Complex Network Security Research Articles

Analytics and measuring the vulnerability of communities for complex network security

Analytics and measuring the vulnerability of communities for complex network security

Application of machine learning algorithm and data evaluation in computer network security situation awareness technology

With the rapid development of information technology and the rapid popularization of the Internet, while people enjoy the convenience and efficiency brought about by new technologies, they are also suffering from the harm caused by cyber attacks. In addition to efficiently thwarting network assaults, a high volume of complicated security event data might unintentionally increase the strain of policy makers. At present, NS threats mainly include network viruses, trojans, DOS (Denial-Of-Service), etc. For the increasingly complex Network Security (NS) problems, the traditional rule-based network monitoring technology is difficult to predict the unknown attack behavior. Environment-based, dynamic and integrated data fusion can integrate data from a macro perspective. In recent years, Machine Learning (ML) technology has developed rapidly, which could easily train, test and predict existing third-party models. It uses ML algorithms to find out the association between data rather than manually sets rules. Support vector machine is a common ML method, which can predict the security of the network well after training and testing. In order to monitor the overall security status of the entire network, NS situation awareness refers to the real-time and accurate reproduction of network attacks using the reconstruction approach. Situation awareness technology is a powerful network monitoring and security technology, but there are many problems in the existing NS technology. For example, the state of the network cannot be accurately detected, and its change rule cannot be understood. In order to effectively predict network attacks, this paper adopted a technology based on ML and data analysis, and constructed a NS situational awareness model. The results showed that the detection efficiency of the model based on ML and data analysis was 7.18% higher than that of the traditional NS state awareness model.

Optimal monitoring and attack detection of networks modeled by Bayesian attack graphs

Early attack detection is essential to ensure the security of complex networks, especially those in critical infrastructures. This is particularly crucial in networks with multi-stage attacks, where multiple nodes are connected to external sources, through which attacks could enter and quickly spread to other network elements. Bayesian attack graphs (BAGs) are powerful models for security risk assessment and mitigation in complex networks, which provide the probabilistic model of attackers’ behavior and attack progression in the network. Most attack detection techniques developed for BAGs rely on the assumption that network compromises will be detected through routine monitoring, which is unrealistic given the ever-growing complexity of threats. This paper derives the optimal minimum mean square error (MMSE) attack detection and monitoring policy for the most general form of BAGs. By exploiting the structure of BAGs and their partial and imperfect monitoring capacity, the proposed detection policy achieves the MMSE optimality possible only for linear-Gaussian state space models using Kalman filtering. An adaptive resource monitoring policy is also introduced for monitoring nodes if the expected predictive error exceeds a user-defined value. Exact and efficient matrix-form computations of the proposed policies are provided, and their high performance is demonstrated in terms of the accuracy of attack detection and the most efficient use of available resources using synthetic Bayesian attack graphs with different topologies.

An Efficient Federated Learning System for Network Intrusion Detection

Network intrusion detection is used to detect unauthorized activities on a digital network, with which the cybersecurity teams of organizations can then kick-start prevention protocols to protect the security of their networks and data. In real-life scenarios, due to the lack of high-quality attack instance data, building an in-depth network intrusion detection system (NIDS) is always challenging for a single enterprise, in terms of handling complex network security threats. To remedy the problem, this article proposes an efficient intrusion detection system called dynamic weighted aggregation federated learning (DAFL) based on federated learning. Specifically, DAFL has used the full advantages of federated learning for data privacy preservation. Moreover, compared to a conventional federated-learning based intrusion detection system, our scheme has implemented dynamic filtering and weighting strategies for local models. In this way, DAFL can perform better in detecting network intrusions with less communication overhead. We give the detailed designs of DAFL, and our experimental results demonstrate that DAFL can achieve excellent detection performance with a low network communication overhead, with data privacy preserved.

