Computer Network Attacks Research Articles

Implementation of DHCP Snooping Method to Improve Security on Computer Networks

This research proposes the DHCP Snooping method which is used to increase security on computer networks because Dynamic Host Configuration Protocol (DHCP) is a potential target for computer network attacks, one of the attack gaps that can occur in DHCP is the DHCP Rogue attack which is the simplest hacking method in which the attacker creates a fake DHCP connected to the core network allowing the hacker to set up a fake DHCP Server with full access to distribute IP addresses to clients. To address security gaps in computer networks in this research, researchers applied the DHCP Snooping method, which is a series of techniques to improve DHCP network security. When the DHCP server allocates IP addresses to clients on the LAN, DHCP Snooping can be configured on the LAN switch to allow only clients with certain IP and MAC addresses to have access to the network. By implementing the DHCP Snooping method you can increase security on computer networks where DHCP Snooping can distinguish which ports can be trusted (Trusted Port) and which ports cannot be trusted (Untrusted Port) so that the security of data and information in the computer network is maintained properly. Based on the results of this research, DHCP Snooping can prevent clients from getting DHCP IPs from DHCP Rouge because it has determined Trusted Port and Untrusted Port.

TENNER: intrusion detection models for industrial networks based on ensemble learning

In the pursuit of discerning patterns within computer network attacks, the utilization of Machine Learning and Deep Learning algorithms has been prevalent for crafting detection models based on extensive network traffic datasets. Furthermore, enhancing detection efficacy is feasible by applying cluster learning techniques, wherein multiple Machine Learning models collaborate to yield detection outcomes. Nevertheless, it is imperative to discern the optimal features within the dataset for training the intrusion detection model. In the present study, we proffer a novel framework for feature selection and intrusion detection within industrial networks, employing Ensemble Learning to achieve commendable performance in terms of both high predictive accuracy and efficient learning duration. The outcomes evince that the proposed model exhibits an accuracy of 99.93%, with a mere one h and 34 min required for comprehensive training. In contrast, a model trained without the framework presented in this paper attains an accuracy of 99.94%, necessitating an extensive training period of 156 h. Notably, the detection model derived from the proposed solution demonstrates superior results in prediction time, accomplishing predictions within 0.0009 seconds, compared to the alternative model which requires 0.0076 seconds for predictions.

تعزيز الامن السيبراني من خلال اختبار الاختراق الفعال وفحص الثغرات

The number of computer network attacks today is increasing with the sophisticated attack tools and complicated methods hence, building secure systems is required. The demand for regular penetration testing and vulnerability scanning has become an urgent issue. This paper focuses on increase the security of the system resources being tested; Determine the weakness in the popular operating systems; Focus on methodologies and approaches to analyze the system for security that leads to protect the system against external threats. An experimental setup of a virtual penetration testing environment lab is created on a system using virtualization software. By using of the most powerful tools and techniques used today, a successful penetration testing and vulnerability scanning through three phases of processes are implemented. Eventually, the results of this process will help identify potential vulnerabilities in the operating systems and ways to patch them up. Keywords: Cybersecurity, penetration testing, vulnerability scanning tools.

Detecting Brute Force Attacks on SSH and FTP Protocol Using Machine Learning: A Survey

The significance of detecting network traffic anomalies in cybersecurity cannot be overstated, especially given the increasing frequency and complexity of computer network attacks. As new Internet-related technologies emerge, so do more intricate attacks. One particularly daunting challenge is represented by dictionary-based brute-force attacks, which require effective real- time detection and mitigation methods. In this paper, we investigate Secure Shell or Secure Socket Shell, is a network protocol that gives users, particularly system administrators, a secure way to access a computer over an unsecured network(SSH)and File Transfer Protocol is a standard network protocol used for the transfer of files from one host to another over a TCP-based network, such as the Internet (FTP) brute-force attack detection by using Our research focuses on using the machine learning approach to detect SSH and FTP brute-force attacks. A reasonably thorough investigation of machine learners' efficacy in identifying brute force assaults on SSH and FTP is made possible by employing several classifiers. Brute-force assaults are a popular and risky method of obtaining usernames and passwords. Applying ethical hacking is an excellent technique to examine the effects of a brute-force assault. This article discusses many defense strategies and approaches to using brute-force assaults. The pros and cons of several defense strategies are enumerated, along with information on which kind of assault is easiest to identify. we made use of machine learning classifiers: Naive Bayes, Random Forest, Logistic Regression, we determined that the Random Forest algorithm achieved the highest level with an accuracy the contribution lies in demonstrating the feasibility of training and evaluating basic Random Forest models with two independent variables to classify CSE-CIC-IDS2018 dataset.

