Cyber Threat Detection Research Articles

AN INTELLIGENT CYBER SECURITY DETECTION AND RESPONSE PLATFORM

To further solve the cyber security challenges faced by the digital transformation of the Philippines university industry. This paper designed and proposed a cyber security detection and response platform (CSDRP), which can deal with traditional network security problems, improve the network security management capabilities of universities, and provide a method for real-time monitoring of network status and network security response in universities. With the outbreak of the epidemic, many universities in the Philippines have launched online courses and online services. These online courses and online services continue to proliferate, and with them come a host of cyber security risks and hidden dangers. CSDRP extracts logs through the traffic probes, and the platform performs correlation analysis on many security logs, combines relevant models and machine learning algorithms and generates response logs, which can be responded to and linked with policies, and finally presents relevant threats visually. This study deploys the platform in the actual network environment. The experimental results show that it provides accurate threat warnings, as well as good real-time detection and visualization of cyber threats, and can collect logs from different data sources in real time. linkage of safety equipment.

BChainGuard: A New Framework for Cyberthreats Detection in Blockchain Using Machine Learning

Recently, blockchain technology has appeared as a powerful decentralized tool for data integrity protection. The use of smart contracts in blockchain helped to provide a secure environment for developing peer-to-peer applications. Blockchain has been used by the research community as a tool for protection against attacks. The blockchain itself can be the objective of many cyberthreats. In the literature, there are few research works aimed to protect the blockchain against cyberthreats adopting, in most cases, statistical schemes based on smart contracts and causing deployment and runtime overheads. Although, the power of machine learning tools there is insufficient use of these techniques to protect blockchain against attacks. For that reason, we aim, in this paper, to propose a new framework called BChainGuard for cyberthreat detection in blockchain. Our framework’s main goal is to distinguish between normal and abnormal behavior of the traffic linked to the blockchain network. In BChainGuard, the execution of the classification technique will be local. Next, we embed only the decision function as a smart contract. The experimental result shows encouraging results with an accuracy of detection of around 95% using SVM and 98.02% using MLP with a low runtime and overhead in terms of consumed gas.

FLDID: Federated Learning Enabled Deep Intrusion Detection in Smart Manufacturing Industries.

The rapid development in manufacturing industries due to the introduction of IIoT devices has led to the emergence of Industry 4.0 which results in an industry with intelligence, increased efficiency and reduction in the cost of manufacturing. However, the introduction of IIoT devices opens up the door for a variety of cyber threats in smart industries. The detection of cyber threats against such extensive, complex, and heterogeneous smart manufacturing industries is very challenging due to the lack of sufficient attack traces. Therefore, in this work, a Federated Learning enabled Deep Intrusion Detection framework is proposed to detect cyber threats in smart manufacturing industries. The proposed FLDID framework allows multiple smart manufacturing industries to build a collaborative model to detect threats and overcome the limited attack example problem with individual industries. Moreover, to ensure the privacy of model gradients, Paillier-based encryption is used in communication between edge devices (representative of smart industries) and the server. The deep learning-based hybrid model, which consists of a Convolutional Neural Network, Long Short Term Memory, and Multi-Layer Perceptron is used in the intrusion detection model. An exhaustive set of experiments on the publically available dataset proves the effectiveness of the proposed framework for detecting cyber threats in smart industries over the state-of-the-art approaches.

A Novel Approach for Cyber Threat Detection Based on Angle-Based Subspace Anomaly Detection

In real time applications related to social media, conventional anomaly detection techniques are not applicable as the accuracy is degraded due to higher dimensionality thereby hampering these applications leading to cyber threat. This paper focuses on an approach that can select feature subspaces of social media which have meaningful information and thereby conduct anomaly detection in the projected subspace correspondingly. Major goal is to maintain the accuracy of detection in the circumstance of high dimensionality detecting cyber threat. This approach determines the angle between any of the two lines for one of the anomaly candidate specifically where the first line is in connection with relevant data points along with centers of adjacent points and the other line is any parallel axis line. For a particular candidate in social media, any dimension having smallest angle with the first line is chosen as subspace parallel to the axis. In the projected subspace, the local outlierness is measured for an object by introducing normalized values of Mahalanobis distance. Artificial datasets are constructed for comparing proposed approach of detecting cyber threats in social media comprehensively and found to be accurate.

