Current Network Security Research Articles

Identification of Network Traffic Intrusion Using Decision Tree

Network technology plays an increasingly important role in all aspects of social life. The Internet has brought a new round of industrial revolution and industrial upgrading. The arrival of the “Internet” era is accompanied by a large‐scale increase in network applications and the number of netizens. At the same time, the number and severity of cyberattacks continue to increase. Therefore, intrusion detection systems (IDSs) have become an important part of the current network security infrastructure in various industries. Anomaly detection of network traffic data is an effective method for network protection. In order to better realize the detection of network traffic anomalies, several algorithms have been successfully applied. Most of them come from artificial intelligence (AI), but there is a general problem of excessive model execution processing time and low detection rates. And through a lot of research, it is found that most models do not pay enough attention to the data processing in the early stage. Therefore, in this paper, we optimize the data normalization process through a series of experiments and combine the PCA feature selection method to propose an optimized MaxAbs‐DT classifier model. To train and measure the performance of the model, we used the NSL‐KDD dataset, which is the benchmark dataset for most network anomaly detection models. The experimental results show that MaxAbs‐DT outperforms other existing models and validates the effectiveness of the method. In addition, its execution time is greatly reduced compared to many models.

An Efficient Intrusion Detection Method Based on Federated Transfer Learning and an Extreme Learning Machine with Privacy Preservation

Current network security is becoming increasingly important, and intrusion detection is an effective method to protect the network from malicious attacks. This study proposes an intrusion detection algorithm FLTrELM based on federated transfer learning and an extreme learning machine to improve the effect of intrusion detection, which implements data aggregation through federated learning and facilitates the construction of personalized transfer learning for all organizations. FLTrELM first builds a transfer extreme learning machine model to solve the problem of insufficient samples and probability adaptation, then uses the model to learn to protect data privacy without sharing training data under the federated learning mechanism, and finally obtains an intrusion detection model. Experiments on the NSL-KDD, KDD99, and ISCX2012 datasets verify that the proposed method can achieve better detection results and robust performance, especially for small samples and new intrusions, and protects data privacy.

Application Research of Data Encryption Technology in Computer Network Information Security

In order to ensure the rights and interests of computer users, a method of data encryption technology in computer network information security is proposed. According to the symmetric encryption AES algorithm, the ECC system has higher security, slower decoding speed, smaller storage space occupation, and lower bandwidth requirements. The experimental results show that the safety mode length can reach 5 : 1, 6 : 1, 10 : 1 or even 35 : 1. Conclusion. The use of a hybrid cryptosystem based on MD5, AES, and elliptic curve keys can effectively make up for various problems and loopholes encountered in data transmission in current network security, and improve the security of information transmission in today’s social network.

Gradient importance enhancement based feature fusion intrusion detection technique

In order to better deal with the current unstable network security situation and improve the accuracy and generalization ability of the intrusion detection model, this paper proposes a feature fusion technique based on gradient importance enhancement, which combines feature fusion and feature enhancement to increase the diversity of sample features, so that the model can focus more on the sample features related to classification, making the model more generalizable and improving the accuracy of the model. The final model was experimented on two datasets, NSL-KDD and CICIDS2017, and its accuracy reached 99.84% and 99.78%, respectively.

A Bayesian optimization-based LSTM model for DGA domain name identification approach

In recent years, with the rapid development and rise of mobile Internet, network security issues have also posed a great threat to people. Botnets are an important problem faced by current network security. DNS protocol-based botnets widely use domain generation algorithm (DGA), which can randomly change the domain name to hide itself, and therefore is very likely to threaten people’s network security. In this paper, we use the domain names of the top 1 million websites in the Alexa global ranking as white samples, and for the DGA sample data, we use the open data of 360netlab as black samples. The character sequence model is used for feature extraction, and the LSTM with Bayesian optimization neural network is used to optimize the hyperparameter combination, which finally makes the accuracy of the model above 97%, and the model has superior performance to compare with the conventional model, which can effectively improve the accuracy of DGA detection and recognition.