WORM-VIRUS DETECTION METHOD ACCORDING TO MULTI-CLASS CLASSIFICATION

The work presents the results of research on worm viruses and methods of their detection. Malware distribution happens all the time. The analyzed modern tools and systems for prevention, detection and countermeasures against malicious software and computer attacks are quite effective, provide a high percentage of detection and function at an adequate level. But criminals constantly study the capabilities of such tools and systems, improve malicious software and computer attacks, and achieve certain results. Therefore, developers of tools and systems for prevention, detection and countermeasures against malicious software and computer attacks must constantly improve them. The protection of corporate networks is relevant. They can be effectively configured to increase computing resources when solving the tasks of warning, detecting and countering malicious software and computer attacks to protect corporate networks. Therefore, the article defines as an urgent scientific task - the development of methods to improve the efficiency of the functioning of distributed systems with partial centralization for detection of malicious software and computer attacks in computer networks and detection of malicious software with their use due to the synthesis of their architecture in such a way that the principles of functioning of such systems make it difficult for criminals to understand them. The work considers a set of worm viruses, which covers network features as much as possible. Therefore, to study the effectiveness of methods of creating distributed systems and the systems themselves based on them, worm viruses were considered. The purpose of the work is to develop a method for detecting worm viruses in corporate networks. The work developed a method of detecting worm viruses using their division into classes based on common features and defined criteria according to the classification of objects according to many classes and taking into account its implementation in the architecture of partially centralized distributed systems to obtain a complete sensor and make a decision regarding the classification of worms virus to a certain class. This improved the reliability of detection by 8-11% compared to using the method without directly involving the elements and components of the system. As a result of setting up experiments and conducting them, results were obtained that confirm the correct functioning of a partially centralized distributed system for the detection of worm viruses.

Attributing digital covert action: the curious case of WikiSaudiLeaks

ABSTRACT How can digital covert action be attributed? This paper revisits one of the most complex, most significant, and most mysterious digital covert actions of our time: a 2015 hack-and-leak case known among investigators as ‘WikiSaudiLeaks’ that so far has evaded attribution. We argue that WikiSaudiLeaks was not a stand-alone event, but a puzzle piece in a larger covert action campaign that involved advanced computer network exploitation, computer network attack, persistent deception, and a creative influence and disinformation effort. By disintegrating the larger event into its components, limited attribution becomes possible. We present the most detailed and comprehensive investigation of this case to date, attribute at least one component of the larger event to Iranian intelligence, and draw conceptional conclusions.

Handling Labeled Data Insufficiency: Semi-supervised Learning with Self-Training Mixup Decision Tree for Classification of Network Attacking Traffic

Motivated by the fast advancements in artificial intelligence (AI) technologies, recent research has moved towards using machine learning and deep learning to detect and classify security attacks in computer networks. However, most prior works adopt supervised learning methods, and the performance heavily depends on the amount of labeled data used to train the detection models. Network attack detection and classification is not an exception due to the lack of labeled data, especially the attacking traffic, which is much less than the regular (legitimate) traffic. Yet, labeling network traffic is also challenging and requires specific domain expertise. This paper proposes an efficient semi-supervised learning method for the classification of network attacking traffic, known as Self-Training Mixup Decision Tree (STM-DT). STM-DT first trains a decision tree on a small amount of labeled data and then uses the obtained model to predict labels of unlabeled samples. Some noisy labels will be removed by consistency. The predicted samples will then be mixed with labeled samples using <monospace>mixup</monospace> to train a new decision tree, which is the final desired classifier. We evaluate STM-DT using four network traffic datasets. Experimental results demonstrate that the proposed STM-DT method achieves higher macro F1 scores over different minority labeled data percentages.

