Attack Detection System Research Articles

The Web Attack Detection System for Internet of Things via Ensemble Classification

Internet of Things (IoT) networks contain millions of devices with the function of interacting with each other and providing useful things that were never available to us before. However, the diversity in types of IoT devices makes the IoT networks’ environments more complex and more vulnerable to various web attacks compared to traditional computer networks. We propose a novel machine learning based Web Attack Detection System (WADS) to alleviate the serious issues that IoT networks faces. Specifically, we have used two machine learning classifier to detect web attacks separately. We then use an MLP classifier to make the final decision according to the results obtained from the Dataset. In order to evaluate the proposed system, we have performed experiments on a public dataset as well as a real-word dataset running in a distributed environment. Experimental results show that the proposed system can detect web attacks accurately with low false positive and negative rates.

SDN Framework for Mitigating Time-Based Delay Attack

Due to recent cyberattacks on the Cyber-Physical Systems, the traditional security schemes face difficulties in dealing with such attacks as the attackers nowadays have adopted many intelligent mechanisms involving advanced information and communication technologies to launch attacks. This recent type of attack provides a significant impact on the resiliency of the software-defined networks. In this paper, we present a real-time delay attack on fault-resilient software-defined networks. The main objective of the time delay attack is to reduce the resiliency in the SDN-RM by adding a delay in the LLDP packets in the OpenFlow Switch. This addition of delay causes degradation in the network performance resulting in a low success rate in the SDN-RM mechanisms. In this paper, we present a machine learning-based detection system for detecting the attacks. The integration of machine learning techniques with network resilience solutions can effectively address the issue of predicting and classifying the LLDP packets that are delayed at a particular switch. Another issue is the detection of the malicious switch at the controller side which results in the improvement of the resiliency in SDN-RM. We propose a machine learning solution to detect the anomalies that are present in the topology and can be detected at the controller side. We use machine learning models such as k-nearest neighbors, support vector machines (SVM), Random Forest, and decision trees to detect the poisonous switches. The delay-based time attack detection system (DTA-DS) helps the controller to take a reactive decision to improve resilience by detecting poisonous network switches. With the help of the preventive approach, we achieve high-fault resiliency in fault resilient-based software-defined networks.

On improving the performance of DDoS attack detection system

A DDoS (Distributed Denial of Service) attack is a harmful way of preventing regular access to a targeted machine, resources, or any network by flooding the target or its neighbouring infrastructure with massive traffic in an attempt to cause an interruption. As a result, the network environment's security has suffered significantly. Although numerous ways have been proposed in previous studies, there is still room for new ones as attacker patterns, and strategies change rapidly. This work designs a quick and efficient detection model to identify the latest real-world attacks. An attempt was made for an effective data pre-processing that includes both memory optimization and hybrid feature selection to improve the model's generalizability. Furthermore, the extreme learning machine (ELM) classifier is analyzed with the extracted features by varying weight ranges, hidden neurons, and activation functions to classify the attacks. Experiments are conducted using the CICDDoS-2019 traffic data. The experimental outcomes indicate that the suggested model is superior to previous strategies, with a detection accuracy of 99.94%.

Deep Learning Based Phishing Websites Detection

Phishing is a crime that involves the theft of confidential user information. Those targeted by phishing websites include individuals, small businesses, cloud storage providers, and government organisations and websites. The majority of phishing prevention techniques involve hardware-based solutions, although software-based options are preferred due of cost and operational considerations. There is no answer to the problem of zero-day phishing assaults from the present phishing detection approaches since there is no solution to the problem. The Phishing Attack Detector based on Web Crawler, a three-phase attack detection system, was designed to handle these issues and accurately detect phishing incidences using a recurrent neural network in order to resolve these issues. It covers the input aspects of web traffic, web content, and Uniform Resource Locator (URL) based on the classification of phishing and non-phishing pages, as well as the output features of phishing and non-phishing pages.

Developing an Efficient Feature Engineering and Machine Learning Model for Detecting IoT-Botnet Cyber Attacks

Computers and networks have been under threat from viruses, worms and attacks from hackers since they were first used. In 2018, the number of devices connected to the Internet exceeded the number of human beings and this increasing trend will see about 80 billion devices by 2024. Securing these devices and the data passing between them is a challenging task because the number of IBAs is also increasing sharply year by year. To address this issue, a large number of defences against network attacks have been proposed in the literature. Despite all the efforts made by researchers in the community over the last two decades, the network security problem is not completely solved. In general, defence against network attacks consists of preparation, detection and reaction phases. The core element of a good defence system is an IOT Botnet Attack (IBA) Detection System (IBA-DS), which provides proper attack detection before any reaction. An IBA-DS aims to detect IBAs before they seriously damage the network. The term IBA refers to any unauthorised attempt to access the elements of a network with the aim of making the system unreliable.