A Model of Network Security Situation Assessment Based on BPNN Optimized by SAA-SSA

In order to address the problems that the accuracy and convergence of current network security situation assessment models need to be improved, a model of network security situation assessment based on SAA-SSA-BPNN is proposed. Using the characteristics of sparrow search algorithm (SSA) optimized by simulated annealing algorithm (SAA) with good stability, fast convergence speed and is not easy to fall into local optimum to improve the BP neural network (BPNN), so as to find the best fitness individual, and obtain the optimal weight and threshold, then assign them to the BP neural network as the initial values. The preprocessed index data is input into the improved BP neural network model for training, and finally the threat degree of the network system is assessed based on the trained model. Comparative experimental results show that this assessment model has higher accuracy and faster convergence than other situation assessment models based on improved BP neural network.

The Construction Method of Computer Network Security Defense System Based on Multisource Big Data

This article proposes a computer network security defense system model based on multisource big data, which makes the security of computer networks more complete because of the shortage of current computer network security defense systems. The current network security situation is analyzed, and the problems faced in the field of network security are pointed out; then, multisource big data is introduced, and the characteristics of the multisource big data model are analyzed. This article proposes an information system network security model, which formally describes the relationship between network behavior among nodes, security threats, network attacks, and defense capability of security devices in an information system. After that, a network security defense system measurement scheme is constructed based on hierarchical analysis, and quantitative indicators of defense effectiveness are defined in two dimensions: risk severity of security threats and defense response actions of security devices, which enables quantitative evaluation of the security defense system, and then identifies omissions and defects of the network security defense system. A defense system measurement and optimization system is designed based on the proposed network security system measurement and optimization scheme. The application analysis of the project is combined with the actual scenarios. Through the evaluation and optimization of the security defense system in the natural methods, it is proved that the network security defense system evaluation and optimization scheme proposed in this article has reasonableness and effectiveness in the actual application.

A network security situation assessment model based on BP neural network optimized by D-S evidence theory

Abstract Traditional networks rely heavily on the distribution of expert experience when assessing complex network security situations, resulting in low assessment accuracy, which has been unable to adapt to the current network security needs of the big data era, and has unavoidable problems such as low efficiency and poor flexibility. In response to these problems, this paper proposes a network security situation assessment method based on D-S evidence theory to optimize neural networks. First establish the CS-BP neural network model, enhance the local search ability of the cuckoo algorithm through conjugate gradient calculation, and then introduce it into the BP neural network to improve the training convergence speed and overcome the local minimum problem; finally, in order to reduce the basic probability distribution (BPA) subjective impact, using DS evidence theory to optimize the CS-BP neural network, determine the degree of impact of each attack, and evaluate the value of the network security situation. The experimental results show that the network situation assessment model of CS-BP neural network optimized based on D-S evidence theory can effectively assess the network security situation in the environment of trusted equipment.

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

With an increase in the number and types of network attacks, traditional firewalls and data encryption methods can no longer meet the needs of current network security. As a result, intrusion detection systems have been proposed to deal with network threats. The current mainstream intrusion detection algorithms are aided with machine learning but have problems of low detection rates and the need for extensive feature engineering. To address the issue of low detection accuracy, this paper proposes a model for traffic anomaly detection named a deep learning model for network intrusion detection (DLNID), which combines an attention mechanism and the bidirectional long short-term memory (Bi-LSTM) network, first extracting sequence features of data traffic through a convolutional neural network (CNN) network, then reassigning the weights of each channel through the attention mechanism, and finally using Bi-LSTM to learn the network of sequence features. In intrusion detection public data sets, there are serious imbalance data generally. To address data imbalance issues, this paper employs the method of adaptive synthetic sampling (ADASYN) for sample expansion of minority class samples, to eventually form a relatively symmetric dataset, and uses a modified stacked autoencoder for data dimensionality reduction with the objective of enhancing information fusion. DLNID is an end-to-end model, so it does not need to undergo the process of manual feature extraction. After being tested on the public benchmark dataset on network intrusion detection NSL-KDD, experimental results show that the accuracy and F1 score of this model are better than those of other comparison methods, reaching 90.73% and 89.65%, respectively.