Robustness of community networks against cascading failures with heterogeneous redistribution strategies

Network robustness is one of the core contents of complex network security research. This paper focuses on the robustness of community networks with respect to cascading failures, considering the nodes influence and community heterogeneity. A novel node influence ranking method, community-based Clustering–LeaderRank (CCL) algorithm, is first proposed to identify influential nodes in community networks. Simulation results show that the CCL method can effectively identify the influence of nodes. Based on node influence, a new cascading failure model with heterogeneous redistribution strategy is proposed to describe and analyze node fault propagation in community networks. Analytical and numerical simulation results on cascading failure show that the community attribute has an important influence on the cascading failure process. The network robustness against cascading failures increases when the load is more distributed to neighbors of the same community instead of different communities. When the initial load distribution and the load redistribution strategy based on the node influence are the same, the network shows better robustness against node failure.

Security Evaluation Method of Smart Home Cloud Platform

The application of artificial intelligence of things (AIoT) is becoming increasingly widespread. With its rapid development, it has raised many complex network security issues. These have brought crushing security threats and risks to all stakeholders. AIoT cloud platform in the smart home plays a vital role in the security management of devices and is the current research hotspot. This paper discusses the security of the AIoT cloud platform, represented by the smart home. The indicator system describing the protection of the smart home cloud platform is proposed, and the security risk evaluation method of the cloud service is formed. Based on the evaluation method, a lightweight security evaluation framework for smart home cloud service is designed to evaluate the typical cloud platform’s security. The evaluation identifies some technical and administrative issues. Finally, to improve the security of the cloud console of AIoT and discover potential security risks in time, a security self-test model of the scalable cloud console is proposed.

Network security situation assessment based on dual attention mechanism and HHO-ResNeXt

The traditional convolutional neural network (CNN) has a limited receptive field and cannot accurately identify the importance of each channel, making it difficult to solve increasingly complex network security problems. To solve these problems, this paper combines ResNeXt with the Efficient Channel Attention (ECA) module and the Contextual Transformer (COT) block to construct a model to assess network conditions. The optimal hyperparameters of the model are selected by the Harris Hawks Optimization (HHO) algorithm. The model can accurately obtain the importance of each channel to assign weights to each channel while making full use of the rich contexts among neighbour keys, effectively enhancing the convolutional neural network. Furthermore, this paper calculates the network security situation value (NSSV) of the adopted datasets based on attack impact. Lastly, experiments on two cybersecurity datasets show that the comprehensive performance of the model on the three indicators of accuracy, precision and F-scores, as well as network security situation assessment, are superior to other models.

Design of Wireless Communication Base Station Monitoring System Based on Artificial Intelligence and Network Security

With the rapid popularization of the network, under the increasingly complex network security situation and the increasingly prominent network security problems, network security occupies an important field in the wireless communication base station monitoring system, and has become a hot research direction. It is to design a wireless communication base station monitoring system based on artificial intelligence and network security. In the experiment, using the supervised machine learning algorithm, the program of the wireless communication base station monitoring system is designed by setting the working frequency of the GSM-based wireless communication system to the wireless communication base station monitoring system.

A network security situation assessment model based on BP neural network optimized by D-S evidence theory

Abstract Traditional networks rely heavily on the distribution of expert experience when assessing complex network security situations, resulting in low assessment accuracy, which has been unable to adapt to the current network security needs of the big data era, and has unavoidable problems such as low efficiency and poor flexibility. In response to these problems, this paper proposes a network security situation assessment method based on D-S evidence theory to optimize neural networks. First establish the CS-BP neural network model, enhance the local search ability of the cuckoo algorithm through conjugate gradient calculation, and then introduce it into the BP neural network to improve the training convergence speed and overcome the local minimum problem; finally, in order to reduce the basic probability distribution (BPA) subjective impact, using DS evidence theory to optimize the CS-BP neural network, determine the degree of impact of each attack, and evaluate the value of the network security situation. The experimental results show that the network situation assessment model of CS-BP neural network optimized based on D-S evidence theory can effectively assess the network security situation in the environment of trusted equipment.

