Bot Attacks Research Articles

CNN- based intrusion detection software for network operating system environment

Cybersecurity represents an important challenge specific to digital technology in the modern world, and is of vital importance for reducing or even preventing the impact of cybercrime. The Linux operating system is designed as open-source software that includes some features of software tools intended for network security and cybersecurity systems, such as intruder detection and penetration testing. With these tools in Linux, we need a special system to constantly detect intrusions into connected network devices. This research presents a method for detecting intrusion attacks based on analyzing the natural behavior of the system by building a special convolutional network to achieve this goal. The classification and detection results of the proposed convolutional neural network were compared with the regular machine learning method (SVM), with feature selection by correlation for both methods. Same datasets were used to train and test each of CNN and SVM. Some metrics were determined to evaluate the performance of classification and prediction models for a specific type of regular attacks, DoS and BOT attacks, where both SVM and CNN obtained an accuracy of 85.58% and 95.59%, respectively.

Deep learning enabled intrusion detection system for Industrial IOT environment

The prevalence of security vulnerabilities in Internet of Things (IoT) applications poses a serious threat to enterprise systems, necessitating sophisticated and reliable defense solutions to counter emerging and evolving threats. For the Industrial Internet of Things (IIoT), stakeholders require trustworthy and sustainable systems that can prevent the loss of human life during critical operations. The impact of multi-variant persistent and sophisticated bot attacks on connected IIoTs is potentially catastrophic, and their detection presents a highly complex and critical challenge. Therefore, there is a pressing need for efficient and timely detection of IIoT botnet attacks. This research paper proposes a robust deep learning model named AttackNet for the detection and classification of different botnet attacks in IIoT based on adaptive based CNN-GRU model. The model is extensively evaluated using the latest dataset and standard performance evaluation metrics, demonstrating its capacity to protect IIoT networks against sophisticated cyber-attacks with a testing accuracy of 99.75%, a loss of 0.0063, precision and recall score of 99.75% and 99.74% respectively. Our proposed model demonstrates superior accuracy, particularly within the N_BaIoT dataset. It achieves an outstanding accuracy of 99.75% across ten classes, surpassing state-of-the-art techniques by a substantial margin ranging from 3.2% to 16.07%. Moreover, the proposed model outperforms state-of-the-art anomaly detection systems in IIoT based on a real-time IoT device dataset in terms of detecting and classifying botnet attacks accurately.

Robustness and user test on text-based CAPTCHA: Letter segmenting is not too easy or too hard

Text-based CAPTCHA is widely used as an online security guard, requiring a user to input letters for classifying human and automated software (known as a bot). However, they are still a problem for usability and robustness. This study investigated the effect of letter spacing, disturbing line orientation and disturbing line color on user test and robustness of text-based CAPTCHA. The 240 CAPTCHAS were tested using Thai undergraduate students. The results show that there were no significant differences in user tests for the three factors. For robustness, disturbing line orientation had no significant difference. However, overlapping letter CAPTCHA was the most significantly robust. CAPTCHA with a disturbing line using the same color as the background was more significantly robust than that using the same color as the foreground. Moreover, if no-spacing letter is used, the effect of disturbing line color is statistically significant in robustness while the effect of that became insignificant when a spacing between letter and overlapping letter are used. We recommend that CAPTCHA with no spacing letter and combined with disturbing line using the same color as the background is suitable for users and its robustness. This can be concluded that letter segmenting technique is not too hard for users (passed 88 %) while it is not too easy for bot attacks (passed 39 %). In terms of security, more studies can still be carried on the CAPTCHA to enabled more robustness against new crime technologies. In terms of usability, on other age groups could be consider.

