Network Intrusion Research Articles

Mobile apps for health surveillance: Balancing public health needs with the privacy of personal data

The privacy of personal information is aimed at protecting human rights both under the international human rights regime and the Saudi Arabian constitution and other statutes and regulations, subject only to some exceptions that include the protection of public health. The coronavirus disease 2019 (COVID-19) pandemic has brought about certain challenges that necessitate strategies to augment the conventional surveillance of infectious diseases, contact tracing, isolation, reporting and vaccination. Several governments institutions, and agencies presently adopt mobile applications for collecting, analyzing, managing, and sharing critical personal data of individuals infected with or exposed to COVID-19. While the benefits of sharing private information for achieving public health needs may not be disputed, the risk of breach of personal privacy is enormous. This had forced the national governments into a dilemma of either succumbing to public health needs, strictly respecting and protecting the privacy of individuals, or alternatively, balancing the two conflicting demands. There is a massive body of literature on the security and privacy of such mobile applications, but none has adequately explored and discussed public interest justifications under Saudi Arabian laws for alleged privacy breaches. We examined the health surveillance mobile app technologies currently in use in Saudi Arabia with the aim of determining the potential risks of data breaches under extant data protection laws. The paper recommends, among others, that any potential risk of breach to right to privacy of personal information under the law must be (justified by) the public health needs to protect society during the COVID-19 pandemic.

A Hierarchical Machine Learning Method for Detection and Visualization of Network Intrusions from Big Data

Machine learning is regarded as an effective approach in network intrusion detection, and has gained significant attention in recent studies. However, few intrusion detection methods have been successfully applied to detect anomalies in large-scale network traffic data, and low explainability of the complex algorithms has caused concerns about fairness and accountability. A further problem is that many intrusion detection systems need to work with distributed data sources in the cloud. In this paper, we propose an intrusion detection method based on distributed computing to learn the latent representations from large-scale network data with lower computation time while improving the intrusion detection accuracy. Our proposed classifier, based on a novel hierarchical algorithm combining adaptability and visualization ability from a self-structured unsupervised learning algorithm and achieving explainability from self-explainable supervised algorithms, is able to enhance the understanding of the model and data. The experimental results show that our proposed method is effective, efficient, and scalable in capturing the network traffic patterns and detecting detailed network intrusion information such as type of attack with high detection performance, and is an ideal method to be applied in cloud-computing environments.

Cyber Security Threat Detection Using Machine Learning

The present review delves into the development and effectiveness of machine learning (ML) methods in the context of cybersecurity threat identification. More sophisticated and adaptable solutions are required as cyber threats increase in number and complexity beyond what can be achieved with standard security techniques. This study provides a thorough assessment of the several machine learning (ML) techniques that have been used to identify and categorize cyber risks. These algorithms include supervised, unsupervised, and deep learning approaches. We assess these methods' efficacy in identifying malware, phishing, and network intrusions while emphasizing their advantages and disadvantages. While ML offers considerable gains over traditional approaches, comparative study shows that issues like algorithmic bias, data quality, and adaptation to changing threats still exist. In an effort to improve predictive capabilities and real-time threat response, the evaluation also highlights trends and future directions in the integration of machine learning with cybersecurity. In order to implement ML-driven security systems, academics and practitioners may use this paper as a thorough guide. Keywords—Cybersecurity, Machine Learning, Algorithms, Threats, Security.

Cyber-Securing Medical Devices Using Machine Learning: A Case Study of Pacemaker

This study aims to enhance the cybersecurity framework of pacemaker devices by identifying vulnerabilities and recommending effective strategies. The objectives are to pinpoint cybersecurity weaknesses, utilize machine learning to predict security breaches, and propose countermeasures based on analytical trends. The literature review highlights the transformation of pacemaker technology from basic, fixed-rate devices to sophisticated systems with wireless capabilities, which, while improving patient care, also introduce significant cybersecurity risks. These risks include unauthorized entry, data breaches, and life-threatening device malfunctions. The methodology in this study utilizes a quantitative research approach using the WUSTL-EHMS-2020 dataset, which includes network traffic features, patients' biometric features, and attack label. The step-by-step method of machine learning prediction includes data collection, data preprocessing, feature engineering, and models’ training using Support Vector Machines (SVM) and Gradient Boosting Machines (GBM). The implementation results used evaluation metrics like accuracy, precision, recall, and F1 score to show that GBM model outperformed the SVM model. The GBM model achieved higher accuracy of 95.1% compared to 92.5% for SVM, greater precision of 99.6% compared to 96.7% for SVM, better recall of 94.9% compared to 42.7% for SVM, and a higher F1 score of 76.3% compared to 59.0% for SVM, making GBM model more effective in predicting cybersecurity threats. This study concludes that GBM is an effective machine learning model for enhancing pacemaker cybersecurity by analyzing network traffic and biometric data patterns. Future recommendations for improving the pacemaker cybersecurity include implementing GBM model for threat predictions, integration with existing security measures, and regular model updates and retraining.