Network Security Threat Situation Recognition Based on Attack and Defense Game Model

At present, network security is a problem that needs to be solved urgently in the current network era. In order to reduce the loss caused by network security threats, and also use limited computer resources to select the best defense strategy, a set of network attack and defense game models are designed to identify the situation of network security threats. Aiming at the unstable problem of the security quantification process of traditional network node information, a network security threat situation identification based on the offensive and defensive game model is proposed. First, build an offensive and defensive game model, design the corresponding situation identification strategy, and calculate the overall utility and expected output of both offensive and defensive parties while clarifying the changes in the authority of both sides during the offensive and defensive process. This paper takes the offensive and defensive game model as the theoretical basis of the research, uses the algorithm as the auxiliary research, and integrates its important content to analyze and research the optimization of the algorithm to improve the network security threat situation identification. This paper uses the classic offensive and defensive game model as the research object to identify the threat situation of network security. In the process of selecting the offensive and defensive game model, it is necessary to have a better grasp of the relevant algorithms. This article introduces the offensive and defensive game model into the network security threat situation identification, and on this basis, it deeply discusses the applicability and effectiveness of the offensive and defensive game model in the complex network security threat situation identification, and provides better for the establishment of future network security systems. Reference. The experimental results show that this study is effective and feasible in the offensive and defensive game model in the network security threat situation identification. It should be noted that in the defense process, the probability of success and the degree of damage of the attack path must be grasped to ensure that the optimal offensive and defensive decision-making meets the actual needs of network security.

A security policy model transformation and verification approach for software defined networking

Software-defined networking (SDN) has been increasingly utilized to enforce the security of complex networks. However SDN-based security enforcement mechanisms rely heavily on some specific security policies containing underlying network information. Facing the increasingly complex and huge SDN networks, we urgently need a novel security policy management mechanism which can be completely transparent to any underlying network information. That is it can permit network managers to define the high-level security policy model without containing any underlying information, and by means of model transformation, high-level security policy model can be automatically transformed into its corresponding lower-level security policy model containing underlying information. Moreover, we must ensure the system model of data plane updated by the low-level security policy model can hold all of security properties defined in high-level security policy model. Based on these insights, we propose a security policy model transformation and verification approach for SDN in this paper. We first specify the security policies used in SDN networks as a formal security policy model (SPM). Then we establish the system model of SDN’s data plane and the mapping rules between the policy objects of SPM and the system objects of system model of data plane. Based on these mapping rules, we propose a security policy model transformation mechanism which transforms SPM into the low-level security policy model, RSPM. In order to verify the system model of data plane updated by RSPM can hold all of security properties defined in SPM, we propose a security policy verification mechanism based on model checking techniques and a group of validation conditions. Finally, we utilize a comprehensive case to illustrate the feasibility of this approach.

Research on optimal control model of complex networks security risk

To solve the problems such as the security risk control and the optimization of the complex networks, an optimal control model of complex networks security risk based on discrete glowworm swarm optimization with key strategy adjustment is proposed. The basic framework of this model is built based on four functional modules including detection and evaluation, strategy selection, control optimization and performance feedback. The optimal evaluation criterions of the security control strategy are constituted of factors such as control cost, benefit reward and negative effect. The discrete glowworm swarm optimization algorithm with key strategy ad-justment is proposed to search for the optimal control strategy of complex network security risk. The concept of control parameter is introduced, whose feedback and adjustment make the optimal control model get evolution-ary. Finally, the model and the algorithm are tested for network security risk optimal control in the Nearest-Neighbor coupled with network, Erdos-Renyi random graph network, Watts-Strogatz small world network and Ba-rabasi-Albert power law network, separately. The availability of the model and the superiority of the algorithm are validated and the effect of the change for the attack strategy to the security risk optimal control model is analyzed by simulations.