An IoT Device-Level Vulnerability Control Model Through Federated Detection

In the rapidly expanding Internet of Things (IoT) landscape, the security of IoT devices is a major concern. The challenge lies in the lack of intrusion detection systems (IDS) models for these devices. This is due to resource limitations, resulting in, single point of failure, delayed threat detection and privacy issues when centralizing IDS processing. To address this, a LiteDLVC model is proposed in this paper, employing a multi-layer perceptron (MLP) in a federated learning (FL) approach to minimize the vulnerabilities in IoT system. This model manages smaller datasets from individual devices, reducing processing time and optimizing computing resources. Importantly, in the event of an attack, the LiteDLVC model targets only the compromised device, protecting the FL aggregator and other IoT devices. The model's evaluation using the BoT-IoT dataset on TensorFlow Federated (TFF) demonstrates higher accuracy and better performance with full features subset of 99.99% accuracy on test set and achieved average of 1.11sec in detecting bot attacks through federated detection. While on 10-best subset achieved 99.99 on test with 1.14sec as average detection time. Notably, this highlights that LiteDLVC model can potential secure IoT device from device level very efficiently. To improve the global model convergence, we are currently exploring the use genetic algorithm. This could lead to better performance on diverse IoT data distributions, and increased overall efficiency in FL scenes with non-IID data.

Implementation of Captcha Mechanisms using Deep Learning to Prevent Automated Bot Attacks

Online platforms' integrity and security are seriously threatened by the growth of automated bot attacks, necessitating the development of effective methods for telling harmful bots apart from legitimate users. In order to successfully combat automated bot attacks, this project investigates the creation and application of CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) methods utilising deep learning techniques. In this study, we employ deep learning to create and apply complex CAPTCHA-problems that help us distinguish between real users and automated bots. Convolutional neural networks and recurrent neural networks are employed to build dynamic, adjustable CAPTCHAs in order to keep up with the bots' evolving approaches. Our research focuses on creating CAPTCHAs that are simple to use for humans but difficult to understand by robots, which creates a favourable user experience for those who are actually human. Character skewing, background noise injection, and image obfuscation are some of the methods we use to safeguard our CAPTCHAs while maintaining their usability. Furthermore, we carry out exhaustive trials in the real world to assess the effectiveness of our methods based on in-depth CAPTCHA learning. We evaluate their resistance to a variety of attack methods, such as counterattacks and machine learning-based bot attacks, in order to confirm that they are resilient. The findings of our study show that utilising deep learning in CAPTCHA methods to thwart automated bot attacks is both feasible and effective. Our method makes the internet environment safer and more user-friendly while also enhancing security and reducing user annoyance. This work is an important step in the fight against the growing menace of automated bot attacks in the digital sphere.

Supervised learning models for social bot detection: Literature review and benchmark

Over the past decades, online social networks such as Twitter and Facebook have become a significant part of people’s daily lives, particularly amid the ongoing global calamity — the COVID-19 pandemic. This gives room for social bot attacks that are designed to automatically replicate the behavior of real accounts. Most of these bots are employed for nefarious purposes such as disseminating false information, artificially amplifying the popularity of a person or movement, or spreading spam. Many studies have been conducted in an attempt to discover new strategies for identifying social bot accounts. To deal with large-scale attacks from social bots, Machine Learning has emerged as a noticeable path of bot detection problem that can handle massive amounts of data. However, the heterogeneity between studies in terms of problem statements, proposed processes, datasets, and evaluation metrics makes it difficult to assess and compare the efficiency of proposed methods. In this paper, we propose a systematic view of supervised learning methodologies for tweet-based social bot detection, ranging from shallow learning to specific deep learning models. In addition, we introduce a framework that measures various performance aspects and summarizes the in-depth analysis of the results, which were obtained using two datasets comprising 26224 labeled Twitter accounts. The results of this framework, we believe, will be beneficial as a practical guideline for other bot detection research or applications that require the use of machine learning techniques.