Dynamic Threat Weight of Network Security Communication Based on Multisource Data Analysis

While the internet brings convenience to people, there are also many security problems. This study mainly discusses network security communication and ideological security technology based on multisource data analysis. The situation awareness model based on dynamic threat weight is mainly composed of the fusion module, evaluation module, and prediction module. The situation fusion module is mainly based on the fusion algorithm of distance vector optimal classification to fuse multisource data. The situation assessment module is based on the situation assessment method based on a dynamic threat weight to quantitatively evaluate the situation value. The situation understanding part is the basis of situation awareness. Firstly, a large amount of original security data is merged at the data level to obtain a standardized dataset. Then, the relationship between the data is analyzed by the method of correlation analysis, and the security incident information and threat propagation network are obtained. The knowledge training module accurately feeds back the relevant parameters and data, and the knowledge training module adjusts the data accuracy according to the received data accuracy. The main function of the situation fusion module is to process the multisource data and use the fusion algorithm for data fusion. The situation assessment module uses the fused data combined with a specific method for comprehensive assessment and uses visualization technology to show the final results in front of the administrator, which is convenient for more efficient operation. Based on the data fusion module, the situation assessment module judges the current network security status, detects the assessment results through error checking, and feeds back to the knowledge training module. From the trend of the overall network situation, we can see that the probability of the overall network at 4 is the highest, followed by 5. This study makes an effective evaluation of the overall network security.

A novel hybrid-based approach of snort automatic rule generator and security event correlation (SARG-SEC).

The rapid advanced technological development alongside the Internet with its cutting-edge applications has positively impacted human society in many aspects. Nevertheless, it equally comes with the escalating privacy and critical cybersecurity concerns that can lead to catastrophic consequences, such as overwhelming the current network security frameworks. Consequently, both the industry and academia have been tirelessly harnessing various approaches to design, implement and deploy intrusion detection systems (IDSs) with event correlation frameworks to help mitigate some of these contemporary challenges. There are two common types of IDS: signature and anomaly-based IDS. Signature-based IDS, specifically, Snort works on the concepts of rules. However, the conventional way of creating Snort rules can be very costly and error-prone. Also, the massively generated alerts from heterogeneous anomaly-based IDSs is a significant research challenge yet to be addressed. Therefore, this paper proposed a novel Snort Automatic Rule Generator (SARG) that exploits the network packet contents to automatically generate efficient and reliable Snort rules with less human intervention. Furthermore, we evaluated the effectiveness and reliability of the generated Snort rules, which produced promising results. In addition, this paper proposed a novel Security Event Correlator (SEC) that effectively accepts raw events (alerts) without prior knowledge and produces a much more manageable set of alerts for easy analysis and interpretation. As a result, alleviating the massive false alarm rate (FAR) challenges of existing IDSs. Lastly, we have performed a series of experiments to test the proposed systems. It is evident from the experimental results that SARG-SEC has demonstrated impressive performance and could significantly mitigate the existing challenges of dealing with the vast generated alerts and the labor-intensive creation of Snort rules.

Research on Situational Awareness Technology of Industrial Control Network Based on Big Data

With the rapid advancement of national strategies such as "Internet+" and "Made in China 2025", industrial control systems have been widely used in various industries such as energy, municipalities, transportation, water conservancy and aerospace, etc. The security of industrial control networks is always affecting the lifeline of the national economy. Therefore, the security of industrial control networks has not been given enough attention, resulting in frequent industrial control network security incidents, which makes us realize the importance of creating an industrial control network situational awareness system that integrates assessment and prediction. In this paper, we study the situational awareness technology of industrial control network based on big data, and integrate situational extraction as the premise, situational assessment as the core, and situational prediction as the goal to comprehensively sense the situational awareness of industrial control network system. Firstly, we adopt two ways of industrial control network data collection in the situational extraction, one is the use of traffic mirroring bypass access to sensor-aware terminals, without affecting the original production services on the premise of network traffic data collection. The second is the use of WireShark tools to achieve industrial control network traffic packet collection and statistics of traffic packets per second, analysis of the current network state, build Hadoop big data platform to achieve offline data pre-processing and feature extraction, and build Flink and TensorFlow model for graph neural network model training and complete prediction. Secondly, we use a combination of hierarchical analysis and correlation analysis to evaluate the situation, and use the evaluation graph to show the current network security state. Thirdly, the situation prediction is done by training the graph neural network model offline. We use the Flink real-time computation engine to read the data of the industrial control network into the graph neural network model in real time, which is used to enhance the feature representation of each node and to predict the probability of anomaly occurrence of the industrial control network in the future period. Finally, the graph neural network model of this paper is compared with traditional neural networks and machine learning models, and the accuracy and false alarm rate indexes are used to demonstrate the high accuracy and robustness of this model.