TDLens: Toward an empirical evaluation of provenance graph-based approach to cyber threat detection

To combat increasingly sophisticated cyber attacks, the security community has proposed and deployed a large body of threat detection approaches to discover malicious behaviors on host systems and attack payloads in network traffic. Several studies have begun to focus on threat detection methods based on provenance data of host-level event tracing. On the other side, with the significant development of big data and artificial intelligence technologies, large-scale graph computing has been widely used. To this end, kinds of research try to bridge the gap between threat detection based on host log provenance data and graph algorithm, and propose the threat detection algorithm based on system provenance graph. These approaches usually generate the system provenance graph via tagging and tracking of system events, and then leverage the characteristics of the graph to conduct threat detection and attack investigation. For the purpose of deeply understanding the correctness, effectiveness, and efficiency of different graph-based threat detection algorithms, we pay attention to mainstream threat detection methods based on provenance graphs. We select and implement 5 state-of-the-art threat detection approaches among a large number of studies as evaluation objects for further analysis. To this end, we collect about 40GB of host-level raw log data in a real-world IT environment, and simulate 6 types of cyber attack scenarios in an isolated environment for malicious provenance data to build our evaluation datasets. The crosswise comparison and longitudinal assessment interpret in detail these detection approaches can detect which attack scenarios well and why. Our empirical evaluation provides a solid foundation for the improvement direction of the threat detection approach.

Detecting Cyber Attacks by Applying MachineLearning Techniques

Because of the growth in cloud services, the growing number of web applications customers, and modifications to network infrastructure that connects devices running several operating systems, cyber security is facing new challenges. For this reason, network security components, sensors and insurance conspiracies must also be developed to meet the needs and concerns of the customers in order to combat new threats. In this post, we focus on combating application layer cyber assaults, which are rankedas the most dangerous threats and the most important test for network and cyber security. Most of this essay focuses on machine learning as a method to cope with model normal use and to detect cyber threats. Chart-based division technique and dynamic programming were used in order to obtain examples in the form of Perl Compatible Regular Expressions (PCRE) ordinary expressions. Information is gathered through HTTP requests made by the client to a web worker, which is used in the model. Using the CSIC 2010 HTTP Dataset, we've been able to demonstrate the effectiveness of our approach.

CYBER SECURITY DETECTION USING ANN

One of the major challenges in cyber security is the provision of an automated and effective cyber-threats detection technique. We present an AI technique for cyber-threats detection, based on artificial neural networks. The proposed technique converts multitude of collected security events to individual event profiles and use a deep learning-based detection method for enhanced cyberthreat detection. For this work, we developed an AI-SIEM system based on a combination of event profiling for data preprocessing and different artificial neural network methods, including FCNN, CNN, and LSTM. The system focuses on discriminating between true positive and false positive alerts, thus helping security analysts to rapidly respond to cyber threats. All experiments in this study are performed by authors using two benchmark datasets (NSLKDD and CICIDS2017) and two datasets collected in the real world. To evaluate the performance comparison with existing methods, we conducted experiments using the five conventional machine-learning methods (SVM, k- NN, RF, NB, and DT). Consequently, the experimental results of this study ensure that our proposed methods are capable of being employed as learning-based models for network intrusion-detection, and show that although it is employed in the real world, the performance outperforms the conventional machine-learning methods.

Cyberattack Defense With Cyber-Physical Alert and Control Logic in Industrial Controllers

Power system substations have intelligent electronic devices (IEDs) that collect data and control other devices. As the bridge between the physical and cyber parts of the power system, IEDs capture some key system behaviors. Since adversaries can modify the system’s behavior, physical and cyber data can be used to infer characteristics about the adversary. In this article, we present alert and control logic for hardware-based power system defense using the physical data and communication status in substation IEDs for <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cyber threat detection</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cyber-physical contingency detection and response</i> , and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">physical contingency identification and response</i> . The proposed alert and control logic routines are implemented in an industrial real-time automation controller using IEC 61131-3 in the resilient energy systems lab testbed. The goal is to help operators identify adversaries and protect the power grid in a cyber-physical environment. The effectiveness and accuracy of logic schemes are validated under different adversarial scenarios. Comparing the proposed schemes with an intrusion detection system, Snort, our results also suggest the benefits of using cyber and physical data to identify threats. The results also suggest the use of such hardware-based schemes with software algorithms in a next-generation cyber-physical energy management system, which can implement automatic control actions to protect power grids and its physical equipment against cyber threats.