Integrating Novel Mechanisms for Threat Detection in Enhanced Data Classification using Ant Colony Optimization with Recurrent Neural Network

In new technologies like fog computing, edge computing, cloud computing, and the Internet of Things (IoT), cybersecurity concerns and cyber-attacks have surged. The demand for better threat detection and prevention systems has increased due to the present global uptick in phishing and computer network attacks. In order to identify irregularities and attacks on the network, which have increased in scale and prevalence, threat identification is essential. However, the community is forced to investigate and create novel threat detection approaches that are capable of detecting threats using anomalies due to the increase in network threats, the growth of new methods of attack and computations, and the requirement to ensure security measures. A novel mechanism is employed to identify threats in a data based on optimized deep learning. The main aim of this paper is the usage of data classification system based on Deep Learning (DL). The proposed mechanism employed the TCP (Transmission Control Protocol) communication protocol to extract data from loud IoT (Internet of Things) networks for the purpose of threat detection. To perform feature extraction an Ant Colony Optimization (ACO) is utilised, through Recurrent Neural Network (RNN), the attacks in data are classified and detected. Additionally, the suggested approach has been evaluated and trained using the BOUN DDoS contemporary dataset, which comprises a variety of attack types and allows for the effectiveness of the framework to be determined to compare it to previous approaches. The Findings indicate that the suggested approach achieved higher accuracy in DDoS attack identification in comparison with Traditional deep learning methods. The existing method detects the generic attack with lower efficiency however; the proposed mechanism achieves better accuracy in both the detection of the DDoS attack and the detection of regular traffic.

Computer detection intelligent mining algorithm for software defined networks

The network security (NS) issues of software defined network (SDN) are becoming increasingly prominent. Traditional computer detection (for convenience, computer detection is abbreviated to CD) methods are usually based on rules and features, and cannot cope with new threats and unknown attacks. The purpose of this article is to analyze a CD intelligent mining algorithm (for convenience, intelligent mining algorithm is abbreviated to IMA) suitable for SDNs, and to optimize and improve the data acquisition difficulty, large data volume, dynamism, timeliness, and security issues of SDNs. On the basis of data preprocessing on the KDD (Data Mining and Knowledge Discovery) Cup 1999 dataset, this article constructed an architecture for CD IMAs. In the data intelligence layer, a combination of k-means algorithm and XGBoost (eXtreme Gradient Boosting) algorithm was used for computer network attack detection based on stream classification. Based on the preprocessed dataset, the k-means algorithm and its combination were trained and simulated. The effectiveness and performance optimization of the CD IMA analyzed in this article were verified by comparing it with traditional computer attack detection algorithms in terms of detection accuracy, CPU (Central Processing Unit) occupancy, detection time, and false detection rate. The experimental results showed that the accuracy of the CD IMAs analyzed in this article was over 80 %, and some even reached over 90 %. However, the accuracy of traditional computer attack detection algorithms has not reached 90 %. The detection time of traditional computer attack detection algorithms was all above 2 s, but some of the detection time of the algorithm in this article was within 2 s. The detection rate of the algorithms analyzed in this article was above 90 %, and the detection results were more accurate than traditional algorithms. This proved that the algorithm analyzed in this article can more effectively select optimized feature subsets, has good flow classification ability, and has high detection accuracy for different types of attacks. The CD IMA for SDNs has great potential and application prospects.