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation

Purpose: Industrial Control Systems become more vulnerable to digital attacks by merging communication groups and the Internet of Things, which could have severe implications. An Intrusion Detection System is essential in IoT businesses for identifying and stopping assaults. To ensure data privacy and security in the face of digital attacks, legislation and large enterprises should develop network security policies today. As people-based full frameworks have become more vital in today's society, they've also become targets for hostile activities, compelling both industry and research to concentrate more on dealing with local area disruption recognition issues. Contraption reviewing techniques have shown to be effective tools for resolving in-network interruption location issues. Design/Methodology/Approach: This investigation yielded a very unique strategy for tackling hub moderation utilizing a Classification and Encryption method. The UNSW-NB15 dataset is acquired and divided into Data for preparation and testing from the start. The information is pre-handled and included are eliminated right away within the preparation time frame. The TWM Algorithm is then used to determine the relevant highlights from that moment onward. The BRELU-RESNET classifier then sorts the input into went after and non-went after categories. The compromised information is then saved in the security log record, and the typical data is encrypted using the ESHP-ECC computation. The shortest path distance is then calculated using Euclidean distance. Finally, the data is available. Finally, using the DSHP-ECC computation, the information is decrypted. If the information is available in the log document during testing, it is regarded as the sought-after data and is prevented from the transmission. If it is not present, then the process of digital assault recognition begins. Findings/Result: The research is based on the UNSW-NB 15 dataset, which shows that the proposed method achieves an unreasonable awareness level of 98.34 percent, particularity level of 77.54 percent, exactness level of 96.6 percent, Precision level of 97.96 percent, review level of 98.34 percent, F-proportion of 98.15 percent, False Positive Rate of 22.46 percent, False Negative Rate of 1.66 percent, and Matthew's connection coefficient of 77.38 Originality/Value: This experimental-based research article examines the malicious activities in the cyberspace using BRELU-RESNET approach and mitigated by using BAIT based approach mechanism. Paper Type: Research Analysis.

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation

A Novel Approach of BRELU RESNET Based Cyber Attack Detection System with BAIT Based Approach for Mitigation

Implementation Paper on Detection of Malicious URLs Using Machine Learning Techniques

Abstract: Detecting and preventing the user from the malicious site attacks are significant tasks. A huge number of attacks have been observed in last few years. Malicious attack detection and prevention system plays an immense role against these attacks by protecting the system’s critical information. The internet security software and fire walls are not enough to provide full protection to the system. Hence efficient detection systems are essential for web security. These existing methods have some drawbacks results into numbers of victims to increase. Hence we developed a system which helps the user to identify whether the website is malicious or not. Our system identifies whether the site is malicious or not through URL. Keywords: Malicious URLs, Classifier, Feature Extraction, ID3 Algorithm

Review on Phishing Attack Detection using Recurrent Neural Network

Phishing is a crime that involves the theft of personal information from users. Individuals, corporations, cloud storage, and government websites are all targets for the phishing websites. Anti-phishing technologies based on hardware are commonly utilised, while software-based options are preferred due to cost and operational considerations. Current phishing detection systems have no solution for problems like zero-day phishing assaults. To address these issues, a three-phase attack detection system called the Phishing Attack Detector based on Web Crawler was suggested, which uses a recurrent neural network to precisely detect phishing incidents. Based on the classification of phishing and non-phishing pages, it covers the input features Web traffic, web content, and Uniform Resource Locator (URL).

An Efficient Framework for Securing the Smart City Communication Networks.

Recently, smart cities have increasingly been experiencing an evolution to improve the lifestyle of citizens and society. These emerge from the innovation of information and communication technologies (ICT) which are able to create a new economic and social opportunities. However, there are several challenges regarding our security and expectation of privacy. People are already involved and interconnected by using smart phones and other appliances. In many cities, smart energy meters, smart devices, and security appliances have recently been standardized. Full connectivity between public venues, homes, cares, and some other social systems are on their way to be applied, which are known as Internet of Things. In this paper, we aim to enhance the performance of security in smart city communication networks by using a new framework and scheme that provide an authentication and high confidentiality of data. The smart city system can achieve mutual authentication and establish the shared session key schemes between smart meters and the control center in order to secure a two-way communication channel. In our extensive simulation, we investigated and evaluated the security performance of the smart city communication network with and without our proposed scheme in terms of throughput, latency, load, and traffic received packet per seconds. Furthermore, we implemented and applied a man-in-the-middle (MITM) attack and network intrusion detection system (NIDS) in our proposed technique to validate and measure the security requirements maintaining the constrained resources.