APPLICATION OF FRACTAL NEURAL NETWORK IN NETWORK SECURITY SITUATION AWARENESS

The purposes are to accurately perceive the network security situations and predict the development trend and effectively defend against network attacks during the operation of the Internet. The Long Short-Term Memory (LSTM) network is adopted as the subject of the network security situation awareness and prediction model. Moreover, it is optimized by the Genetic Algorithm (GA) to improve its global search capability. Then, a Fractal Neural Network (FNN) is constructed in combination with fractal theory, which is utilized in network security situation awareness to avoid the exploding or vanishing gradient problems. The KDD CUP 99 standard dataset is applied to verify the performance of the proposed GA-LSTM FNN; results demonstrate that its accuracy of network security situation awareness can reach 90.22%. The experimental results confirm that using the fractal difference function as the activation function can deliver the gradient variation in a balanced and stable manner. Besides, it can improve the feasibility and effectiveness of the neural network structure for network security situation awareness and prediction. The FNN studied is of practical significance for assessing the current network security situation and predicting its evolution trend, providing a reference for protecting the operation of the Internet from network attacks.

Predicting User Susceptibility to Phishing Based on Multidimensional Features.

While antiphishing techniques have evolved over the years, phishing remains one of the most threatening attacks on current network security. This is because phishing exploits one of the weakest links in a network system—people. The purpose of this research is to predict the possible phishing victims. In this study, we propose the multidimensional phishing susceptibility prediction model (MPSPM) to implement the prediction of user phishing susceptibility. We constructed two types of emails: legitimate emails and phishing emails. We gathered 1105 volunteers to join our experiment by recruiting volunteers. We sent these emails to volunteers and collected their demographic, personality, knowledge experience, security behavior, and cognitive processes by means of a questionnaire. We then applied 7 supervised learning methods to classify these volunteers into two categories using multidimensional features: susceptible and nonsusceptible. The experimental results indicated that some machine learning methods have high accuracy in predicting user phishing susceptibility, with a maximum accuracy rate of 89.04%. We conclude our study with a discussion of our findings and their future implications.

CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution

Open-source cyber threat intelligence (OSCTI) is becoming more influential in obtaining current network security information. Most studies on cyber threat intelligence (CTI) focus on automating the extraction of threat entities from public sources that describe attack events. The cybersecurity knowledge graph aims to change the expression of threat knowledge so that security researchers can accurately and efficiently obtain various types of threat information for preliminary intelligent decisions. The attribution technology can not only assist security analysts in detecting advanced persistent threats, but can also identify the same threat from different attack events. Therefore, it is important to trace the attack threat actor. In this study, we used the knowledge graph technology, considered the latest research on cyber threat attack attribution, and thoroughly examined key related technologies and theories in the process of constructing and applying the advanced persistent threat (APT) knowledge graph from OSCTI. We designed a cybersecurity platform named CSKG4APT based on a knowledge graph. Inspired by the theory of ontology, we constructed CSKG4APT as an APT knowledge graph model based on real APT attack scenarios. We then designed an APT threat knowledge extraction algorithm for completing and updating the knowledge graph using deep learning and expert knowledge. Finally, we proposed a practical APT attack attribution method with attribution and countermeasures. CSKG4APT is not a passive defense method in traditional network confrontation but one that integrates a large amount of fragmented intelligence and can actively adjust its defense strategy. It lays the foundation for further dominance in network attack and defense.