Securing Industrial Internet of Things Against Botnet Attacks Using Hybrid Deep Learning Approach

Industrial Internet of Things (IIoT) formation of richer ecosystem of intelligent interconnected devices while enabling new levels of digital innovation has essentially transformed and revolutionized global manufacturing and industry 4.0. Conversely, the prevalent distributed nature of IIoT, Industrial 5G, underlying IoT sensing devices, IT/OT convergence, Edge Computing, and Time Sensitive Networking makes it an impressive and potential target for cyber-attackers. Multi-variant persistent and sophisticated bot attacks are considered catastrophic for connects IIoTs. Besides, botnet attack detection is extremely complex and decisive. Thus, efficient and timely detection of IIoT botnets is a dire need of the day. We propose a hybrid intelligent Deep Learning (DL)-enabled mechanism to secure IIoT infrastructure from lethal and sophisticated multi-variant botnet attacks. The proposed mechanism has been rigorously evaluated with latest available dataset, standard and extended performance evaluation metrics, and current DL benchmark algorithms. Besides,cross validation of our results are also performed to clearly show overall performance. The proposed mechanisms outperforms in identifying accurately multi-variant sophisticated bot attacks. Besides, our proposed technique also show promising results in terms of speed efficiency.

OTP bots and crypto: A tactic to disrupt

One-time password (OTP) bots are a form of crimeware-as-a-service that is being used to bypass two-factor authentication (2FA) on victim accounts. The bots are operated through Telegram and are sold at various price points in exchange for cryptocurrency. The bot operators facilitate a false phone call to victims, impersonating their financial institution, to obtain their OTP to commit an account takeover. Account takeovers facilitated by this type of social engineering are an enormous threat to financial institutions due to the inability to identify the attack without secondary corroboration. This paper illustrates the typical workflow of an OTP bot, avenues of institutional platform investigation and detection, as well as potential mitigation options to combat OTP bot attacks.

An Experimental Investigation of Text-based CAPTCHA Attacks and Their Robustness

Text-based CAPTCHA has become one of the most popular methods for preventing bot attacks. With the rapid development of deep learning techniques, many new methods to break text-based CAPTCHAs have been developed in recent years. However, a holistic and uniform investigation and comparison of these attacks’ effects is lacking due to inconsistent choices of model structures, training datasets, and evaluation metrics. In this article, we perform an experimental investigation on the effects of existing attacks on text-based CAPTCHA schemes. We first summarize existing text-based CAPTCHAs using a newly proposed taxonomy based on their resistance mechanisms and systematically review corresponding attacks in terms of methods and pros/cons. Then, we introduce a unified attack framework that contains a number of different attack modules and transfer learning strategies. Applying this framework, we extensively evaluate the performance of known attacks on 20 CAPTCHA schemes in terms of accuracy and efficiency; then, we investigate the robustness of these widely used schemes and discover the effects of previously unexplored attacks. Finally, we discuss future CAPTCHA designs based on our experimental results and findings. Our work also contributes to the CAPTCHA community by offering an open-access dataset that contains 22 different CAPTCHA sample sets.

Enhancing the security in cyber-world by detecting the botnets using ensemble classification based machine learning

With various malware, botnets are the legitimate risk increasing against cybersecurity providing criminal operations like malware dispersal, distributed denial of service attacks, fraud clicking, phishing, and identification of theft. Existing techniques used for detection of botnet, which are suitable only for specific command of botnet and protocol for controlling and do not support botnet detection at earlier stages. In several computer security defense systems, honeypots are deployed successfully by security defenders. As honeypots can attract botnet compromises and expose spies in botnet membership and behaviors of the attacker, they are broadly employed in botnet defense. Thus, attackers whose role is to construct and maintain botnets have to determine honeypot trap avoiding methods. To handle the issues related to botnet attacks, machine learning techniques are used to support detection and prevent bot attacks. An Ensemble Classifier Algorithm with Stacking Process (ECASP) is proposed in this paper to select optimal features fed as input to the machine learning classifiers to estimate the botnet detection performance. As a result, the method achieves proposed achieves 94.08% accuracy, 86.5% sensitivity, 85.68% specificity, and 78.24% F-measure.