DDoS Attacks Detection in the IoT Using Deep Gaussian-Bernoulli Restricted Boltzmann Machine

Distributed denial of service (DDoS) attack is generally known as one of the most significant threats to the internet of things (IoT). Current detection technologies of DDoS attacks are not adequate for IoT systems because of the peculiar features of IoT such as resource constraint nodes, specific network architecture, and specific network protocols. Providing adequate DDoS attacks detection systems to IoT, however, becomes a necessity since IoT is ubiquitous. This study hence developed a deep learning-based model for detecting DDoS in IoT, while considering its peculiarities. The proposed deep learning-based model was formulated using a deep Gaussian-Bernoulli restricted Boltzmann machine (DBM) because of its capability to learn high-level features from input following the unsupervised approach and its ability to manage real-time data that is common in the IoT network. Furthermore, the SoftMax regression was used for classification. The accuracy of the proposed model on the network socket layer-knowledge discovery in databases was obtained as 93.52%. The outcome of the study shows that the proposed DBM can efficiently detect DDoS attacks in IoT.

Secure IoMT Pattern Recognition and Exploitation for Multimedia Information Processing using Private Blockchain and Fuzzy Logic

The Internet of Medical Things (IoMT) is a definite IoT connecting atmosphere that contracts with communication via intelligent medical equipment. Activity detection, motion tracking, information extraction, consumer retrieval, etc., have all been solved due to advances in the autonomous study of human behavior from multimedia information processing. Though the IoT connecting atmosphere enables and provisions our daily actions, it too has certain disadvantages. IoTgrieves from numerous safety and confidentiality challenges, such as reiteration, impersonation, man-in-the-middle, remote hijacking, privileged-insider attack, denial of service (DoS) attacks, password guessing, and malware bouts. Hence, in this paper, Private Blockchain and Fuzzy Logic based Attack Detection system (PBFL-ADS) has been proposed for secure IoMT disease prediction using Multimedia Information Processing techniques. The proposed method utilizes Bayesian inference-based trust administration to perceived malevolent nodes in Health Smartphone Structures (HSS) for PBFL-ADS. This paper focuses on the specific form of IoMT called HSS because smartphones have been widely used in the healthcare profession. Then, blockchains have been utilized to improve Bayesian trust management's efficacy in detecting hostile nodes in HSSs. The effectiveness of the suggested technique has been assessed, and test results show that blockchain technology helps identify fraudulent nodes with an acceptable workload. The proposed PBFL-ADS method increases the HS2 scenario 1.1, processor utilization at nodes 33.5%, pattern recognition ratio 92.1%.and server utilization 40.1%.

Adaptive Machine Learning Based Distributed Denial-of-Services Attacks Detection and Mitigation System for SDN-Enabled IoT.

The development of smart network infrastructure of the Internet of Things (IoT) faces the immense threat of sophisticated Distributed Denial-of-Services (DDoS) security attacks. The existing network security solutions of enterprise networks are significantly expensive and unscalable for IoT. The integration of recently developed Software Defined Networking (SDN) reduces a significant amount of computational overhead for IoT network devices and enables additional security measurements. At the prelude stage of SDN-enabled IoT network infrastructure, the sampling based security approach currently results in low accuracy and low DDoS attack detection. In this paper, we propose an Adaptive Machine Learning based SDN-enabled Distributed Denial-of-Services attacks Detection and Mitigation (AMLSDM) framework. The proposed AMLSDM framework develops an SDN-enabled security mechanism for IoT devices with the support of an adaptive machine learning classification model to achieve the successful detection and mitigation of DDoS attacks. The proposed framework utilizes machine learning algorithms in an adaptive multilayered feed-forwarding scheme to successfully detect the DDoS attacks by examining the static features of the inspected network traffic. In the proposed adaptive multilayered feed-forwarding framework, the first layer utilizes Support Vector Machine (SVM), Naive Bayes (NB), Random Forest (RF), k-Nearest Neighbor (kNN), and Logistic Regression (LR) classifiers to build a model for detecting DDoS attacks from the training and testing environment-specific datasets. The output of the first layer passes to an Ensemble Voting (EV) algorithm, which accumulates the performance of the first layer classifiers. In the third layer, the adaptive frameworks measures the real-time live network traffic to detect the DDoS attacks in the network traffic. The proposed framework utilizes a remote SDN controller to mitigate the detected DDoS attacks over Open Flow (OF) switches and reconfigures the network resources for legitimate network hosts. The experimental results show the better performance of the proposed framework as compared to existing state-of-the art solutions in terms of higher accuracy of DDoS detection and low false alarm rate.

