Prediction Of Cyber-attacks Research Articles

Review of Intrusion Detection System for Prediction of Cyber Attacks using AI Techniques

Review of Intrusion Detection System for Prediction of Cyber Attacks using AI Techniques

Prediction of cyber-attacks in air transport using neural networks

This article addresses the topic of cyber-attacks in air transport, which is crucial for ensuring the safety and reliability of airports and air transport operations. The aim of the article was to present a new method for predicting cyber-attacks in air transport based on neural networks. The task of the neural network was to determine the multiple regression function based on which the probability of a cyberattack occurring at a specified hour and on a specific day of the week is predicted. The probability, depending on the time of the cyberattack occurrence, was determined using theoretical distributions. The method was verified with real data. Verification of the method confirmed its high effectiveness, determined at the level of 92%. The study examined the effectiveness of using the classical multiple regression method in predicting cyber-attacks in air transport. The classical multiple regression model covered only 0.14 of the input data, while the regression model generated by the neural network covered 0.99, indicating the high efficiency of the developed neural network.

CL-AP[formula omitted]: A composite learning approach to attack prediction via attack portraying

The capabilities of accurate prediction of cyberattacks have long been desired as detection methods cannot avoid the damages caused by occurrences of cyberattack. Attack prediction still remains an open issue especially to specify the upcoming steps of an attack with the quickly evolving intelligent techniques at the attackers’ side. This study proposes a composite learning approach (namely CL-AP2), which fulfills this task in two phases of “attack portraying” and “attack prediction”: (1) (Attack Portraying) CL-AP2 generates a Temporal Attack Knowledge Graph (TAKG) from real-time system logs providing full knowledge that formulates time-aware entities related to attacks and the relations amongst them; Over the TAKG, a Tactic-based Cyber Kill Chain (TCKC) model highlights the attacker’s portrait via evaluation of behaviors in the past, i.e., presenting the tactical path and attack steps taken by the attacker; (2) (Attack Prediction) The Soft Actor–Critic algorithm applies to identify the most possible attack trajectory confined in the attack portrait; The transformer model finally derives the specific attack technique to be taken next.Experiments have been performed versus the state-of-the-art counterparts over a public dataset and results indicate that: (1) CL-AP2 can effectively reveal the tactical path taken by the attacker and form a complete portrait of the attack; and (2) CL-AP2 excels in predicting attack techniques to be taken by attackers and providing the defense guidance against the predicted attacks.

Transforming Cybersecurity into Critical Energy Infrastructure: A Study on the Effectiveness of Artificial Intelligence

This work explores the integration and effectiveness of artificial intelligence in improving the security of critical energy infrastructure, highlighting its potential to transform cybersecurity practices in the sector. The ability of artificial intelligence solutions to detect and respond to cyber threats in critical energy infrastructure environments was evaluated through a methodology that combines empirical analysis and artificial intelligence modeling. The results indicate a significant increase in the threat detection rate, reaching 98%, and a reduction in incident response time by more than 70%, demonstrating the effectiveness of artificial intelligence in identifying and mitigating cyber risks quickly and accurately. In addition, implementing machine learning algorithms has allowed for the early prediction of failures and cyber-attacks, significantly improving proactivity and security management in energy infrastructure. This study highlights the importance of integrating artificial intelligence into energy infrastructure security strategies, proposing a paradigmatic change in cybersecurity management that increases operational efficiency and strengthens the resilience and sustainability of the energy sector against cyber threats.

Review of AI and machine learning applications to predict and Thwart cyber-attacks in real-time

The contemporary cybersecurity landscape demands innovative solutions to combat the relentless evolution of cyber threats. Traditional approaches are facing unprecedented challenges, compelling a paradigm shift towards the integration of Artificial Intelligence (AI) and Machine Learning (ML). This paper meticulously explores the potential of AI and ML to fortify real-time cybersecurity, with a focus on the swift prediction and mitigation of cyber-attacks. Against the backdrop of an escalating threat landscape, this paper propels the inquiry into advanced technologies to fortify cybersecurity. The limitations of traditional methodologies underscore the urgency of investigating the efficacy of AI and ML in reinforcing defense mechanisms. This paper endeavors to comprehensively investigate the role of AI and ML in real-time cybersecurity. It places a distinct emphasis on their potential to predict and thwart cyber-attacks promptly. The exploration encompasses diverse dimensions, ranging from the intricacies of model complexity to crucial considerations in security, ethics, and emerging trends. Structured around a robust framework, the exploration encompasses comprehensive research directions. These include the imperative to enhance explainability, address vulnerabilities to adversarial attacks, foster collaboration between humans and AI, and develop quantum-resistant cryptographic solutions. The paper navigates through the intricate technical, organizational, and ethical dimensions inherent in the implementation of AI and ML in real-time cybersecurity. The findings of this exploration illuminate both the promises and challenges associated with the integration of AI and ML in cybersecurity. Ethical considerations, vulnerabilities to adversarial attacks, and the exigency for quantum-resistant cryptography emerge as critical areas necessitating nuanced attention and exploration. This paper envisions a future where the fusion of human expertise with the capabilities of AI and ML results in the creation of resilient and adaptive cybersecurity ecosystems. The delineated research directions serve not only as a comprehensive roadmap for ongoing innovation but also as a foundational guide to effectively integrate AI and ML in safeguarding our digital realm against the ever-evolving landscape of cyber threats.

