Cyber Intrusions Research Articles

ตัวแบบทำนายการบุกรุกทางไซเบอร์แบบอัตโนมัติด้วยการเรียนรู้เชิงลึก เพื่อรับมือกับภัยคุมคามทางไซเบอร์สำหรับกองทัพอากาศไทย

The Royal Thai Air Force was one of the nation’s Critical Information Infrastructure (CII) Organizations and has a record of cyber intrusions continue throughout the year. Therefore, researchers presented a new automated cyber intrusion prediction model using deep learning to resilient in cyber threat for the Royal Thai Air Force. It was an extension of the Looking Back Algorithm to increase the accuracy of the predictive model. In order to predict the future of the Air Force’s cyber threat patterns, researchers used cyber intrusion datasets from the Air Force that ranging from January 2021 to December 2021 with a total of 241,148 entries. We applied techniques such as RNN, LSTM, GRU, Bi-LSTM Deep Learning (DL). We developed the new cyber intrusion prediction model with name Bi-LSTM Looking Back Risk: Bi-LSTM-LBR. However, the developed model had high accurate result on test dataset that compared to other predictive models. In addition, prediction results had a Mean Absolute Error (MAE) was 0.038, a Mean Square Error (MSE) was 0.010 and a Root Mean Square Error (RMSE) was at 0.102.

A Federated Learning Framework for Enhanced Data Security and Cyber Intrusion Detection in Distributed Network of Underwater Drones

A Federated Learning Framework for Enhanced Data Security and Cyber Intrusion Detection in Distributed Network of Underwater Drones

Development of algorithms for early detection of cyberattacks on networks using machine learning

Critical infrastructure protection and national security are enhanced by the security and reliability of networks. Various types of information circulate on these networks, ranging in classification from open to closed. The consequences of cyberattacks on these networks can be severe, including reputational damage, financial loss, operational disruption and data leakage. Traditional security methods, such as firewalls and anti-virus software, are becoming less effective against modern and ever-changing cyber threats. As a result, powerful network intrusion detection systems (IDS) have become indispensable for proactive detection and mitigation of cyber attacks. Machine learning has become a viable method for creating adaptive intrusion detection tools that can detect new and complex attack patterns. By learning from huge labelled network traffic datasets, ML models can understand the subtle patterns and differentiating features of normal and abnormal or malicious traffic flows. This allows them to detect possible cyber threats and intrusions that traditional signature-based IDSs cannot detect. Extracting discriminative features and training appropriate classification models from such data is a challenging task. In the presented study, we analyse the effectiveness of ML algorithms for detecting cyberattacks, in particular distributed denial of service (DDoS) attacks, in network traffic data. In the presented study, a network attack detection system is developed using ML and deep learning (DL) models and experimented on the CICIDS2017 dataset. The main objectives of the study are to develop a strategy for extracting valuable information from raw network streams; to study the impact of data preparation on the false positive rate; and to conduct a comparative analysis of ML models for cyberattack detection. The main goal of the study is to provide an understanding of the development of a reliable adaptive network intrusion detection system using ML approaches that increase cybersecurity capabilities and protect against future cyberattacks.

Impact of AI on the Cyber Kill Chain: A Systematic Review

The Cyber Kill Chain (CKC) defense model aims to assist subject matter experts in planning, identifying, and executing against cyber intrusion activity, by outlining seven stages required for adversaries to execute an attack. Recent advancements in Artificial Intelligence (AI) have empowered adversaries to execute sophisticated attacks to exploit system vulnerabilities. As a result, it is essential to consider how AI-based tools change the cyber threat landscape and affects the current standard CKC model. Thus, this study examines and categorizes how attackers use AI-based tools and offers potential defense mechanisms. We conducted a systematic literature review of 62 papers published between 2013 and 2023 from the Web of Science and Google Scholar databases. Our findings indicate that AI-based tools are used most effectively in the initial stages of cyberattacks. However, we find that current defence tools are not designed to counter these sophisticated attacks during these stages. Thus, we provide insights to 1) highlight the changing threat landscape due to AI and 2) to guide the development of cyberdefense mechanisms.

