conducted a comprehensive assessment to evaluate their effectiveness and resilience in generating high-quality attacks. It helps to develop, train, and fine-tune machine and deep learning models to estimate their impacts. We utilized NSL-KDD and CICIDS-2017 datasets to ensure generalization, implementing both ML and DL approaches. The outcomes demonstrate that the WGAN model outperformed GAN, Bi-GAN, and the models trained on the original imbalanced dataset and traditional sampling techniques in binary and multiclass classifications for both datasets.

Optimized deep learning-based intrusion detection framework for vehicular network

The Internet’s evolution resulted in a massive amount of data. As a result, the internet has become more sophisticated and vulnerable to massive attacks. The attack detection system is a key feature for system security in modern networks. The IDS might be signature-based or detect anomalous behavior. Researchers recently created several detection algorithms for identifying network intrusions in vehicular network security, but they failed to detect intrusions effectively. For this reason, the optimal Deep Learning approach, namely Political Fractional Dingo Optimizer (PFDOX)-based Deep belief network is introduced for attack detection in network security for vehicles. The Internet of Vehicle simulation is done initially, and then the input data is passed into the pre-processing phase, which removes noise present in the data. Then, the feature extraction module receives the pre-processed data. The Deep Maxout Network is trained using the Fractional Dingo optimizer (FDOX)is utilized to detect normal and abnormal behavior. Fractional calculus and Dingo optimizer (DOX) are combined to create the proposed FDOX. Finally, intruder/attack types are classified using the Deep Belief Network, which is tuned using the PFDOX. The PFDOX is created by the assimilation of the DOX, Fractional Calculus, and Political Optimizer (PO). The experimental result shows that the designed PFDOX_DBN for attack type classification offers a better result based on f-measure, precision, and recall with the values of 0.924, 0.916, and 0.932, for the CIC-IDS2017 dataset.

Security and risk analysis in the cloud with software defined networking architecture

Cloud computing has emerged as the actual trend in business information technology service models, since it provides processing that is both cost-effective and scalable. Enterprise networks are adopting software-defined networking (SDN) for network management flexibility and lower operating costs. Information technology (IT) services for enterprises tend to use both technologies. Yet, the effects of cloud computing and software defined networking on business network security are unclear. This study addresses this crucial issue. In a business network that uses both technologies, we start by looking at security, namely distributed denial-of-service (DDoS) attack defensive methods. SDN technology may help organizations protect against DDoS assaults provided the defensive architecture is structured appropriately. To mitigate DDoS attacks, we offer a highly configurable network monitoring and flexible control framework. We present a dataset shift-resistant graphic model-based attack detection system for the new architecture. The simulation findings demonstrate that our architecture can efficiently meet the security concerns of the new network paradigm and that our attack detection system can report numerous threats using real-world network data.

A two-stage cyber attack detection and classification system for smart grids

As the adoption of Internet of Things (IoT) devices increases rapidly, industrial applications of IoT devices gain further popularity. Some of these applications, such as smart grids, are considered high-risk applications. In the past few years, smart grids became the target of many cyber attacks. In this paper, we present a two-stage system for the detection and classification of cyber attacks based on machine learning. The first stage of the proposed system focuses on detecting attacks efficiently and accurately. The second stage analyzes available data and predicts the specific attack class. The proposed system was tested using the DNP3 intrusion detection dataset, and delivered an F1 score of 0.9976 at the detection stage, and 0.9883 at the attack type classification stage.

Device discovery and identification in industrial networks

Abstract The Act on Federal Office for Information Security (BSI Act) explicitly mandates the use of attack detection systems. The BSI works together with operators of process plants as well as discrete manufacturing facilities in order to test sensors, which may be part of such systems, in their networks. This gives the BSI the opportunity to record a collection of network traffic from those plants. One goal is to improve the detection and characterization of devices in industrial networks by implementing new or enhanced features for the open source network monitoring tool suite Malcolm. In this context, the recording of the network traffic represents the starting point for further investigations. This paper highlights what needs to be considered in these recordings to serve as a basis for device identification and characterization.