Cloud‐based deep learning architecture for DDoS cyber attack prediction

AbstractConventional methodologies employed in detecting distributed denial‐of‐service attacks have frequently struggled to adapt to the dynamic and multi‐faceted evolution of such threats. Furthermore, many of the contemporary detection and prevention solutions, while innovative, remain anchored to dedicated workstations, lacking the flexibility and scalability required in today's digital landscape. To bridge this technological chasm, this research introduces a state‐of‐the‐art intrusion detection system firmly rooted in advanced Deep Learning techniques. By leveraging the expansive and adaptable nature of cloud‐centric, service‐oriented architectures, we not only bolster detection precision but also offer a solution designed for modern infrastructures. This system provides enterprises with a robust, easily deployable tool that is both versatile in its application and proactive in its defence approach, ensuring that networks remain resilient against the continuously evolving spectrum of cyber threats.

Hidden Markov Model Based Cyberattack Prediction in Power Systems

Hidden Markov Model Based Cyberattack Prediction in Power Systems

Next-generation cyber attack prediction for IoT systems: leveraging multi-class SVM and optimized CHAID decision tree

Billions of gadgets are already online, making the IoT an essential aspect of daily life. However, the interconnected nature of IoT devices also leaves them open to cyber threats. The quantity and sophistication of cyber assaults aimed against Internet of Things (IoT) systems have skyrocketed in recent years. This paper proposes a next-generation cyber attack prediction framework for IoT systems. The framework uses the multi-class support vector machine (SVM) and the improved CHAID decision tree machine learning methods. IoT traffic is classified using a multi-class support vector machine to identify various types of attacks. The SVM model is then optimized with the help of the CHAID decision tree, which prioritizes the attributes most relevant to the categorization of attacks. The proposed framework was evaluated on a real-world dataset of IoT traffic. The findings demonstrate the framework's ability to categorize attacks accurately. The framework may determine which attributes are most crucial for attack categorization to enhance the SVM model's precision. The proposed technique focuses on network traffic characteristics that can be signs of cybersecurity threats on IoT networks and affected Network nodes. Selected feature vectors were also created utilizing the elements acquired on every IoT console. The evaluation results on the Multistep Cyber-Attack Dataset (MSCAD) show that the proposed CHAID decision tree can significantly predict the multi-stage cyber attack with 99.72% accuracy. Such accurate prediction is essential in managing cyber attacks in real-time communication. Because of its efficiency and scalability, the model may be used to forecast cyber attacks in real time, even in massive IoT installations. Because of its computing efficiency, it can make accurate predictions rapidly, allowing for prompt detection and action. By locating possible entry points for attacks and mitigating them, the framework helps strengthen the safety of IoT systems.

Optimizing intrusion detection in industrial cyber-physical systems through transfer learning approaches

Applications of Cyber-Physical Systems (CPSs) greatly influenceseveral industrial sectors. Treating security-related concerns with utmost seriousness is necessary for the CPS to work correctly. Although CPS supervises the manufacturing process, the type and volume of cyberattacks that try to obtain data from CPS are significantly increasing. Since attacks on CPS can disrupt production, cause financial losses, and endanger national security, they must be prevented and detected. The general operation of the physical process can nevertheless be affected, and system failure is caused by specific traditional measures designed to anticipate CPS cyber-attacks. Also, as the system appears to be extremely complicated and no pertinent information about the item under investigation is available, the productive prediction of cyber-attacks in CPS remains a complex problem. This work will handle these issues using the proposed framework using Transfer Learning with the VGG16 model. The proposed TL-VGG16 achieves 96% accuracy, higher than existing CPS intrusion detection techniques.