A hybrid CNN-LSTM approach for intelligent cyber intrusion detection system

As the technology is advancing more and more in the era of increasing digitalization, safeguarding networks from cyber threats is crucial. As cyber-attacks on critical infrastructure are becoming more and more sophisticated, enhancing cyber intrusion detection systems (IDS) is imperative. This paper proposes and evaluates a deep learning-based IDS using the NSL-KDD dataset, a benchmark for intrusion detection. The system pre-processes data with Recursive Feature Elimination (RFE) and a Decision Tree classifier to identify the most significant features, optimizing model performance. Various deep learning models, including ANN, LSTM, BiLSTM, CNN-LSTM, GRU, and BiGRU, have been evaluated. The CNN-LSTM model outperformed the others, with 95 % accuracy, 0.89 recall, and 0.94 f1-score. These results prove the effectiveness of the proposed IDS in accurately distinguishing between malicious and benign network traffic. Future research can explore ensemble techniques like boosting or bagging to further enhance IDS performance.

Identification and prioritization of the challenges faced by vendor organizations in the shape of cyber security: A FUZZY‐AHP ‐based systematic approach

AbstractThe goal of this research study was to identify and prioritize the significant cybersecurity challenges that vendor firms encounter during software development. Using Systematic Literature Reviews (SLRs), 13 significant challenges were found, including “Security issues/Access of Cyberattacks”, “Lack of Right Knowledge”, “Cost Security Issues”, and “Lack of Confidentiality and Trust” among others. To address these concerns, a multifaceted strategy that prioritizes continuing education, training, and investment in cybersecurity measures, as well as cross‐industry cooperation and coordination with government entities, is required. These challenges were ranked using the Fuzzy Analytic Hierarchy Process (F‐AHP). We obtained the following results after applying the Fuzzy Analytic Hierarchy Process: CSC1 (Cyber Security Challenge‐1) “Security Issues/Access of Cyber Attacks”, CSC2 “Lack of Right Knowledge”, and CSC3 “Framework” are the top most critical cyber security challenges, with weightages of 0.1687, 0.1672, and 0.1194, respectively. This study lays the groundwork for future research and assists vendor organizations in addressing the cybersecurity concerns they face during software development. The study also emphasizes the significance of addressing cybersecurity during the software development process in order to avoid the financial and reputational losses associated with cyber intrusions.

A COMPREHENSIVE REVIEW OF ARTIFICIAL INTELLIGENCE APPLICATIONS IN ENHANCING CYBERSECURITY THREAT DETECTION AND RESPONSE MECHANISMS

This literature review explores the transformative impact of artificial intelligence (AI) on enhancing cybersecurity measures across various domains. The study systematically examines the integration of AI in Intrusion Detection Systems (IDS), malware detection, phishing detection, threat intelligence, network security, and endpoint protection. Key findings reveal that AI-driven techniques significantly outperform traditional methods, particularly in real-time threat detection, accuracy, and adaptive response capabilities. Network-based IDS benefit from supervised and unsupervised learning algorithms, improving the identification of malicious network traffic and novel attack patterns. In malware detection, AI-enhanced static and dynamic analysis methods surpass signature-based approaches by detecting previously unknown malware and complex behaviors. Phishing detection has seen substantial improvements with AI applications in email filtering and URL analysis, reducing phishing incidents despite challenges like false positives. AI's role in threat intelligence is critical, automating data analysis to uncover hidden threats and employing predictive analytics to anticipate and mitigate cyber attacks. AI techniques in network security and endpoint protection enhance real-time monitoring and authentication processes, providing robust defenses against cyber intrusions. Despite these advancements, challenges such as handling high data volumes and the need for continuous learning to adapt to emerging threats remain. This review underscores the significant advancements, practical implementations, and ongoing challenges of leveraging AI in cybersecurity, highlighting its potential to fortify digital defenses and address the complexities of contemporary cyber threats.

Information War - International Security Dilemma in the Modern World

In the modern world, in the field of international security, one of the important challenges is the information war. On the other hand, information is a universal and cheap weapon with a limitless scope and high efficiency. Therefore, it can be more dangerous than any conventional means of warfare. During its implementation, the attacking side achieves the desired outcome through the psychological manipulation of common beliefs. During the last ten years, the rate of disinformation has increased sharply. Also, propaganda, espionage, uncontrolled dissemination of state secrets and personal information, massive cyber-attacks and so on. Both states and terrorist organizations use such mechanisms. Today, the most functional means of information in this field are used by terrorist organizations, which often use social media to recruit so-called “Islamic Fighters” and lay out fundamentalism. Cooperation at the international and regional levels is important in fighting cybercrime and protecting critical information infrastructure. For this purpose, within the framework of the Council of Europe, the European Union, the United Nations, NATO, and other international organizations, it carries out active activities on cyber security topics. In addition, protecting against cyber intrusion, even on a small scale, is in the country’s national security interests, and it is crucial to involve each state in the proceeding discussion about information warfare.