Network Attack Detection Using Intrusion Detection System Utilizing Snort Based on Telegram

The constantly evolving of information technology landscape has made information security something of paramount importance, yet the development of information technology is not met with a corresponding advancement in its security systems. As a result, in the current era, there is a multitude of cybercrimes in the realm of the internet. Therefore, this research aims to create a computer network attack detector using the Linux operating system by leveraging the Telegram-based Snort application and employing the Intrusion Detection System (IDS) method through an IDS-based application, namely Snort. Additionally, this study incorporates features for blocking IP addresses and changing the Linux server password through the Telegram application for initial response when an attack is detected, accomplished by sending specific commands within the Telegram application. Furthermore, this paper also introduce a feature for categorizing the risk of computer network attacks into three categories: Low, Medium, and High within the Telegram application. The results of this research demonstrate that Snort can detect predefined rules and send alerts to the Telegram application for every attack occurring within the Wireless Local Area Network (WLAN). Successful IP address blocking is achieved through Telegram integration with the Iptables application, and changing the Linux server password is also accomplished through Telegram by integrating the bash shell programming language found in the Terminal of the Linux operating system. Finally, the risk of attacks can be viewed within the Telegram application.

The Optimization of the ARP Poisoning Attack Detection Model Using a Similar Approach Based on NetFlow Analysis

Information security and threats are a concern in the cyber era. Attacks can be malicious activities. One of them is known as ARP poisoning attack activity, which attacks by falsifying a computer's identity through illegal access to retrieve confidential information in a target computer. Besides, it has also caused service deadlocks in the network. Previous studies have been introduced for the ARP Attack Detection model using rule-based and mining-based. Still, they cannot show optimal detection performance and obtain high false positive results. This paper proposed a detection model for ARP poisoning attacks using a similarity measurement approach adopting cosine similarity. The goal is to obtain measurements of host activities similar to ARP poisoning attacks. The experiment results showed that the model got an accuracy of 97.25%, recall of 96.43%, and precision of 81% with a similarity threshold value of 0.488. Comparison results with previous studies showed higher detection accuracy than previous studies and some classification methods. It shows that the model can improve intrusion detection performance and facilitate network administrators to analyze ARP poisoning attacks in computer networks.&#x0D;

Machine Learning for APT Detection

Nowadays, countries face a multitude of electronic threats that have permeated almost all business sectors, be it private corporations or public institutions. Among these threats, advanced persistent threats (APTs) stand out as a well-known example. APTs are highly sophisticated and stealthy computer network attacks meticulously designed to gain unauthorized access and persist undetected threats within targeted networks for extended periods. They represent a formidable cybersecurity challenge for governments, corporations, and individuals alike. Recognizing the gravity of APTs as one of the most critical cybersecurity threats, this study aims to reach a deeper understanding of their nature and propose a multi-stage framework for automated APT detection leveraging time series data. Unlike previous models, the proposed approach has the capability to detect real-time attacks based on stored attack scenarios. This study conducts an extensive review of existing research, identifying its strengths, weaknesses, and opportunities for improvement. Furthermore, standardized techniques have been enhanced to enhance their effectiveness in detecting APT attacks. The learning process relies on datasets sourced from various channels, including journal logs, traceability audits, and systems monitoring statistics. Subsequently, an efficient APT detection and prevention system, known as the composition-based decision tree (CDT), has been developed to operate in complex environments. The obtained results demonstrate that the proposed approach consistently outperforms existing algorithms in terms of detection accuracy and effectiveess.

A Network Intrusion Detection Approach Using Extreme Gradient Boosting with Max-Depth Optimization and Feature Selection

Network intrusion detection system (NIDS) has become a vital tool to protect information anddetect attacks in computer networks. The performance of NIDSs can be evaluated by the numberof detected attacks and false alarm rates. Machine learning (ML) methods are commonly usedfor developing intrusion detection systems and combating the rapid evolution in the pattern ofattacks. Although there are several methods proposed in the state-of-the-art, the development ofthe most effective method is still of research interest and needs to be developed. In this paper,we develop an optimized approach using an extreme gradient boosting (XGB) classifier withcorrelation-based feature selection for accurate intrusion detection systems. We adopt the XGBclassifier in the proposed approach because it can bring down both variance and bias and hasseveral advantages such as parallelization, regularization, sparsity awareness hardware optimization,and tree pruning. The XGB uses the max-depth parameter as a specified criterion toprune the trees and improve the performance significantly. The proposed approach selects thebest value of the max-depth parameter through an exhaustive search optimization algorithm.We evaluate the approach on the UNSW-NB15 dataset that imitates the modern-day attacks ofnetwork traffic. The experimental results show the ability of the proposed approach to classifyingthe type of attacks and normal traffic with high accuracy results compared with the currentstate-of-the-art work on the same dataset with the same partitioning ratio of the test set.