Intrusion Detection Prediction Using Data Science Technique

Abstract: Intrusion Detection Systems are designed to safeguard the security needs of enterprise networks against cyber-attacks. However, networks suffer from several limitations, such as generating a high volume of low-quality alerts. The study has reviewed the state-of-the-art cyber-attack prediction based on Intrusion Alert, its models, and limitations. The ever-increasing frequency and intensity of intrusion attacks on computer networks worldwide intense research efforts towards the design of attack detection and prediction mechanisms. While there are a variety of intrusion detection solutions available, the prediction of network intrusion events is still under active investigation. Over the past, statistical methods have dominated the design of attack prediction methods. The analysis of dataset by supervised machine learning technique(SMLT) to capture several information’s like, variable identification, univariate analysis, bivariate and multivariate analysis, missing value treatments etc. A comparative study between machine learning algorithms had been carried out in order to determine which algorithm is the most accurate in predicting the type cyber attacks. The results show that the effectiveness of the proposed machine learning algorithm technique can be compared with best accuracy, precision, Recall, F1 Score,Sensitivity, and Specificity.

Analysing Cyber Threats: A Comprehensive Literature Review on Data-Driven Approaches

This literature review paper aims to examine and analyze the existing research on prediction models for different types of cyber-attacks. Four key research papers have been selected as the base for this review: "A Prediction Model of DoS Attack's Distribution Discrete Probability," "Apriori Viterbi Model for Prior Detection of Socio-Technical Attacks," "Cyber Attacks Prediction Model Based on Bayesian Network," and "Applying Data Science to Cybersecurity Network Attacks & Events.” An overview of the value of prediction models in cybersecurity and their function in reducing potential threats come first in the review. The methodology section outlines the search strategy used to identify relevant literature and the selection criteria for the base papers. The subsequent sections provide an overview of the field, highlighting the historical development and key theories or frameworks related to cyber-attack prediction. The themes or subtopics identified in the literature are discussed, focusing on the discrete probability distribution model of DoS attacks, the Apriori Viterbi model for detecting socio-technical attacks, the Bayesian network-based prediction model, and the application of data science in analyzing network attacks and events. The review critically evaluates the selected papers, analyzing their methodologies, findings, and limitations. It identifies gaps, controversies, and conflicting findings in the literature, paving the way for further research in the field. The synthesis and interpretation section integrates the findings from the different studies, compares various perspectives, and discusses the implications and significance of the literature for cyber-attack prediction. In conclusion, this literature review paper provides a comprehensive analysis of prediction models for cyber-attacks, based on the selected base papers. It highlights the strengths and weaknesses of existing approaches, identifies research gaps, and offers recommendations for future studies. This review contributes to the advancement of knowledge in the field of cybersecurity and aids in the development of more effective prediction models to combat evolving cyber threats.

A holistic and proactive approach to forecasting cyber threats

Traditionally, cyber-attack detection relies on reactive, assistive techniques, where pattern-matching algorithms help human experts to scan system logs and network traffic for known virus or malware signatures. Recent research has introduced effective Machine Learning (ML) models for cyber-attack detection, promising to automate the task of detecting, tracking and blocking malware and intruders. Much less effort has been devoted to cyber-attack prediction, especially beyond the short-term time scale of hours and days. Approaches that can forecast attacks likely to happen in the longer term are desirable, as this gives defenders more time to develop and share defensive actions and tools. Today, long-term predictions of attack waves are mostly based on the subjective perceptiveness of experienced human experts, which can be impaired by the scarcity of cyber-security expertise. This paper introduces a novel ML-based approach that leverages unstructured big data and logs to forecast the trend of cyber-attacks at a large scale, years in advance. To this end, we put forward a framework that utilises a monthly dataset of major cyber incidents in 36 countries over the past 11 years, with new features extracted from three major categories of big data sources, namely the scientific research literature, news, blogs, and tweets. Our framework not only identifies future attack trends in an automated fashion, but also generates a threat cycle that drills down into five key phases that constitute the life cycle of all 42 known cyber threats.

Extremely boosted neural network for more accurate multi-stage Cyber attack prediction in cloud computing environment

There is an increase in cyberattacks directed at the network behind firewalls. An all-inclusive approach is proposed in this assessment to deal with the problem of identifying new, complicated threats and the appropriate countermeasures. In particular, zero-day attacks and multi-step assaults, which are made up of a number of different phases, some malicious and others benign, illustrate this problem well. In this paper, we propose a highly Boosted Neural Network to detect the multi-stageattack scenario. This paper demonstrated the results of executing various machine learning algorithms and proposed an enormously boosted neural network. The accuracy level achieved in the prediction of multi-stage cyber attacks is 94.09% (Quest Model), 97.29% (Bayesian Network), and 99.09% (Neural Network). The evaluation results of the Multi-Step Cyber-Attack Dataset (MSCAD) show that the proposed Extremely Boosted Neural Network can predict the multi-stage cyber attack with 99.72% accuracy. Such accurate prediction plays a vital role in managing cyber attacks in real-time communication.