Security Optimization of Dynamic Networks with Probabilistic Graph Modeling and Linear Programming

Securing the networks of large organizations is technically challenging due to the complex configurations and constraints. Managing these networks requires rigorous and comprehensive analysis tools. A network administrator needs to identify vulnerable configurations, as well as tools for hardening the networks. Such networks usually have dynamic and fluidic structures, thus one may have incomplete information about the connectivity and availability of hosts. In this paper, we address the problem of statically performing a rigorous assessment of a set of network security defense strategies with the goal of reducing the probability of a successful large-scale attack in a dynamically changing and complex network architecture. We describe a probabilistic graph model and algorithms for analyzing the security of complex networks with the ultimate goal of reducing the probability of successful attacks. Our model naturally utilizes a scalable state-of-the-art optimization technique called sequential linear programming that is extensively applied and studied in various engineering problems. In comparison to related solutions on attack graphs, our probabilistic model provides mechanisms for expressing uncertainties in network configurations, which is not reported elsewhere. We have performed comprehensive experimental validation with real-world network configuration data of a sizable organization.

Hybrid Protocol for Handling Security using SBPGP

ad hoc network is part of wireless networks which is formed by collection of two or more nodes moving in an arbitrary manner. The nodes are self organizing, adaptive, infrastructure less and has dynamic topology. Hence due to high mobility and multipath propagation network is vulnerable to attacks. There are many types of MANET like VANET (Vehicular Ad hoc Network), SPANs (Smart Phone Ad hoc Networks), iMANET (Internet based Mobile Ad hoc Network), Tactical MANET. There are various attacks that can be possible on MANET like Denial of Service attack, Black hole attack, Wormhole attack, Sybil attack etc which can disturb the communication between the nodes. So today's requirement is to provide secure and authentic communication in MANET. For small network security is not a big issue but for large or complex network security should be provided in large extent. To provide security for complex networks in the network using a technique Seniority Based Pretty Good Privacy (SBPGP) is used. KeywordsBlack hole attack, DOS, MANET, Network Security, SBPGP.

A New Security Baseline Reinforcement Method for the Power Information System

Power information is a typical distributed interconnect system, faced with a complex network security problems. It still lacks a systematic method for the design and evaluation of system security. The authors comprehensively survey the layout of the power network and also ISO27001 international standards, and proposed a new security baseline reinforcement method for the power information system. By using the multi-class fuzzy comprehensive judgment model and the SSE-CMM method, the authors proved the reinforcement method is reliable in theory. This method combines ISO27001 PDCA model with the security baseline testing process, and applies ITU-T X.805 security architecture to the testing indicators extraction process, which makes the security evaluation process for the power information system quick and practical.

Complex networks: Dynamics and security

This paper presents a perspective in the study of complex networks by focusing on how dynamics may affect network security under attacks. In particular, we review two related problems: attack-induced cascading breakdown and range-based attacks on links. A cascade in a network means the failure of a substantial fraction of the entire network in a cascading manner, which can be induced by the failure of or attacks on only a few nodes. These have been reported for the internet and for the power grid (e.g., the August 10, 1996 failure of the western United States power grid). We study a mechanism for cascades in complex networks by constructing a model incorporating the flows of information and physical quantities in the network. Using this model we can also show that the cascading phenomenon can be understood as a phase transition in terms of the key parameter characterizing the node capacity. For a parameter value below the phase-transition point, cascading failures can cause the network to disintegrate almost entirely. We will show how to obtain a theoretical estimate for the phase-transition point. The second problem is motivated by the fact that most existing works on the security of complex networks consider attacks on nodes rather than on links. We address attacks on links. Our investigation leads to the finding that many scale-free networks are more sensitive to attacks on short-range than on long-range links. Considering that the small-world phenomenon in complex networks has been identified as being due to the presence of long-range links, i.e., links connecting nodes that would otherwise be separated by a long node-to-node distance, our result, besides its importance concerning network efficiency and security, has the striking implication that the small-world property of scale-free networks is mainly due to short-range links.