Computation of persistent homology on streaming data using topological data summaries

AbstractPersistent homology is a computationally intensive and yet extremely powerful tool for Topological Data Analysis. Applying the tool on potentially infinite sequence of data objects is a challenging task. For this reason, persistent homology and data stream mining have long been two important but disjoint areas of data science. The first computational model, that was recently introduced to bridge the gap between the two areas, is useful for detecting steady or gradual changes in data streams, such as certain genomic modifications during the evolution of species. However, that model is not suitable for applications that encounter abrupt changes of extremely short duration. This paper presents another model for computing persistent homology on streaming data that addresses the shortcoming of the previous work. The model is validated on the important real‐world application of network anomaly detection. It is shown that in addition to detecting the occurrence of anomalies or attacks in computer networks, the proposed model is able to visually identify several types of traffic. Moreover, the model can accurately detect abrupt changes of extremely short as well as longer duration in the network traffic. These capabilities are not achievable by the previous model or by traditional data mining techniques.

Cloud Intrusion Detection System Based on SVM

The demand for better intrusion detection and prevention solutions has elevated due to the current global uptick in hacking and computer network attacks. The Intrusion Detection System (IDS) is essential for spotting network attacks and anomalies, which have increased in size and scope. A detection system has become an effective security method that monitors and investigates security in cloud computing. However, several existing methods have faced issues such as low classification accuracy, high false positive rates, and low true positive rates. To solve these problems, a detection system based on Support Vector Machine (SVM) is proposed in this paper. In this method, the SVM classifier is utilized for network data classification into normal and abnormal behaviors. The Cloud Intrusion Detection Dataset is used to test the effectiveness of the suggested system. The experimental results show which the suggested system can detect abnormal behaviors with high accuracy.

Intrusion detection algorithom based on transfer extreme learning machine

Intrusion detection can effectively detect malicious attacks in computer networks, which has always been a research hotspot in field of network security. At present, most of the existing intrusion detection methods are based on traditional machine learning algorithms. These methods need enough available intrusion detection training samples, training and test data meet the assumption of independent and identically distributed, at the same time have the disadvantages of low detection accuracy for small samples and new emerging attacks, slow speed of establishment model and high cost. To solve the above problems, this paper proposes an intrusion detection algorithm-TrELM based on transfer learning and extreme machine. TrELM is no longer limited by the assumptions of traditional machine learning. TrELM utilizes the idea of transfer learning to transfer a large number of historical intrusion detection samples related to target domain to target domain with a small number of intrusion detection samples. With the existing historical knowledge, quickly build a high-quality target learning model to effectively improve the detection effect and efficiency of small samples and new emerging intrusion detection behaviors. Experiments are carried out on NSL-KDD, KDD99 and ISCX2012 data sets. The experimental results show that the algorithm can improve the detection accuracy, especially for unknown and small samples.

An intrusion detection method to detect denial of service attacks using error-correcting output codes and adaptive neuro-fuzzy inference

ContextA wide range of network technologies and equipment used in network infrastructure are vulnerable to Denial of Service (DoS) attacks. Therefore, the identification of these attacks is of particular importance in security systems. ProblemMost of the previously presented solutions use a single machine learning model to detect DoS attacks; but it seems that improving the detection accuracy and reliability in the intrusion detection system will be possible by using the combination of learning models. ObjectivesThis research, is an effort to improve the accuracy of DoS attacks detection, compared to previous methods. Also, overcoming the challenge of large number of classes in intrusion detection task using ECOC based hybrid classifiers is one of the main objectives of the research. MethodsIn this paper, a novel method to detect DoS attacks in computer networks is proposed. The proposed method performs the intrusion detection process in three phases named as pre-processing, feature extraction and classification. Principal Component Analysis (PCA) is used for extracting features, while a combination of Error Correcting Output Codes (ECOC) and Adaptive Neuro-Fuzzy Inference System (ANFIS) is used for classification. In this classification model, Particle Swarm Optimization (PSO) algorithm has been used to optimize the structure of ANFIS. ResultsThe performance of the proposed method has been evaluated using the NSLKDD database. Using a 10-fold cross validation experiment, the proposed IDS showed a sensitivity of 99.82%. The results also show that the proposed method can detect the types of DoS attacks with an average accuracy of 98.9%, which shows a significant improvement compared to the previous methods.