Detection of Malicious Cloud Bandwidth Consumption in Cloud Computing Using Machine Learning Techniques.

The Internet of Things, sometimes known as IoT, is a relatively new kind of Internet connectivity that connects physical objects to the Internet in a way that was not possible in the past. The Internet of Things is another name for this concept (IoT). The Internet of Things has a larger attack surface as a result of its hyperconnectivity and heterogeneity, both of which are characteristics of the IoT. In addition, since the Internet of Things devices are deployed in managed and uncontrolled contexts, it is conceivable for malicious actors to build new attacks that target these devices. As a result, the Internet of Things (IoT) requires self-protection security systems that are able to autonomously interpret attacks in IoT traffic and efficiently handle the attack scenario by triggering appropriate reactions at a pace that is faster than what is currently available. In order to fulfill this requirement, fog computing must be utilised. This type of computing has the capability of integrating an intelligent self-protection mechanism into the distributed fog nodes. This allows the IoT application to be protected with the least amount of human intervention while also allowing for faster management of attack scenarios. Implementing a self-protection mechanism at malicious fog nodes is the primary objective of this research work. This mechanism should be able to detect and predict known attacks based on predefined attack patterns, as well as predict novel attacks based on no predefined attack patterns, and then choose the most appropriate response to neutralise the identified attack. In the environment of the IoT, a distributed Gaussian process regression is used at fog nodes to anticipate attack patterns that have not been established in the past. This allows for the prediction of new cyberattacks in the environment. It predicts attacks in an uncertain IoT setting at a speedier rate and with greater precision than prior techniques. It is able to effectively anticipate both low-rate and high-rate assaults in a more timely manner within the dispersed fog nodes, which enables it to mount a more accurate defence. In conclusion, a fog computing-based self-protection system is developed to choose the most appropriate reaction using fuzzy logic for detected or anticipated assaults using the suggested detection and prediction mechanisms. This is accomplished by utilising a self-protection system that is based on the development of a self-protection system that utilises the suggested detection and prediction mechanisms. The findings of the experimental investigation indicate that the proposed system identifies threats, lowers bandwidth usage, and thwarts assaults at a rate that is twenty-five percent faster than the cloud-based system implementation.

Design of a Bottleneck Layered DNN Algorithm for Intrusion Detection System

Deep learning algorithms are very effective in the application of classification and prediction over the traditional estimators. The proposed work employs a bottleneck layer algorithm on CICIDS-2017 dataset to prove its efficacy on the prediction of cyber-attacks. The performance of the bottleneck model architecture is incorporated with Artificial Neural Network (ANN) and Deep Neural Network (DNN) models and compared over the traditional ANN, DNN and Support Vector Machines (SVM) models. The experimental work reaches a maximum accuracy of 92.35% in the DNN and 90.98% in ANN algorithm respectively.

Cyber Attacks Prediction using Data Science

Cyber-attack, via cyberspace, targeting an enterprise's use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information. The state of the cyberspace portends uncertainty for the future Internet and its accelerated number of users. New paradigms add more concerns with big data collected through device sensors divulging large amounts of information, which can be used for targeted attacks. Though a plethora of extant approaches, models and algorithms have provided the basis for cyber-attack predictions, there is the need to consider new models and algorithms, which are based on data representations other than task-specific techniques. However, its non-linear information processing architecture can be adapted towards learning the different data representations of network traffic to classify type of network attack. In this paper, we model cyber-attack prediction as a classification problem, Networking sectors have to predict the type of Network attack from given dataset using machine learning techniques. The analysis of dataset by supervised machine learning technique(SMLT) to capture several information’s like, variable identification, uni- variate analysis, bi-variate and multi-variate analysis, missing value treatments etc. A comparative study between machine learning algorithms had been carried out in order to determine which algorithm is the most accurate International Journal of Scientific Research in Engineering and Management (IJSREM) Volume: 06 Issue: 03 | March - 2022 ISSN: 2582-3930 © 2022, IJSREM | www.ijsrem.com DOI: 10.55041/IJSREM11906 | Page 2 in predicting the type cyber Attacks. We classify four types of attacks are DOS Attack, R2L Attack, U2R Attack, Probe attack. The results show that the effectiveness of the proposed machine learning algorithm technique can be compared with best accuracy with entropy calculation, precision, Recall, F1 Score, Sensitivity, Specificity and Entropy. Keywords Cyber-attack, Cyberspace, DOS Attack, R2L Attack, U2R Attack, Probe attack

Cyber-Attack Prediction Based on Network Intrusion Detection Systems for Alert Correlation Techniques: A Survey.