Cyber-Threat Detection System Using a Hybrid Approach of Transfer Learning and Multi-Model Image Representation.

Currently, Android apps are easily targeted by malicious network traffic because of their constant network access. These threats have the potential to steal vital information and disrupt the commerce, social system, and banking markets. In this paper, we present a malware detection system based on word2vec-based transfer learning and multi-model image representation. The proposed method combines the textual and texture features of network traffic to leverage the advantages of both types. Initially, the transfer learning method is used to extract trained vocab from network traffic. Then, the malware-to-image algorithm visualizes network bytes for visual analysis of data traffic. Next, the texture features are extracted from malware images using a combination of scale-invariant feature transforms (SIFTs) and oriented fast and rotated brief transforms (ORBs). Moreover, a convolutional neural network (CNN) is designed to extract deep features from a set of trained vocab and texture features. Finally, an ensemble model is designed to classify and detect malware based on the combination of textual and texture features. The proposed method is tested using two standard datasets, CIC-AAGM2017 and CICMalDroid 2020, which comprise a total of 10.2K malware and 3.2K benign samples. Furthermore, an explainable AI experiment is performed to interpret the proposed approach.

Machine learning model to predict cyber attack

All users place a high value on information security. Over the last few decades, cyber security has been one of the most fascinating and essential topics in cyber re-search. The goal of this work is to propose a machine learning method for the problem of cyber security threats. As a result, a multi-model machine learning approach was developed to predict the top ten traits that can be used to detect cyber threats. This work finds the importance of each feature in from the dataset using machine learning. this model trained with random forest model and exclude the features which are least important to the model.

FEDGAN-IDS: Privacy-preserving IDS using GAN and Federated Learning

Federated Learning (FL) is a promising distributed training model that aims to minimize the data sharing to enhance privacy and performance. FL requires sufficient and diverse training data to build efficient models. Lack of data balance as seen in rare classes affects the model accuracy. Generative Adversarial Networks (GAN) are remarkable in data augmentation to balance the available training data. In this article, we propose a novel Federated Deep Learning (DL) Intrusion Detection System (IDS) using GAN, named FEDGAN-IDS, to detect cyber threats in smart Internet of Things (IoT) systems; smarthomes, smart e-healthcare systems and smart cities. We distribute the GAN network over IoT devices to act as a classifier and train using augmented local data. We compare the convergence and accuracy of our model with other federated intrusion detection models. Extensive experiments with multiple datasets demonstrates the effectiveness of the proposed FEDGAN-IDS. The model performs better and converges earlier than the state-of-the-art standalone IDS.

Cyber Threat Detection Based on Artificial Neural Networks Using Event Profiles

Abstract: Cyber Supply Chain (CSC) system is complex which involves different sub-systems performing various tasks. Security in supply chain is challenging due to the inherent vulnerabilities and threats from any part of the system which can be exploited at any point within the supply chain. This can cause a severe disruption on the overall business continuity. Therefore, it is paramount important to understand and predicate the threats so that organization can undertake necessary control measures for the supply chain security. Cyber Threat Intelligence (CTI) provides an intelligence analysis to discover unknown to known threats using various properties including threat actor skill and motivation, Tactics, Techniques, and Procedure (TT and P), and Indicator of Compromise (IoC). This paper aims to analyse and predicate threats to improve cyber supply chain security. We have applied Cyber Threat Intelligence (CTI) with Machine Learning (ML) techniques to analyse and predict the threats based on the CTI properties. That allows to identify the inherent CSC vulnerabilities so that appropriate control actions can be undertaken for the overall cybersecurity improvement. To demonstrate the applicability of our approach, CTI data is gathered and a number of ML algorithms, i.e., Logistic Regression (LG), Support Vector Machine (SVM), Random Forest (RF), and Decision Tree (DT), are used to develop predictive analytics using the Microsoft Malware Prediction dataset. Parameters and vulnerabilities and Indicators of compromise (IoC) as output parameters. The results relating to the prediction reveal that Spyware/Ransomware and spear phishing are the most predictable threats in CSC. We have also recommended relevant controls to tackle these threats. We advocate using CTI data for the ML predicate model for the overall CSC cyber security improvement. Keywords: TF-IDF--Term Frequency–Inverse Document Frequency, SVM-Support Vector Machine, CSC-Cyber Supply Chain, CTI-Cyber Threat Intelligence

Trust-Based Intelligent Routing Protocol with Q-Learning for Mission-Critical Wireless Sensor Networks.