Encrypted Chat Application

In today's cyber landscape, the protection of digital communication channels stands as a paramount concern. This abstract dissects the cyber resilience strategies underpinning the development of secure chat applications, with a particular focus on user interface design using Jetpack Compose and encryption integration leveraging Kotlin. The examination commences with an in-depth analysis of the cyber defence mechanisms ingrained within chat interfaces crafted through Jetpack Compose, the cutting-edge toolkit tailored for native Android UI construction. By meticulously adhering to Material Design principles, developers fortify chat interfaces against cyber intrusions, placing a premium on real-time messaging functionalities and multimedia integration to foster user engagement while deterring malicious exploitation.The abstract plunges into the cornerstone role of encryption in fortifying cybersecurity, spotlighting Kotlin's robust encryption capabilities. Through the adept utilization of Kotlin AES encryption algorithms, developers erect an impregnable bastion around user messages, guaranteeing both confidentiality and integrity. Synergizing encryption with Firebase Firestore for fortified data storage and Firebase Authentication for resilient user validation fortifies the application's cyber defense, thereby ensuring user data remains impervious to cyber threats. By amalgamating Jetpack Composes resilient UI design tools with Kotlin's encryption prowess, developers erect a formidable cybersecurity fortress around chat applications. This symbiotic alliance not only safeguards user privacy and data integrity but also reinforces communication channels against the relentless onslaught of cyber adversaries in the ever-evolving cyber landscape Key Words: Encryption Integration, Secure Chat Application, Cyber Resilience Strategies, Cyber Defense Mechanism.

Cyber Intrusion Exposed: Illuminating The Dark Pathways Of The Cyber Kill Chain In Administrative Control

Cyber Intrusion Exposed: Illuminating The Dark Pathways Of The Cyber Kill Chain In Administrative Control

Anomaly‐detection‐based learning for real‐time data processing in non‐intrusive load monitoring

AbstractA power system can be regarded as a cyber‐physical system with physical power networks and a cyber system based on increasing engagement with information communication technologies for smart grid functionalities for more efficient operations and control. Non‐intrusive load monitoring (NILM), an emerging smart‐grid technology, can be used to better understand the electricity usage profile and composition of smart meters using advanced data analysis algorithms. Although NILM enables various smart grid services, wider applications of NILM require addressing the challenges regarding cyber security and data privacy risks. Anomaly detection in appliance data is one of the most effective measures against potential cyber intrusions from a data perspective. This study proposes a framework of anomaly detection‐based learning algorithms to identify the anomalous periods of electricity loading data, which may be a subject for potential cyber‐attacks. Comparison studies with the hidden Markov model are performed to validate the proposed approaches. The simulation results show that these anomaly detection‐based learning algorithms work well and can precisely determine anomalous loading periods. Moreover, these trained models perform well on the testing dataset without prior knowledge of the data, providing the possibility of the real‐time assessment of power‐ loading states. The proposed framework can also be used to develop protective measures to ensure secure system operation and user data privacy.

Feature Extraction vs Fine-tuning for Cyber Intrusion Detection Model

This study investigates the effectiveness of feature extraction and fine-tuning approaches in developing robust cyber intrusion detection models using the Network-based Security Lab - KDD dataset (NSL-KDD). The role of cyber intrusion detection is pivotal in securing computer networks from unauthorized access and malicious activities. Feature extraction, involving methods such as PCA, LDA, and Autoencoders, aims to transform raw data into informative representations, while fine-tuning leverages pre-trained models for task-specific adaptation. The study follows a comprehensive research method encompassing data collection, preprocessing, model development, and experimental evaluation. Results indicate that LDA and Autoencoders excel in the feature extraction phase, demonstrating precision, high accuracy, F1-Score, and recall. However, fine-tuning a pre-trained Multilayer Perceptron model surpasses individual feature extraction methods, achieving superior performance across all metrics. The discussion emphasizes the complexity and flexibility of these approaches, with fine-tuned models showcasing higher adaptability. In conclusion, this study provides valuable insights into the comparative effectiveness of feature extraction and fine-tuning for cyber intrusion detection. The findings underscore the importance of leveraging pre-trained knowledge and adapting models to specific tasks, offering a foundation for further advancements in enhancing network security through advanced machine learning techniques.