Network Intrusion Detection Systems (NIDS) are designed to safeguard the security needs of enterprise networks against cyber-attacks. However, NIDS networks suffer from several limitations, such as generating a high volume of low-quality alerts. Moreover, 99% of the alerts produced by NIDSs are false positives. As well, the prediction of future actions of an attacker is one of the most important goals here. The study has reviewed the state-of-the-art cyber-attack prediction based on NIDS Intrusion Alert, its models, and limitations. The taxonomy of intrusion alert correlation (AC) is introduced, which includes similarity-based, statistical-based, knowledge-based, and hybrid-based approaches. Moreover, the classification of alert correlation components was also introduced. Alert Correlation Datasets and future research directions are highlighted. The AC receives raw alerts to identify the association between different alerts, linking each alert to its related contextual information and predicting a forthcoming alert/attack. It provides a timely, concise, and high-level view of the network security situation. This review can serve as a benchmark for researchers and industries for Network Intrusion Detection Systems’ future progress and development.

Prediction of dynamics of suspicious network activity based on network traffic analysis

The article considers the possibility of early prediction of cyberattacks based on the analysis of suspicious activity in the network, which will provide additional opportunities for information protection services in countering such attacks. A feature of a slow DDoS attack is the use of a vulnerability in the TCP protocol, where interruptions can be caused intentionally or unintentionally as a result of delays in the communication channel. It is well known that detection of slow DDoS attacks is significantly different from volume-based attacks, as slow attacks do not increase network traffic. The general problem is to detect the start time of such an attack, since traffic parameters do not change dramatically. An assumption is made about the dependence of the slow attack on the user’s behavior. Using machine learning methods based on the analysis of similar situations in the past, it is possible to create an integrated system for transforming large volumes of publicly available data to predict the behavior of attackers in the network. A method of detecting such attacks based on research and prediction of suspicious user activity is proposed. The possibilities of using this method have been proven on the basis of modeling RUDY attacks on HTTP services. The characteristics of forecasting accuracy depending on the accumulated traffic and attack statistics are given. It is concluded that this method can be used to detect different types of slow DDoS attacks. Predicting suspicious traffic provides a solution to the problem of detecting slow DDoS attacks based on an algorithm for finding unknown future values for a time series of traffic parameters. The proposed method combines the advantages of artificial intelligence and statistical analysis and is capable of self-learning in case of replenishment of attack statistics. This approach allows you to accurately determine the random process at the control points and ensure a minimum of the mean square error of approximation in the intervals between these points.

A Novel Cyber-attack Leads Prediction System using Cascaded R2CNN Model

Novel prediction systems are required in almost all internet-connected platforms to safeguard the user information to get hacked by intermediate peoples. Finding the real impacted factors associated with the Cyber-attack probes are being considered for research. The proposed methodology is derived from various literature studies that motivated to find the unique prediction model that shows improved accuracy and performance. The proposed model is represented as R2CNN that acts as the cascaded combination of Gradient boosted regression detector with recurrent convolution neural network for pattern prediction. The given input data is the collection of various applications engaged with the wireless sensor nodes in a smart city. Each user connected with a certain number of applications that access the authorization of the device owner. The dataset comprises device information, the number of connectivity, device type, simulation time, connectivity duration, etc. The proposed R2CNN extracts the features of the dataset and forms a feature mapping that related to the parameter being focused on. The features are tested for correlation with the trained dataset and evaluate the early prediction of Cyber-attacks in the massive connected IoT devices.

Determining the Probability of Cyberattacks

Abstract The use of information is inextricably linked with its security. The presence of vulnerabilities enables a third party to breach the security of information. Threat modeling helps to identify those infrastructures, which would be most likely exposed to cyberattacks. In some cases, however, threat modeling can not be classified as sufficient method of protection. This paper entitled “Determining the probability of cyberattacks” presents an analysis of different techniques with an attempt to identify the most informative parameters and cyberattack prediction markers, which would lay the foundation for the development of cyberattack probability functions. Next, it would be relevant to design such cyberattack probability functions, which would be used upon the initial identification of a cyberattack. The findings of this research could be applied during the future assessment of risk levels of information systems to ensure more effective information security management.