A Survey on Advanced Persistent Threat Detection: A Unified Framework, Challenges, and Countermeasures

In recent years, frequent Advanced Persistent Threat (APT) attacks have caused disastrous damage to critical facilities, leading to severe information leakages, economic losses, and even social disruptions. Via sophisticated, long-term, and stealthy network intrusions, APT attacks are often beyond the capabilities of traditional intrusion detection methods. Existing methods employ various techniques to enhance APT detection at different stages, but this makes it difficult to fairly and objectively evaluate the capability, value, and orthogonality of available techniques. Overly focusing on hardening specific APT detection stages cannot address some essential challenges from a global perspective, which would result in severe consequences. To holistically tackle this problem and explore effective solutions, we abstract a unified framework that covers the complete process of APT attack detection, with standardized summaries of state-of-the-art solutions and analysis of feasible techniques. Further, we provide an in-depth discussion of the challenges and countermeasures faced by each component of the detection framework. In addition, we comparatively analyze public datasets and outline the capability criteria to provide a reference for standardized evaluations. Finally, we discuss insights into potential areas for future research.

An automated intrusion detection system in IoT system using Attention based Deep Bidirectional Sparse Auto Encoder model

Nowadays, the Internet of Things (IoT) is a smart network connected to the Internet for transmitting gathered data with verified protocols. Attackers frequently use communication protocol defects as the basis for their attacks. Better protection measures are required since attacks affect the reputations of service providers. Both machine learning (ML) and deep learning (DL) methods have been developed in a number of research works to detect network intrusions. However, the system's security is limited by the rising number of new threats. Critical problems in IoT platforms, cyber-physical systems, wireless networks, and fog computing are caused by such attacks. The development of various cyber-security attacks reinforces the need for a strong intrusion detection system (IDS) in the IoT platform. The proposed study introduced a robust deep-feature learning mechanism for automatically detecting network intruders in the IoT platform. Initially, input data are gathered from the given dataset. Pre-processing helps reduce any noise in the data and improves the data quality using cleaning, outlier removal, and min-max normalization. The proposed Attention-based Deep Bidirectional Sparse Auto Encoder (AD-BiSA) model is the most important feature retrieved using the attention-based deep Bi-LSTM model. The different IoT network threats are categorized using a sparse Autoencoder approach. The chaotic Seagull Optimization (CSGO) algorithm decreases the loss and enhances the weight in the proposed DL technique. The UNSW NB15_IDS and NSL-KDD datasets achieve accuracy rates of 99.71% and 98.97%, respectively, for the proposed technique. The proposed method achieves better performance than existing approaches.

Cybersecurity in Learning Systems: Data protection and privacy in educational information systems and digital learning environments

This research addresses the growing cybersecurity challenges within educational information systems and digital learning platforms, focusing on the protection of sensitive data and user privacy. The objective is to identify prevalent cybersecurity threats in these environments and propose effective solutions to mitigate them. A mixed-method approach is employed, combining a comprehensive literature review with a survey distributed to IT professionals and educators working in digital learning environments. The findings highlight the increasing sophistication of cyberattacks, including data breaches, phishing, and malware, which compromise the integrity and security of educational data. Moreover, the study reveals a gap in the implementation of robust cybersecurity policies, especially in underfunded educational institutions. The proposed solutions emphasize the integration of advanced encryption methods, multifactor authentication, and regular cybersecurity training for all stakeholders. In conclusion, this research underscores the importance of developing a resilient cybersecurity framework tailored to educational systems, ensuring the protection of both institutional data and the privacy of users, thereby enhancing trust and security in digital learning environments.