Network Security Situation Assessment Based on Improved WOA-SVM

Network security situation assessment is an important means of understanding the current network security situation to provide a basis for taking security measures. To address the problem that the accuracy of existing network security situation assessment methods needs to be improved, this paper proposes a network security situation assessment method based on support vector machine (SVM) optimized by whale optimization algorithm (WOA) that is improved by adaptive weight (AW) combined with simulated annealing algorithm (SA). In this method, the SVM is embedded into the fitness function calculation of the improved WOA, and the global optimization characteristics of WOA are used to determine the optimal penalty parameter c and kernel function parameter g of the SVM. To solve the problem of the WOA being prone to falling into local extremum and slow convergence when solving large and complex data problems, an adaptive weight is used to adjust the whale position update coefficient, and a simulated annealing algorithm (SA) is used to increase random search factors to avoid falling into local extremum, so as to improve the global optimization ability. The experimental results show that this method is feasible, can assess the network security situation more accurately, and has better convergence than other assessment algorithms based on an improved SVM.

Brief Analysis of Security Protection Practice of Key Information Infrastructure in Communication Industry

To solve the problem how to effectively identify critical information infrastructure challenges that the communications industry, improve pertinence and effectiveness of the security and protection work, this paper reports the legislative background of critical information infrastructure protection at home and abroad and the status quo, on the communications industry key information infrastructure security framework are discussed in this paper, by adopting the method of analytic hierarchy process (AHP), by calculating the key, Through the calculation of the critical degree, the paper proposes how to accurately identify the critical information infrastructure in the communication industry. This research is the latest practical exploration of the security protection work method of the critical information infrastructure in the communication industry, and is the urgent need of the current communication network security situation in China. It is hoped to take the implementation of the Regulations on the Security protection of Critical Information Infrastructure as an opportunity to publicize and promote the research method, continuously strengthen the security protection of critical information infrastructure, realize the high-quality development of the communication industry, and better empower the economic and social development.

Optimization of Data Encryption Technology in Computer Network Communication

In recent years, computer network communication system has been widely used in many industrial fields, which brings great convenience to people’s daily life and work. Therefore, this paper describes and analyzes the current situation and characteristics of the application of data encryption technology in computer network communication security. This paper points out the common threats to the current network security, discusses the data encryption technology applied to the network communication security, including link encryption technology, node encryption technology and end-to-end encryption technology, and deeply analyzes the application of data encryption technology in the computer network communication security. The results show that the MSE value of data 1 is 42.453, that of data 2 is 87.324, and that of data 3 is 87.324674.

Security risk prevention and control deployment for 5G private industrial networks

In this paper, we investigate and analyze the network security risks faced by 5G private industrial networks. Based on current network security architecture and 3GPP requirements and considering the actual application of 5G private industrial networks, a comparative analysis is used to plan and design a private network security construction scheme. The network security construction model, network organization, and key processes of 5G private industrial networks at the current stage are investigated. In addition, the key direction for the next stage of construction is discussed.

Never trust, always verify: A multivocal literature review on current knowledge and research gaps of zero-trust

In response to weaknesses of current network security solutions, the zero-trust model follows the idea that no network – whether internal or external – is trustworthy. The concept of zero-trust is enjoying increasing attention in both research and practice due to its promise to fulfil complex new network security requirements. Despite zero-trust's advantages over traditional solutions, it has not yet succeeded in replacing existing approaches. Uncertainty remains regarding the concept's distinct benefits and drawbacks for organisations and individuals, which hinders a holistic understanding of zero-trust and wide-spread adoption. Research can make valuable contributions to the field by systematically providing new insights into zero-trust. To support researchers in this endeavour, we aim to consolidate the current state of the knowledge about zero-trust and to identify gaps in the literature. Thus, we conduct a multivocal literature review, analysing both academic and practice-oriented publications. We develop a research framework for zero-trust to structure the identified literature and to highlight future research avenues. Our results show that the academic literature has focused mainly on the architecture and performance improvements of zero-trust. In contrast, the practice-oriented literature has focused on organisational advantages of zero-trust and on potential migration strategies. However, economic analyses and user-related studies have been neglected by both academia and practice. Future research may rely on our findings to advance the field in meaningful ways.