Mission-critical wireless sensor networks require a trustworthy and punctual routing protocol to ensure the worst-case end-to-end delay and reliability when transmitting mission-critical data collected by various sensors to gateways. In particular, the trustworthiness of mission-critical data must be guaranteed for decision-making and secure communications. However, it is a challenging issue to meet the requirement of both reliability and QoS in sensor networking environments where cyber-attacks may frequently occur and a lot of mission-critical data is generated. This study proposes a trust-based routing protocol that learns the trust elements using Q-learning to detect various attacks and ensure network performance. The proposed mechanism ensures the prompt detection of cyber threats that may occur in a mission-critical wireless sensor network and guarantees the trustworthy transfer of mission-critical sensor data. This paper introduces a distributed transmission technology that prioritizes the trustworthiness of mission-critical data through Q-learning results considering trustworthiness, QoS, and energy factors. It is a technology suitable for mission-critical wireless sensor network operational environments and can reliably operate resource-constrained devices. We implemented and performed a comprehensive evaluation of our scheme using the OPNET simulator. In addition, we measured packet delivery rates, throughput, survivability, and delay considering the characteristics of mission-critical sensor networks. The simulation results show an enhanced performance when compared with other mechanisms.

Fast Detection for Cyber Threats in Electric Vehicle Traction Motor Drives

While cyber-physical security of electric vehicles (EV) is gaining increased concerns due to the fast development of vehicle onboard communication networks, the existing literature focuses on the vehicle level and it does not explicitly address cyber-threat detection for the EV powertrain traction motor drives. Therefore, in this paper, we propose a fast, model-free approach to detect cyber-threats in electric vehicle traction motor drives with only four easy-to-get, trustworthy sensor signals. First, the trustworthy motor current signals are selected to undermine the impacts of the vehicle’s random driving cycles. Then a set of innovative time-domain current features that are the most sensitive to a wide range of anomalies are selected to reduce the number of observations needed, thus vastly reducing the computational burden and the time-to-detect. Next, four binary classifiers are developed to detect cyber-threats while a majority vote mechanism is adopted to reduce the false alarm rate. Finally, the proposed method is validated by the real-time hardware-in-the-loop simulations. Validation results show that the proposed detection method achieves much faster detection compared to traditional current signature analysis. Furthermore, the proposed detection methods achieve an accuracy higher than 98% with the false alarm rate less than 0.01%.

Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research

This survey presents a comprehensive review of current literature on Explainable Artificial Intelligence (XAI) methods for cyber security applications. Due to the rapid development of Internet-connected systems and Artificial Intelligence in recent years, Artificial Intelligence including Machine Learning (ML) and Deep Learning (DL) has been widely utilized in the fields of cyber security including intrusion detection, malware detection, and spam filtering. However, although Artificial Intelligence-based approaches for the detection and defense of cyber attacks and threats are more advanced and efficient compared to the conventional signature-based and rule-based cyber security strategies, most ML-based techniques and DL-based techniques are deployed in the black-box manner, meaning that security experts and customers are unable to explain how such procedures reach particular conclusions. The deficiencies of transparency and interpretability of existing Artificial Intelligence techniques would decrease human users' confidence in the models utilized for the defense against cyber attacks, especially in current situations where cyber attacks become increasingly diverse and complicated. Therefore, it is essential to apply XAI in the establishment of cyber security models to create more explainable models while maintaining high accuracy and allowing human users to comprehend, trust, and manage the next generation of cyber defense mechanisms. Although there are papers reviewing Artificial Intelligence applications in cyber security areas and the vast literature on applying XAI in many fields including healthcare, financial services, and criminal justice, the surprising fact is that there are currently no survey research articles that concentrate on XAI applications in cyber security.