Research on NTP Nonlinear Reflection Attack Identification Based on AHP Multidimensional Matrix in Global COVID-19 Environment

Under the influence of the global epidemic, various businesses have moved online one after another. With the rise of emerging industries such as online medical treatment, online education, and online conference, the proportion of attacks in the network service industry has increased year by year. UDP-FLOOD is still the primary scenario of DDoS attacks. Among them, with a large number of attack resources and most of them are high configuration servers, NTP (Network Time Protocol) reflection has become the most common UDP reflection attack method, accounting for 59% of the overall distribution. Therefore, establishing an efficient NTP attack detection system is a very important content to prevent network malicious attacks. At present, NTP-attacking based defensed methods mainly include IP filtering, hop mapping, and response packet detection, but they all have obvious weaknesses. Among them, the IP detection scheme can only detect historical attack IP, the implementation of hop mapping scheme is complex, and the resource overhead of response packet detection scheme is too large. Therefore, this paper proposes a nonlinear detection algorithm based on AHP multidimensional matrix quad information entropy. Through simulation experiments, the change of quad information entropy of attack intensity from 10% to 100% is counted. The detection rate based on the traditional target IP and target port algorithm is only 50% and 60%, which is significantly lower than this algorithm. Experiments show that the detection rate of this algorithm is higher.

Detection of Network Attacks in a Heterogeneous Industrial Network Based on Machine Learning

The paper discusses the issues of improving algorithms for detecting network attacks in a heterogeneous industrial Internet of Things network based on machine learning technologies for subsequent integration with the subsystems of the center for monitoring and responding to information security incidents. A structural diagram of a network attack detection system and an algorithm for intelligent analysis of network traffic parameters in the task of detecting malicious network activity have been developed. Variants of constructing ensembles of classifiers based on machine learning models and heterogeneous neural network models are analyzed. The F1-measure score when working with test samples reaches 96 %. The possibility of embedding the obtained models as modules of network equipment to increase the efficiency of the analysis of network traffic of industrial systems or use as part of a network intrusion detection system is considered. The efficiency of the obtained solutions in assessing the quality of network attack detection on the original datasets is comparable for the tested models. The most promising for use in specialized signal processors of network equipment is a classifier based on a committee of random trees, since it provides good quality detection of network attacks and does not require significant computing resources when launching a model with coefficients selected during training. Monitoring the state of information and network infrastructure is implemented on the basis of a deployed solution based on the ELK stack. A virtual testing ground has been developed to assess the effectiveness of ML-models for detecting network attacks. Further research is aimed at developing a methodology for testing models in various scenarios for the implementation of targeted multi-step network attacks.

Key Recovery for Content Protection Using Ternary PUFs Designed with Pre-Formed ReRAM

Physical unclonable functions, embedded in terminal devices, can be used as part of the recovery process of session keys that protect digital files. Such an approach is only valuable when the physical element offers sufficient tamper resistance. Otherwise, error correcting codes should be able to handle any variations arising from aging, and environmentally induced drifts of the terminal devices. The ternary cryptographic protocols presented in this paper, leverage the physical properties of resistive random-access memories operating at extremely low power in the pre-forming range to create an additional level of security, while masking the most unstable cells during key generation cycles. The objective is to reach bit error rates below the 10−3 range from elements subjected to drifts and environmental effects. We propose replacing the error correcting codes with light search engines, that use ciphertexts as helper data to reduce information leakage. The tamper-resistant schemes discussed in the paper include: (i) a cell-pairing differential method to hide the physical parameters; (ii) an attack detection system and a low power self-destruct mode; (iii) a multi-factor authentication, information control, and a one-time read-only function. In the experimental section, we describe how prototypes were fabricated to test and quantify the performance of the suggested methods, using static random access memory devices as the benchmark.