Network intrusion detection system using machine learning models and data mining strategies: comprehensive study

Cybersecurity concerns have increased as a result of the development of computat ing and intelligent gadgets and the growing interconnectivity of numerous systems. This study investigates the use of data mining techniques and machine learning models in building intrusion detection systems for network security. By investigating the use of several machine learning approaches, such as naive Bayes, random forest, support vec tor machines, decision tree, k-nearest neighbours, and XGBoost, this study seeks to answer this problem. Furthermore, data mining techniques including association rule mining and clustering algorithms are investigated. The network intrusion detection dataset, which can be downloaded from Kaggle, is used to train and evaluate the sys tem. The primary aim of this study is to provide a more effective and adaptable solution to the network intrusion problem, with the ultimate goal of developing a system that can accurately and efficiently detect and respond to network intrusions. Проблемы кибербезопасности увеличились в результате развития вычислительных и интеллектуальных гаджетов и возросшей взаимосвязности многочисленных систем. В этом исследовании изучается использование методов получения данных и моделей машинного обучения при создании систем обнаружения вторжений для сетевой безопасности. Изучая использование нескольких подходов машинного обучения, таких как наивный байесовский алгоритм, случайный лес, метод опорных векторов, дерево решений, метод k-ближайших соседей и XGBoost, предлагаемое исследование пытается ответить на эту проблему. Кроме того, исследуются методы получения данных, включая алгоритмы нахождения ассоциативных правил и кластеризации. Набор данных обнаружения сетевых вторжений, который можно загрузить с веб-сайта Kaggle, используется для обучения и оценки системы. Основная цель этого исследования — предоставить более эффективное и адаптируемое решение проблемы сетевых вторжений, с конечной целью разработки системы, которая может точно и эффективно обнаруживать и реагировать на сетевые вторжения.

Super Encryption Feal Algorithm and Base64 Algorithm Image File Security

In the rapidly advancing digital era, image file security has become a critical issue, especially with the increasing risks of data breaches and attacks on digital files. This study aims to enhance the security of image files by implementing a combination of two cryptographic algorithms: Fast Data Encipherment Algorithm- 4 (FEAL-4) and Base64. FEAL-4 is a symmetric encryption algorithm known for its high speed and processing efficiency, while Base64 is used for encoding binary data into ASCII format to ensure safer transmission. This research develops a super encryption system that integrates these two algorithms to protect the integrity and confidentiality of image files, particularly for BMP, JPEG, and PNG formats. The implementation was carried out using the Visual Basic programming language. The results of the study show that the combination of FEAL-4 and Base64 algorithms significantly enhances the security of image files, with a high success rate in the encryption and decryption processes.

Cybersecurity lessons from the Vastaamo psychotherapy data breach for psychiatrists and other mental healthcare providers.

The Vastaamo psychotherapy data breach in Finland is perhaps the largest cybersecurity incident in mental healthcare to date, resulting in significant patient harm. There are specific lessons for mental healthcare providers from an analysis of the incident. Case study of this specific electronic health record data breach, based on detailed media reporting. The issues raised include: the importance of governance of the cybersecurity of sensitive personal patient data, such as compliance with legislative requirements on privacy and data security; specific security measures such as de-identification of data, data protection via passwords, multi-factor authentication, firewalls and encryption; and timely and effective communication, and support of those who have been affected. The implications for mental healthcare providers, including psychiatrists and trainees, are that, within their capability, providers need to assess the efficacy and robustness of cybersecurity of electronic health record systems they use, and carefully consider the information that is recorded to minimise exposures such as in the Vastaamo breach.

A Multi-Scale Feature Extraction Method Based on Improved Transformer for Intrusion Detection

Network traffic is a crucial indicator of network performance and network intrusions typically result in traffic anomalies. Capturing the differences and commonalities between different input features is challenging due to high-dimensional traffic data. To address this, we propose a multi-scale feature extraction method based on global additive attention (MSFE-GAA), which integrates time position information encoded by trigonometric functions to capture multi-scale temporal features. An improved Transformer with a similarity matrix captures the commonalities and differences, enhanced by global additive attention for long-term dependencies. Experiments on two public datasets show that the MSFE-GAA model outperforms other baseline models.

An Efficient Detection Mechanism of Network Intrusions in IoT Environments Using Autoencoder and Data Partitioning

In recent years, with the development of the Internet of Things and distributed computing, the “server-edge device” architecture has been widely deployed. This study focuses on leveraging autoencoder technology to address the binary classification problem in network intrusion detection, aiming to develop a lightweight model suitable for edge devices. Traditional intrusion detection models face two main challenges when directly ported to edge devices: inadequate computational resources to support large-scale models and the need to improve the accuracy of simpler models. To tackle these issues, this research utilizes the Extreme Learning Machine for its efficient training speed and compact model size to implement autoencoders. Two improvements over the latest related work are proposed: First, to improve data purity and ultimately enhance detection performance, the data are partitioned into multiple regions based on the prediction results of these autoencoders. Second, autoencoder characteristics are leveraged to further investigate the data within each region. We used the public dataset NSL-KDD to test the behavior of the proposed mechanism. The experimental results show that when dealing with multi-class attacks, the model’s performance was significantly improved, and the accuracy and F1-Score were improved by 3.5% and 2.9%, respectively, maintaining its lightweight nature.