Congnitive Networks, Their Properties and Applications in Attack Detection and Prevention Systems

Congnitive Networks, Their Properties and Applications in Attack Detection and Prevention Systems

DNN controlled adaptive front-end for replay attack detection systems

Developing robust countermeasures to protect automatic speaker verification systems against replay spoofing attacks is a well-recognized challenge. Current approaches to spoofing detection are generally based on a fixed front-end, typically a time-invariant filter bank, followed by a machine learning back-end. In this paper, we propose a novel approach whereby the front-end comprises an adaptive filter bank with a deep neural network-based controller, which is jointly trained along with a neural network back-end. Specifically, the deep neural network-based adaptive filter controller tunes the selectivity and sensitivity of the front-end filter bank at every frame to capture replay-related artefacts. We demonstrate the effectiveness of the proposed framework in spoofing attack detection on a synthesized dataset and ASVSpoof 2019 and ASVSpoof 2021 challenge datasets in terms of equal error rate and its ability to capture artefacts that differentiate replayed signals from genuine ones in comparison to conventional non-adaptive front-ends.

WCGAN-GP based synthetic attack data generation with GA based feature selection for IDS

Cyber-attack is one of the alarming issues in today's era. Firewalls, Intrusion Detection Systems (IDSs), and other techniques are popularly applied to prevent those attacks. Intrusion Detection System (IDS) works as the watchdog to monitor the network traffic and identify an alert when an unauthorized action is detected. However, most IDSs are designed on traditional datasets, which do not address the data imbalance problem. As a result, their performance is not good enough against minority class samples. In order to overcome the aforementioned problem and detect cyber-attacks with higher precision, this paper proposes a novel IDS applying Wasserstein Conditional Generative Adversarial Network – Gradient Penalty (WCGAN-GP) and Genetic Algorithm (GA). The objective of the two components- WCGAN-GP and Genetic Algorithm are introduced in the proposed work for synthetic data generation, feature optimization, and attack detection system. The proposed model generates synthetic samples that follow the underlying data distribution of actual data. This paper uses a novel fitness function for the convergence of the Genetic algorithm and produces an optimal feature vector for the classification problem. In this work, an extensive experimental study applying NSL-KDD and UNSW-NB15 datasets in combination with generated samples and reduced feature set from the proposed model is carried out to evaluate the performance of different machine learning models. Observations show that Xgboost gives the best performances among others. To justify using a genetic algorithm for feature optimization, this paper has compared the proposed model with other traditional feature selection approaches such as PCA, Autoencoder, and T-SNE on the proposed model. It is found that the proposed GA-based feature selection outperforms others. The reason behind it is that the GA-based feature selection technique offers certain advantages over PCA and Autoencoder-based dimensionality reduction techniques, such as the ability to handle non-linearity between features in the data, enhanced flexibility in feature selection, interpretability, and human insight, handling high-dimensional data, robustness to noise and outliers. It also offers an advantage over T-SNE, a nonlinear dimensionality reduction technique in terms of computational efficiency. Furthermore, the model is also compared with other state-of-the-art which address data imbalance problems. Our proposed model with Xgboost classifier gives better results than other existing approaches in terms of accuracy (95.54%), precision (92.61%), recall (95.54%), F1-score (93.41%), and false alarm rate (4.30%) on the NSL-KDD dataset and accuracy (89.58%), precision (89.46%), recall (89.58%), F1-score (88.89%) and false alarm rate (1.18%) on the UNSW-NB15 dataset.

Replay attack detection based on deformable convolutional neural network and temporal-frequency attention model

Abstract As an important identity authentication method, speaker verification (SV) has been widely used in many domains, e.g., mobile financials. At the same time, the existing SV systems are insecure under replay spoofing attacks. Toward a more secure and stable SV system, this article proposes a replay attack detection system based on deformable convolutional neural networks (DCNNs) and a time–frequency double-channel attention model. In DCNN, the positions of elements in the convolutional kernel are not fixed. Instead, they are modified by some trainable variable to help the model extract more useful local information from input spectrograms. Meanwhile, a time–frequency domino double-channel attention model is adopted to extract more effective distinctive features to collect valuable information for distinguishing genuine and replay speeches. Experimental results on ASVspoof 2019 dataset show that the proposed model can detect replay attacks accurately.