Genetic programming support vector machine model for a wireless intrusion detection system

Objectives. The rapid penetration of wireless communication technologies into the activities of both humans and Internet of Things (IoT) devices along with their widespread use by information consumers represents an epochal phenomenon. However, this is accompanied by the growing intensity of successful information attacks, involving the use of bot attacks via IoT, which, along with network attacks, has reached a critical level. Under such circumstances, there is an increasing need for new technological approaches to developing intrusion detection systems based on the latest achievements of artificial intelligence. The most important requirement for such a system consists in its operation on various unbalanced sets of attack data, which use different intrusion techniques. The synthesis of such an intrusion detection system is a difficult task due to the lack of universal methods for detecting technologically different attacks; moreover, the consistent application of known methods is unacceptably long. The aim of the present work is to eliminate such a scientific gap.Methods. Using the achievements of artificial intelligence in the fight against attacks, the authors proposed a method based on a combination of the genetic programming support vector machine (GPSVM) model using an unbalanced CICIDS2017 dataset.Results. The presented technological intrusion detection system architecture offers the possibility to train a dataset for detecting attacks on CICIDS2017 and extracting detection objects. The architecture provides for the separation of the dataset into verifiable and not verifiable elements, with the latter being added to the training set by feedback. By training the model and improving GPSVM training set, better accuracy is ensured. The operability of the new flowchart of the GPSVM model is demonstrated in terms of the entry of input data and output of data after processing using the training set of the GPSVM model. Numerical analysis based on the results of model experiments on selected quality indicators showed an increase in the accuracy of the results as compared to the known SVM method.Conclusions. Computer experiments have confirmed the methodological correctness of choosing a combination of the GPSVM model using an unbalanced CICIDS2017 dataset to increase the effectiveness of intrusion detection. A procedure for forming a training dataset based on feedback is proposed. The procedure involving the separation of datasets is shown to create conditions for improving the training of the model. The combination of the GPSVM model with an unbalanced CICIDS2017 dataset to collect a sample increases theaccuracy of intrusion detection to provide improved intrusion detection performance as compared to the SVM method.

A secure annuli CAPTCHA system

Many websites and applications rely on CAPTCHA for protection from bot attacks. Otherwise, users and businesses will be exposed to risks. Although several different CAPTCHA systems have been proposed, the development of deep learning algorithms allows attackers to create more efficient and accurate attack methods. Many studies have shown that existing CAPTCHA systems are no longer safe, especially text-based CAPTCHA. To resolve this issue, a simple, secure, and effective annuli CAPTCHA system is proposed in this paper. In the proposed system, the annuli CAPTCHA image containing the overlapping of circles and ovals is randomly generated. The user wishing to gain access to the system is required to answer correctly the total number of circles and ovals in the image to prove that he/she is not a bot. The security of our proposed CAPTCHA system is verified by three attack methods. Additionally, the usability survey of our CAPTCHA system conducted by anonymous questionnaires shows that our system is user friendly. In other words, the proposed system maintains a high level of usability under the premise of high security. Compared with the existing CAPTCHA system, our CAPTCHA system is significantly better in terms of security, usability and ease of implementation.

A Secure Network Model Against Bot Attacks in Edge-Enabled Industrial Internet of Things

The new Industry 4.0 standard has offered many advantages to the industries improving their production rate since it evaluates novel cutting-edge technologies like artificial intelligence, machine learning, cyber-physical systems, and Internet of Things (IoTs) to automate manufacturing processes so as to minimize time and economical costs while improving the quality of products. However, this rapid industrial transition carries risks in terms of security and privacy issues that arise. In this article, we propose a novel secure network model to enhance network security and employees’ privacy in the edge-enabled industrial IoTs. Experimental results demonstrate encouraging performance rates in terms of accuracy, precision, recall, fall-out, F-measure, and Matthews correlation coefficient against known and unknown bot attacks.