Влияние проблемы многозначности меток классов системных журналов на защищенность компьютерных сетей

The security of information circulating in a computer network is related to the security of the supporting infrastructure. An important problem in the intelligent processing of syslog data is the existence of multi-label datasets. Among the Russian-language scientific publications, the problem under consideration in the context of information security of computer networks is not presented. Purpose: increase the security of computer networks by using multi-label learning methods when solving the problem of classifying system logs class labels. Results: A comparative analysis of single-valued and multi-label classifiers was carried out in a computational experiment on the Mean accuracy metric. A non-linear relationship was found between the proportion of experimental data sections containing multi-label class labels and the overall accuracy of data classification. Despite the fact that multilabel plots in the studied experimental data are only 3%, the gain in accuracy reaches 23% according to the specified metric. According to the results of the analysis, 80% of unambiguous classifiers were inferior in classification accuracy according to the Mean accuracy multi-label metric to their analogues, which may signal a strong influence of multi-label class labels on the models under consideration. It is shown that the considered structure of experimental data in a tabular form is affected by the multi-label problem much more strongly than it can be estimated by a standard frequency check, which actualizes further research in this direction. Practical relevance: The practical significance of the results obtained lies in increasing the security of computer networks through the use of a multi-label approach in the classification problem. The tasks of information security solved by multi-label classification may include: the area of monitoring, detection or prevention of violations and computer attacks in computer networks. Discussion: Since the predictive power of frequency testing of the influence of multi-label class label results on the classification results of unambiguous classifiers is low, further research on this topic is planned. It is planned to expand the list of classification quality assessment metrics in future experiments.

Combining a class-based classification method with ensemble boosting and sequential feature selection

The Binary Min-Redundancy Max-Diversity (BMRMD) was utilized to determine the computer network hacking and attacks. The Intrusion Detection System (IDS) is crucial for detecting attacks on an organization, which have increased in size and scale, as well as other anomalies. IDS achieves this by preparing for the unauthorized information related to network security and it is essential for distinguishing various types of attacks. The organization's traffic dataset contains numerous highlights, so selecting and eliminating irrelevant items improves the accuracy of the organization's calculations. Containing a large amount of meaningless or excessive data, a dataset can cause fitting problems and reduce the capacity of the model to learn meaningful patterns. BRMMD approach covers not only the significance of each element but also the expected accuracy when an ideal set of features is given. Solving such challenges requires a series of feature selection techniques. Therefore, the challenge is addressed by evaluating the repeatability of the features and determining their relevance to the target class based on the optimal grouping of the included features.

Detection of zero‐day attacks in computer networks using combined classification

SummaryIn today's world, many public and private services are provided virtually on the Internet. Due to the increasing dynamism and development of computer networks, intrusion detection systems, as one of the hottest topics in network security, has become an attractive area of research for researchers. The intrusion detection system tries to categorize the activity of the connections into two categories, normal and abnormal. In intrusion detection system, each connection is described based on a set of features, and decisions about whether that connection is normal or abnormal are made using those features. The act of determining the norm or abnormality of a connection is called classification. In this article, a method based on combined classification is proposed to detect zero‐day attacks. One of the most important innovations in this method is using a new version of the GRASP feature selection algorithm, which is used to diversify the base classifiers. In this method, an attempt is made to produce a subset of different features that have high accuracy; and variety to be used in the assembly stage. Experimental results showed that the method used to create feature subsets has high quality.