Artificial Intelligence in Finance: Applications and Implications

The definition and uses of Artificial Intelligence, often abbreviated as AI, has come a long way since its inception. This technology is rapidly changing some business operations in the areas of trading, identification of frauds, and customer service in particular, the modern finance sector, and this article highlights the importance of technology in these processes. Significant Applications of Artificial Intelligence in Finance: From Algorithmic Trading to Robo-Advisors. Explaining, the paper analyzes the current trends and practices in the industries, addressing the positive and negative aspects of AI in the finance sector, with respect to the visions of the future. One that relates to the socio-technical implications that include the use of such technology in finance and the associated risks of data breach, availability, and loss of control and trust in processes.

An Efficient Multilayer approach for Securing E-Healthcare Data in Cloud using Crypto – Stego Technique

Healthcare data has been moving to cloud platforms in recent years, which has increased accessibility and scalability but also raised security issues. Ensuring data integrity and safeguarding private health information from unwanted access are critical. This paper presents a comprehensive strategy to integrate effective Elliptic Curve Cryptography ECC-AES with steganography techniques to improve the security of healthcare data in the cloud. ECCAES is especially well-suited for cloud situations with limited resources since it provides strong security with reduced key sizes. Confidentiality is guaranteed by encrypting healthcare data using ECC- AES before storage, reducing the possibility of data breaches. Steganography techniques are also integrated to improve security against skilled adversaries by adding an extra degree of obfuscation by concealing encrypted data inside innocuous files or images. Strict key management procedures, access control systems, and frequent security audits are important components of the proposed system that ensure adherence to Health Insurance Portability and Accountability Act (HIPAA) and General Data Protection Regulation (GDPR) compliance requirements pertaining to healthcare data protection. Programs for employee awareness and training are also crucial for reducing the likelihood of human mistakes. Healthcare businesses can safely use cloud technology while protecting patient data integrity and privacy by putting in place multi-layered security safeguards. The proposed system provides the multilayer security on healthcare data in cloud environment than other existing systems.

Privacy-Preserving Federated Learning-Based Intrusion Detection Technique for Cyber-Physical Systems

The Internet of Things (IoT) has revolutionized various industries, but the increased dependence on all kinds of IoT devices and the sensitive nature of the data accumulated by them pose a formidable threat to privacy and security. While traditional IDSs have been effective in securing critical infrastructures, the centralized nature of these systems raises serious data privacy concerns as sensitive information is sent to a central server for analysis. This research paper introduces a Federated Learning (FL) approach designed for detecting intrusions in diverse IoT networks to address the issue of data privacy by ensuring that sensitive information is kept in the individual IoT devices during model training. Our framework utilizes the Federated Averaging (FedAvg) algorithm, which aggregates model weights from distributed devices to refine the global model iteratively. The proposed model manages to achieve above 90% accuracies across various metrics, including precision, recall, and F1 score, while maintaining low computational demands. The results show that the proposed system successfully identifies various types of cyberattacks, including Denial-of-Service (DoS), Distributed Denial-of-Service (DDoS), data injection, ransomware, and several others, showcasing its robustness. This research makes a great advancement to the IDSs by providing an efficient and reliable solution that is more scalable and privacy friendly than any of the existing models.

How to Realize the Collaborative Supply of Cultural Resource Big Data with Government Participation: Experiences from China

To foster the sustainable development of culture, particularly focusing on the preservation of cultural heritage, encompassing relics, intangible cultural heritage, and historical sites, China has launched a strategy for the digitalization of culture, with the goal of establishing a holistic national big data framework for cultural resources. To improve the efficiency of collaborative supply of cultural resource big data among various parties and to further advance the sustainable development of culture, this research has created a cooperative model that includes cultural institutions, a cultural resource big data service platform, and government participation. Our research findings, based on prospect theory and evolutionary game theory combined with Chinese practice, are presented below. (1) Various factors, including the coefficient of digital infrastructure empowerment, access charges for digital infrastructure, government penalties, and the probability of data leakage, have varying effects on the system in different states. (2) Once the industry has developed, the government can increase the impact of digital infrastructure empowerment to create stronger incentives, rather than relying solely on rewards or penalties. (3) When the value level of cultural resource big data is high, the benefit distribution coefficient does not affect the system evolution results. Finally, we offer practical insights for the government, cultural organizations, and cultural resource big data service platforms based on our research results. Our research offers Chinese insights for global cultural sustainable development.