Attack-filtered interactive arabic CAPTCHAs

A CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) is widely used challenge–response test intended to distinguish between a human user and a malicious bot. This paper deals with text-based interactive CAPTCHA generation. Solving a CAPTCHA is interactive in the sense that the user is asked to solve a challenge from a pool of challenges. The novelty of the proposed method is that we introduce the concept of attack-filtering as a pre-release step for CAPTCHAs. In other words, the distortion level and challenge type for a particular CAPTCHA image are selected in a way that enables the presented CAPTCHA to withstand certain attacks. In addition, attack-filtering enables us to select an appropriate distortion level, present challenges in the proper order, and apply security thresholds. We implemented the presented model in a novel Arabic handwritten text-based interactive CAPTCHA scheme. The experimental results show that, with an interactive challenge pool, the proposed scheme can attain high usability even after filtering the CAPTCHA sample with pre-set bot attacks.

MOCA: A Network Intrusion Monitoring and Classification System

Optimizing the monitoring of network traffic features to detect abnormal traffic is critical. We propose a two-stage monitoring and classification (MOCA) system requiring fewer features to detect and classify malicious network attacks. The first stage monitors abnormal traffic, and the anomalous traffic is forwarded for processing in the second stage. A small subset of features trains both classifiers. We demonstrate MOCA’s effectiveness in identifying attacks in the CICIDS2017 dataset with an accuracy of 99.84% and in the CICDDOS2019 dataset with an accuracy of 93%, which significantly outperforms previous methods. We also found that MOCA can use a pre-trained classifier with one feature to distinguish DDoS and Botnet attacks from normal traffic in four different datasets. Our measurements show that MOCA can distinguish DDoS attacks from normal traffic in the CICDDOS2019 dataset with an accuracy of 96% and DDoS attacks in non-IoT and IoT traffic with an accuracy of 99.94%. The results emphasize the importance of using connection features to discriminate new DDoS and Bot attacks from benign traffic, especially with insufficient training samples.

Bot-MGAT: A Transfer Learning Model Based on a Multi-View Graph Attention Network to Detect Social Bots

Twitter, as a popular social network, has been targeted by different bot attacks. Detecting social bots is a challenging task, due to their evolving capacity to avoid detection. Extensive research efforts have proposed different techniques and approaches to solving this problem. Due to the scarcity of recently updated labeled data, the performance of detection systems degrades when exposed to a new dataset. Therefore, semi-supervised learning (SSL) techniques can improve performance, using both labeled and unlabeled examples. In this paper, we propose a framework based on the multi-view graph attention mechanism using a transfer learning (TL) approach, to predict social bots. We called the framework ‘Bot-MGAT’, which stands for bot multi-view graph attention network. The framework used both labeled and unlabeled data. We used profile features to reduce the overheads of the feature engineering. We executed our experiments on a recent benchmark dataset that included representative samples of social bots with graph structural information and profile features only. We applied cross-validation to avoid uncertainty in the model’s performance. Bot-MGAT was evaluated using graph SSL techniques: single graph attention networks (GAT), graph convolutional networks (GCN), and relational graph convolutional networks (RGCN). We compared Bot-MGAT to related work in the field of bot detection. The results of Bot-MGAT with TL outperformed, with an accuracy score of 97.8%, an F1 score of 0.9842, and an MCC score of 0.9481.

End-To-End Neural Network Based Captcha Recognition

Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) is widely used as a security measure against spam and bot attacks via the Internet. CAPTCHA works by the assumption that it takes human sensory and cognitive skills (that are not present in computers) to successfully identify objects or letters within a noisy graphical environment. In this work, we propose a way to teach machines to recognize CAPTCHAs with deep learning. Our deep learning model uses a Convolutional Neural Network (CNN) encoder to convert CAPTCHA images into vector representations, followed by a Recurrent Neural Network (RNN) decoder to convert vector representations into text. Our model is able to achieve a validation accuracy of 90% after about an hour of training. Code is available at https://github.com/wilbertharriman/tf2-attention-captcha-recognizer.