APPLICATION OF THE THREAT INTELLIGENCE PLATFORM TO INCREASE THE SECURITY OF GOVERNMENT INFORMATION RESOURCES

With the development of information technology, the need to solve the problem of information security has increased, as it has become the most important strategic resource. At the same time, the vulnerability of the modern information society to unreliable information, untimely receipt of information, industrial espionage, computer crime, etc. is increasing. In this case, the speed of threat detection, in the context of obtaining systemic information about attackers and possible techniques and tools for cyberattacks in order to describe them and respond to them quickly is one of the urgent tasks. In particular, there is a challenge in the application of new systems for collecting information about cyberevents, responding to them, storing and exchanging this information, as well as on its basis methods and means of finding attackers using integrated systems or platforms. To solve this type of problem, the promising direction of Threat Intelligence as a new mechanism for acquiring knowledge about cyberattacks is studied. Threat Intelligence in cybersecurity tasks is defined. The analysis of cyberattack indicators and tools for obtaining them is carried out. The standards of description of compromise indicators and platforms of their processing are compared. The technique of Threat Intelligence in tasks of operative detection and blocking of cyberthreats to the state information resources is developed. This technique makes it possible to improve the productivity of cybersecurity analysts and increase the security of resources and information systems.

Dataset Generation for Development of Multi-Node Cyber Threat Detection Systems

This paper presents a new approach to generate datasets for cyber threat research in a multi-node system. For this purpose, the proof-of-concept of such a system is implemented. The system will be used to collect unique datasets with examples of information hiding techniques. These techniques are not present in publicly available cyber threat detection datasets, while the cyber threats that use them represent an emerging cyber defense challenge worldwide. The network data were collected thanks to the development of a dedicated application that automatically generates random network configurations and runs scenarios of information hiding techniques. The generated datasets were used in the data-driven research workflow for cyber threat detection, including the generation of data representations (network flows), feature selection based on correlations, data augmentation of training datasets, and preparation of machine learning classifiers based on Random Forest and Multilayer Perceptron architectures. The presented results show the usefulness and correctness of the design process to detect information hiding techniques. The challenges and research directions to detect cyber deception methods are discussed in general in the paper.

Threat Hunting Early Experiment through Event Correlation and Memory Forensic

The cyber threat landscapes nowadays are dynamically evolving over time, the cyber security practitioner in corporations need to adapt with more sophisticated way with the latest cyber threat attacks are launched. Cyber Threat Intelligence is one of the tools that can be utilized as a cyber threat detection. Generally, CTI operates by integrating its directory with events collected from Security Information and Event Management (SIEM) to correlates all of the appliances logs within corporation and providing summarized and meaningful information that can be reviewed to identify legitimate malicious cyber threat activity. However, relying only CTI subscription that only contains blacklist domain and ip addresses integrated with SIEM will only provide passive detection for known cyber threats. The needs for proactive cyber threat detection is required to compete with the modern threat landscape. This research work will try to explore the possibility of detecting unknown or undetected cyber threats using network event correlation and memory forensic to validate its existence. Throughout this research time span, we’re able to discover malicious network pattern that is proven to be undetected within internal organization endpoint protection. Therefore, this research will provide baseline for threat hunting activity based on network behavioural pattern.

Cyber threat Detection and Response Time Modeling

Cyber threat Detection and Response Time Modeling

USE OF MACHINE LEARNING IN CYBER SECURITY

The urgency of the topic is the integration of machine learning technologies into cybersecurity systems. After getting acquainted with the technical literature, the main technologies of machine learning that are implemented in the organization of cybersecurity were formulated. Acquainted with the main type of artificial neural network used in the prevention and detection of cyber threats and found that the main to consider the general application of machine learning technologies are artificial neural networks based on a multilayer perceptron with inverse error propagation. It is proposed to use indicators of compromise cyberattacks as initial information for automatic machine learning systems. Emphasis is placed on the main types of data that can be used by surveillance subsystems for information security and cybersecurity to perform tasks and prevent, classify and predict cybersecurity events. According to the results of the analysis, the main problem areas for their implementation in information security systems are identified. The problem of using machine learning (ML) in cybersecurity is difficult to solve, because advances in this area open up many opportunities, from which it is difficult to choose effective means of implementation and decision-making. In addition, this technology can also be used by hackers to create a cyber attack. The purpose of the study is to implement machine learning in information security and cybersecurity technology, and to depict a model based on self-learning