A Content Poisoning Attack Detection and Prevention System in Vehicular Named Data Networking

Named data networking (NDN) is gaining momentum in vehicular ad hoc networks (VANETs) thanks to its robust network architecture. However, vehicular NDN (VNDN) faces numerous challenges, including security, privacy, routing, and caching. Specifically, the attackers can jeopardize vehicles’ cache memory with a Content Poisoning Attack (CPA). The CPA is the most difficult to identify because the attacker disseminates malicious content with a valid name. In addition, NDN employs request–response-based content dissemination, which is inefficient in supporting push-based content forwarding in VANET. Meanwhile, VNDN lacks a secure reputation management system. To this end, our contribution is three-fold. We initially propose a threshold-based content caching mechanism for CPA detection and prevention. This mechanism allows or rejects host vehicles to serve content based on their reputation. Secondly, we incorporate a blockchain system that ensures the privacy of every vehicle at roadside units (RSUs). Finally, we extend the scope of NDN from pull-based content retrieval to push-based content dissemination. The experimental evaluation results reveal that our proposed CPA detection mechanism achieves a 100% accuracy in identifying and preventing attackers. The attacker vehicles achieved a 0% cache hit ratio in our proposed mechanism. On the other hand, our blockchain results identified tempered blocks with 100% accuracy and prevented them from storing in the blockchain network. Thus, our proposed solution can identify and prevent CPA with 100% accuracy and effectively filters out tempered blocks. Our proposed research contribution enables the vehicles to store and serve trusted content in VNDN.

A new method for the detection and identification of the replay attack on cars using SDR technology and classification algorithms

ContextCurrently, a wide variety of cars use Remote Keyless Entry (RKE) to activate the security system by radio frequency. ProblemRKE systems have security vulnerabilities with attacks such as brute force, replay, spoofing, and replay. ObjectiveThis study proposes a replay-type attack detection system using SDR and intelligent algorithms. MethodThe present dataset was obtained from an RKES type Key-fob of a 2016 model vehicle taken with different antenna polarizations at different distances. There were used three test and configuration systems based on two neural network identification models. ResultsThe proposed designs with the different classification models were able to detect replay-type vulnerabilities. In the first system, retransmitted indicators were detected with a maximum identification percentage of 90.9% and original signs of 90.9%; for the second system, 100% of the retransmitted signals and 89% of the original ones were detected, and for the third system, detected 100% of the retransmitted signals and 89.09% of the first signs. ConclusionThe models used in the system's design showed an identification percentage of more than 87% in all cases, managing to detect and identify the replay-type attack on the vehicles. System 1 presented better results with the VGG 16 system than in system 2, within the VGG 16 and SVM models having identical identification percentages obtained and, in system 3, which has the characteristics of the previous two, attained better results with SVM. The reception of signals with SDR is an effective tool for detecting vulnerabilities in vehicle security systems.

DDoS Attack Detection Using Enhanced Neural Network Algorithm in Software-Defined Networks

With the uncommon advancement of technology and networking, the world today is totally relying on it. The most obvious drawback of this technical progress resulted in several possible dangers. A Distributed Denial of Service (DDoS) attack is one in which a large number of compromised systems work together to prevent service from being provided to the targeted system. Consequently, to protect network servers, attack detection systems must be very effective. The proposed architecture has Software Defined Networks (SDN) which comprise controllers and SFlow agents. According to the article, the anomaly detection of statistical traffic, which is performed on both normal and pathological anomaly traces in the packet header, as well as traffic volume detection, is based on the suggested work provided in this study. The k-means clustering technique is used by the statistical anomaly detection system and the attack alert aggregation system. Low-level attack detection systems are used to generate cluster dissimilar warnings, which are then investigated further. Clusters generate meta-alerts based on the information they have gathered. After that, the report of meta-alerts is sent to the security specialists. The online alert aggregation technique, which is also known as the probabilistic model, is used to identify new assaults on a system. The k-means clustering method is used to improve the quality of the traffic data streams. The Enhanced Neural Network Algorithm (ENNA) is being used to advance the intelligent attack detection system, which is currently under development. It is utilized in open-day controllers to identify attacks with a 99.7% accuracy by using Mininet and the Python simulation tool (ODL). In future work, it is possible to evaluate how the suggested detection method would be used in the event of subnet attacks and its mitigation.