Comparative analysis of various machine learning algorithms for ransomware detection

Recently, the ransomware attack posed a serious threat that targets a wide range of organizations and individuals for financial gain. So, there is a real need to initiate more innovative methods that are capable of proactively detect and prevent this type of attack. Multiple approaches were innovated to detect attacks using different techniques. One of these techniques is machine learning techniques which provide reasonable results, in most attack detection systems. In the current article, different machine learning techniques are tested to analyze its ability in a detection ransomware attack. The top 1000 features extracted from raw byte with the use of gain ratio as a feature selection method. Three different classifiers (decision tree (J48), random forest, radial basis function (RBF) network) available in Waikato Environment for Knowledge Analysis (WEKA) based machine learning tool are evaluated to achieve significant detection accuracy of ransomware. The result shows that random forest gave the best detection accuracy almost around 98%.

GANBA: Generative Adversarial Network for Biometric Anti-Spoofing

Automatic speaker verification (ASV) is a voice biometric technology whose security might be compromised by spoofing attacks. To increase the robustness against spoofing attacks, presentation attack detection (PAD) or anti-spoofing systems for detecting replay, text-to-speech and voice conversion-based spoofing attacks are being developed. However, it was recently shown that adversarial spoofing attacks may seriously fool anti-spoofing systems. Moreover, the robustness of the whole biometric system (ASV + PAD) against this new type of attack is completely unexplored. In this work, a new generative adversarial network for biometric anti-spoofing (GANBA) is proposed. GANBA has a twofold basis: (1) it jointly employs the anti-spoofing and ASV losses to yield very damaging adversarial spoofing attacks, and (2) it trains the PAD as a discriminator in order to make them more robust against these types of adversarial attacks. The proposed system is able to generate adversarial spoofing attacks which can fool the complete voice biometric system. Then, the resulting PAD discriminators of the proposed GANBA can be used as a defense technique for detecting both original and adversarial spoofing attacks. The physical access (PA) and logical access (LA) scenarios of the ASVspoof 2019 database were employed to carry out the experiments. The experimental results show that the GANBA attacks are quite effective, outperforming other adversarial techniques when applied in white-box and black-box attack setups. In addition, the resulting PAD discriminators are more robust against both original and adversarial spoofing attacks.

A Time-Series Self-Supervised Learning Approach to Detection of Cyber-physical Attacks in Water Distribution Systems

Water Distribution System (WDS) threats have significantly grown following the Maroochy shire incident, as evidenced by proofed attacks on water premises. As a result, in addition to traditional solutions (e.g., data encryption and authentication), attack detection is being proposed in WDS to reduce disruption cases. The attack detection system must meet two critical requirements: high accuracy and near real-time detection. This drives us to propose a two-stage detection system that uses self-supervised and unsupervised algorithms to detect Cyber-Physical (CP) attacks. Stage 1 uses heuristic adaptive self-supervised algorithms to achieve near real-time decision-making and detection sensitivity of 66% utilizing Boss. Stage 2 attempts to validate the detection of attacks using an unsupervised algorithm to maintain a detection accuracy of 94% utilizing Isolation Forest. Both stages are examined against time granularity and are empirically analyzed against a variety of performance evaluation indicators. Our findings demonstrate that the algorithms in stage 1 are less favored than those in the literature, but their existence enables near real-time decision-making and detection reliability. In stage 2, the isolation Forest algorithm, in contrast, gives excellent accuracy. As a result, both stages can collaborate to maximize accuracy in a near real-time attack detection system.

Retracted: An empirical intrusion detection system based on XGBoost and bidirectional long‐short term model for 5G and other telecommunication technologies

AbstractRecently, intrusion detection system (IDS) has become an essential remedy to protect networks from malicious activities and attacks. The attacks force the network activities under risk and cause network data as an unrecoverable one. The attacks have different features in nature and their detection rate is low. An efficient attack detection system requires a huge volume of network transactions and relevant features for training. But the existing datasets have significant and nonsignificant features together. Hence, the significant feature selection plays a major role to detect the attacks. For this reason, this paper adopts the XGBoost approach to identify the relevant (significant) features of the attacks in the dataset. After this XGBoost, this article applies the bidirectional long short term model (Bi‐LSTM) for the detection and classification of the attacks. This Bi‐LSTM model is a novel approach to the IDS and very effective to increase the detection rate. Thus, this article focuses on feature reduction and classification of the attacks. The experimental results show that the proposed XGBoost and Bi‐LSTM combination outperforms in detecting attacks.