Web Bot Detection System Based on Divisive Clustering and K-Nearest Neighbor Using Biostatistics Features Set

Web bots are destructive programs that automatically fill the web form and steal the data from web sites. According to numerous web bot traffic reports, web bots traffic comprises of more than fifty percent of the total web traffic. An effective guard against the stealing of the data from web sites and automated web form is to identify and confirm the human user presence on web sites. In this paper, an efficient k-Nearest Neighbor algorithm using hierarchical clustering for web bot detection is proposed. Proposed technique exploits a novel taxonomy of web bot features known as Biostatistics Features. Numerous attack scenarios for web bot attacks such as automatic account registration, automatic form filling, bulk message posting, and web scrapping are created to imitate the zero-day web bot attacks. The proposed technique is evaluated with number of experiments using standard evaluation parameters. The experimental result analysis demonstrates that the proposed technique is extremely efficient in differentiating human users from web bots.

Feature extractions and selection of bot detection on Twitter A systematic literature review

Abstract Automated or semiautomated computer programs that imitate humans and/or human behavior in online social networks are known as social bots. Users can be attacked by social bots to achieve several hidden aims, such as spreading information or influencing targets. While researchers develop a variety of methods to detect social media bot accounts, attackers adapt their bots to avoid detection. This field necessitates ongoing growth, particularly in the areas of feature selection and extraction. The study's purpose is to provide an overview of bot attacks on Twitter, shedding light on issues in feature extraction and selection that have a significant impact on the accuracy of bot detection algorithms, and highlighting the weaknesses in training time and dimensionality reduction. To the best of our knowledge, this study is the first systematic literature review based on a preset search-strategy that encompasses literature published between 2018 and 2021 which are concerned with Twitter features (attributes). The key findings of this research are threefold. First, the paper provides an improved taxonomy of feature extraction and selection approaches. Second, it includes a comprehensive overview of approaches for detecting bots in the Twitter platform, particularly machine learning techniques. The percentage was calculated using the proposed taxonomy, with metadata, tweet text, and merging (meta and tweet text) accounting for 37%, 31%, and 32%, respectively. Third, some gaps are also highlighted for further research. The first is that public datasets are not precise or suitable in size. Second, the use of integrated systems and real-time detection is uncommon. Third, detecting each bots category identified separately is needed, rather than detecting all categories of bots using one generic model and the same features' values. Finally, extracting influential features that assist machine learning algorithms in detecting Twitter bots with high accuracy is critical, especially if the type of bot is pre-determined.

NFV-Based Scheme for Effective Protection against Bot Attacks in AI-Enabled IoT

The Internet of Things (IoT) is the upcoming network that aspires to interconnect “things” to each other and to the Internet. Many such “things” like smart devices and wireless sensors are already connected to the Internet, improving human life worldwide. These things can also have artificial intelligence, providing many capabilities to their users. However, such IoT-based devices hide risks since they are usually small devices with constrained resources, and hence do not have sufficient built-in security mechanisms. In addition, the increase of such devices with geometric regression worries network administrators who must take countermeasures to restrict and eliminate attackers who aim to turn the IoT into a Botnet of Things network, using compromised devices as bots to unleash distributed-denial-of-service and man-in-the-middle attacks, or/and spread various types of malware. Thus, they can have unauthorized access and steal very sensitive data from users for malicious purposes. In this article, we highlight the problem caused by the uncontrolled development of insecure IoT-based devices and describe an effective network functions virtualization infrastructure in combination with emerging technologies that could provide smart management and enhanced protection against botnet attacks.