Issues of personal data protection when using cloud technologies

It is indicated that in today’s digital world, where the amount of stored and processed data is growing at a frantic pace, issues of personal data protection are becoming increasingly important. With the proliferation of cloud technologies that allow companies and individuals to store and process information on remote servers, a new spectrum of threats to data privacy and security is emerging. The article examines the issue of personal data protection when using cloud technologies, in particular, the need to integrate legal and technological aspects to ensure comprehensive protection. The impact of international regulatory acts, such as GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Protection Act), on cloud data protection processes is analyzed. Particular attention is paid to problems arising from differences in the legal regimes of different countries, which complicate data management at the international level. The article examines in detail modern technical solutions, such as data encryption and multi­factor authentication, which are key elements in protecting confidential information. These technologies have been found to provide a high level of protection, but also have their vulnerabilities. Based on this, it is proposed to invest in the latest technologies, in particular quantum encryption and artificial intelligence, to improve the effectiveness of data protection. Practical cases of data leaks are separately considered, which emphasize the importance of proper configuration of security systems and regular monitoring. Analysis of the results of empirical research shows the need to adapt business processes to changes in the regulatory environment and introduce new technologies to reduce risks. Based on the received data, recommendations for organizations are formulated, which include reviewing data protection policies, investing in modern technologies and training employees. The conclusions of the article emphasize the need for a comprehensive approach to ensuring the protection of personal data in cloud environments. This involves taking into account both modern technologies and current legal requirements to ensure adequate data protection and minimize possible risks.

NetSentinel applications for website security

NetSentinel is an extensive web security platform designed to scan, detect and protect websites from potential vulnerabilities and cyber-threats. NetSentinel offers a proactive approach to strengthen and safeguard the website’s security, in an era where data breaches and cyber-attacks are common. The platform analyzes critical security features like SSL security validity, DNSSEC implementation, threat detection, security headers, firewall, and open ports. The main feature of the platform is the scoring mechanism, which assesses the website’s overall security to ensure it is protected from potential threats. The scoring method assigns different weights to the various security features according to their importance in the calculation. This scoring system helps users focus on the most important vulnerabilities and gives clear, practical advice on how to mitigate risks. Along with the main scoring feature the platform also includes 24 other critical security features which are Server location, Whois, DNS Data, DNS Records, Archives, Carbon Footprint, TLS Cipher Suites, TLS Security Configuration, TLS Handshake Simulation, Status, Traceroute, Blocklists, Pages, Social Tags, Headers, HSTS Check, Domain Rank, Tranco Rank, Linked Pages, Mail Services, Redirects, Security Txt, Robots Txt. NetSentinel breaks down complex information into a simple, easy to understand security score, which makes security assessment easier. It also offers clear explanations of the issues and provides step-by-step recommendations on how to fix them, helping users improve their overall security without needing advanced technical knowledge to be possessed. Using this platform, organizations can enhance their site’s ability to withstand cyber threats, ensuring data integrity and secure communication. NetSentinel helps users take control of their web security by balancing technical accuracy with easy-to-use interfaces, making it simple for everyone to stay proactive about their safety online.

Healthcare Data Privacy Protection Through the Lens of Big Data

In the era of rapid development of big data, there are more and more fields that have a close connection with big data technology, of which the medical field is a particularly important part. Nowadays, citizens reflect that the medical information they had uploaded to the cloud platform has been leaked frequently, even in some regular hospitals and other government-provided platforms, which has aroused citizens' doubts and dissatisfaction. This paper will combine the two perspectives of the field of medical information and big data technology to provide new countermeasures and solutions for solving the problem of medical data leakage from the perspective of big data technology and combining with citizens' awareness of privacy protection.

Quantitative Finance and Information Technologies: A Comparative Analysis of Quantitative Trading and Cryptocurrency and Their Regulatory Challenges

As technology has improved in the last decade, financial institutions have developed new technologies, including quantitative trading and cryptocurrency, to enhance their financial products and services. This paper first provides a brief background of quantitative trading and argues for the transactional efficiency of quantitative trading over traditional trading practices; it characterizes quantitative trading as fast and precise. Meanwhile, the study also accounts for the regulatory concerns–including data leakage and platform security–that quantitative trading firms may encounter. This study then establishes a distinction between cryptocurrency and quantitative trading–the former is money-driven, and the latter is data-driven. This paper then discusses the speculative nature of cryptocurrency and addresses its financial concerns citing the FTX collapse. Overall, this paper establishes the argument that quantitative trading supported by technological experts and facilitators offers more advantages than disadvantages compared to cryptocurrency trading. This research concludes that since quantitative trading and cryptocurrency trading are conducted without consideration for international boundaries, they offer bold financial potential as alternatives to traditional banking practices, as long as specific international financial laws are complied with.