Managing and Evaluating Data Integrity in machine Learning-Based Cyber Intrusion Detection

This study investigated the impact of data quality on the performance of intrusion detection systems. Experiments were conducted using intrusion datasets and machine learning models. The pre-trained models were less affected by data duplications and overlaps compared to classic ML models. Removing overlaps and duplicates from training data improved the pre-trained models' performance in most cases, but had adverse effects in datasets with highly similar sequences. The study also proposed a framework for model selection and data quality assurance for building high- quality intrusion detection systems. Additionally, we focus on optimizing nine hyperparameters within a 1D-CNN model, using two well-established evolutionary computation methods—genetic algorithm(GA) and particle swarm optimization(PSO).The performances of these methods are assessed using three majordatasets—UNSW-NB15,CIC- IDS2017, and NSL-KDD. The key performance metrics considered in this study include the accuracy, loss, precision, recall, and F1-score. The results demonstrate considerable improvements in all metrics across all datasets, for both GA- and PSO-optimized models, when compared to those of the original non optimized 1D-CNN model.

A Study on the Navigating Cybersecurity Challenges in the Digital-era

In today's era Navigating cybersecurity concerns is a top priority for individuals, corporations, and governments in today's digital landscape. This in-depth research explores the complex realm of cybersecurity, looking at the new dangers and the methods used to successfully counter them. The swift growth of digital technologies, encompassing cloud computing and the widespread use of Internet of Things devices, has greatly expanded the attack surface, revealing weaknesses that malevolent actors can promptly take advantage of. Gaining an understanding of these weaknesses is essential to creating strong defenses. The present study centers on pivotal components of cybersecurity strategy, commencing with the pivotal function of encryption in safeguarding confidential information. An essential layer of security is provided by encryption methods and protocols, which prevent unauthorized users from reading data. Furthermore, the application of multi-factor authentication is examined as a crucial security precaution. The security of digital assets is greatly increased by MFA, which requires users to submit several kinds of authentication, such as passwords, biometric information, or security tokens. The study also explores the significance of intrusion prevention systems and intrusion detection systems in preventing unwanted access. IDS keeps an eye on networks for unusual behavior or security policy violations and instantly notifies administrators of any hazards. people can learn how to spot and avoid social engineering scams. Organizations may greatly lower the chance of successful cyber intrusions by arming users with knowledge. Finally This report concludes by emphasizing how urgent it is to address cybersecurity issues in the digital age. A proactive, multi-layered protection plan is essential due to the increasing sophistication and pervasiveness of cyber threats.

A Review: Machine Learning Approaches for Zero-Day Attacks Recognition

Advancements and rapid technological developments in information age promoted computerization of day to day activities in all walks of life. As technology is growing rapidly, the cybercrime rate also increases both in number and complexity. Since a variety of attacks evolves regularly with complex patterns and varied signatures the task of securing cyberspace becomes more and more difficult and challenging. To minimize the impact of cybercrime through early detection of intrusions, network activity in terms of network traffic, is monitored in real-time thus accumulating huge data which is sometimes erroneous. Therefore, synergizing the concepts of cybersecurity and data analytics is essential to develop effective security algorithms for attack detection. Existing security measures like firewalls are no longer sufficient to deal with these emerging attacks. Because the firewall only checks the header of the data packet, it doesn't go through the details of the packet. Intrusion Detection Systems (IDSs) are the systems introduced as a second line of security after firewalls to handle cyber intrusions more efficiently. IDSs play a key role in protecting cyberspace by examining the entire details of the traffic packets to detect intrusions.

Induced alterations driven compromised structural properties in additively manufactured products

PurposeAdditive manufacturing also known as 3D printing is an evolving advanced manufacturing technology critical for the new era of complex machinery and operating systems. Manufacturing systems are increasingly faced with risk of attacks not only by traditional malicious actors such as hackers and cyber-criminals but also by some competitors and organizations engaged in corporate espionage. This paper aims to elaborate a plausible risk practice of designing and demonstrate a case study for the compromised-based malicious for polymer 3D printing system.Design/methodology/approachThis study assumes conditions when a machine was compromised and evaluates the effect of post compromised attack by studying its effects on tensile dog bone specimens as the printed object. The designed algorithm removed predetermined specific number of layers from the tensile samples. The samples were visually identical in terms of external physical dimensions even after removal of the layers. Samples were examined nondestructively for density. Additionally, destructive uniaxial tensile tests were carried out on the modified samples and compared to the unmodified sample as a control for various mechanical properties. It is worth noting that the current approach was adapted for illustrating the impact of cyber altercations on properties of additively produced parts in a quantitative manner. It concurrently pointed towards the vulnerabilities of advanced manufacturing systems and a need for designing robust mitigation/defense mechanism against the cyber altercations.FindingsDensity, Young’s modulus and maximum strength steadily decreased with an increase in the number of missing layers, whereas a no clear trend was observed in the case of % elongation. Post tensile test observations of the sample cross-sections confirmed the successful removal of the layers from the samples by the designed method. As a result, the current work presented a cyber-attack model and its quantitative implications on the mechanical properties of 3D printed objects.Originality/valueTo the best of the authors’ knowledge, this is the original work from the team. It is currently not under consideration for publication in any other avenue. The paper provides quantitative approach of realizing impact of cyber intrusions on deteriorated performance of additively manufactured products. It also enlists important intrusion mechanisms relevant to additive manufacturing.

Intrusion Detection using Network Traffic Profiling and Machine Learning for IoT

The proliferation of the Internet of Things (IoT) in various sectors, including healthcare, smart cities, and industrial automation, has significantly enhanced operational efficiency and service delivery. However, this widespread adoption has introduced new vulnerabilities, making IoT networks a prime target for cyberattacks. Traditional security mechanisms often fall short in protecting IoT devices due to their limited computational resources and the unique nature of IoT network traffic. This paper introduces a novel intrusion detection system (IDS) that leverages network traffic profiling and machine learning techniques tailored for the IoT ecosystem. By analyzing the behavioral patterns of network traffic, the proposed system can accurately identify malicious activities and potential threats in real-time, ensuring the integrity and confidentiality of IoT networks. The methodology encompasses data collection, feature extraction, model training, and evaluation stages, employing a combination of supervised and unsupervised machine learning algorithms to optimize detection accuracy. Experimental results, conducted on real-world IoT network datasets, demonstrate the effectiveness of our approach in detecting a wide range of cyber threats with high precision and recall rates. This research contributes to the cybersecurity domain by providing a scalable, efficient, and adaptive IDS framework that can be integrated into various IoT infrastructures to mitigate the risk of cyber intrusions.

IoT Guardian: A Novel Feature Discovery and Cooperative Game Theory Empowered Feature Selection with ML Model for IoT Threats & Attack Detection

Cyber intrusion attacks increasingly target the Internet of Things (IoT) ecosystem, exploiting vulnerable devices and networks. Malicious activities must be identified early to minimize damage and mitigate threats. Using actual benign and attack traffic from the CICIoT2023 dataset, this WORK aims to evaluate and benchmark machine-learning techniques for IoT intrusion detection. There are four main phases to the system. First, the CICIoT2023 dataset is refined to remove irrelevant features and clean up missing and duplicate data. The second phase employs statistical models and artificial intelligence to discover novel features. The most significant features are then selected in the third phase based on cooperative game theory. Using the original CICIoT2023 dataset and a dataset containing only novel features, we train and evaluate a variety of machine learning classifiers. On the original dataset, Random Forest achieved the highest accuracy of 99%. Still, with novel features, Random Forest's performance dropped only slightly (96%) while other models achieved significantly lower accuracy. As a whole, the work contributes substantial contributions to tailored feature engineering, feature selection, and rigorous benchmarking of IoT intrusion detection techniques. IoT networks and devices face continuously evolving threats, making it necessary to develop robust intrusion detection systems.

Cyber Security: Study on Attack, Threat, Vulnerability

Abstract: The main aim of this research is to examine the various aspects of cyber infrastructure, encompassing both hardware and software systems, networks, enterprise networks, intranets, and the occurrence of cyber intrusions. The paper intends to elucidate the significance of network intrusions and cyber-theft, along with delving into the factors contributing to the proliferation of cybercrime. Furthermore, it provides a comprehensive definition of cyber security and its role in addressing network intrusion and cyber theft, while also exploring the drivers behind the surge in cybercrime and their repercussions. The authors conclude by suggesting preventive measures and potential solutions to mitigate the risks associated with cyber attacks. They emphasize that while technological advancements can aid in minimizing the impact of cyber attacks, human behavior and psychological tendencies remain significant vulnerabilities. Despite this, the authors express optimism in reducing cyber attacks through investment in organizational education campaigns that address psychological susceptibilities.

Ensemble adaptive online machine learning in data stream: a case study in cyber intrusion detection system

Ensemble adaptive online machine learning in data stream: a case study in cyber intrusion detection system