Detection Of Malicious Activities Research Articles

Intrusion Detection System Application with Machine Learning

Information security holds paramount importance for organizations and users alike, safeguarding against unauthorized access to sensitive data. Daily usage of the internet amplifies the importance of security measures and the detection of malicious activities. Cyber-attacks, as these malicious activities are commonly known, are continually evolving with advancements in hardware, software, and complex network algorithms. Intrusion Detection Systems play a crucial role in shielding data and information from cyberattacks. The rapid progression in machine learning and deep learning, two popular methodologies in data mining, has found applications in various fields, including security. This study focuses on the use of machine learning and deep learning methods to design an intelligent intrusion detection system. For the development of this smart intrusion detection system, two well-established datasets, NSL-KDD and Kyoto 2006+, were employed. Machine learning methods were implemented utilizing the classification algorithms available in the WEKA data mining tool. The results obtained from these classification algorithms were compared with the deep learning model designed within the scope of the study. Consequently, a detailed analysis of machine learning and deep learning methods on the NSL-KDD and Kyoto 2006+ datasets for an intelligent intrusion detection system was conducted, and suggestions were proposed for further research endeavors.

Time series processing-based malicious activity detection in SCADA systems

Many critical infrastructures, essential to modern life, such as oil and gas pipeline control and electricity distribution, are managed by SCADA systems. In the contemporary landscape, these systems are interconnected to the internet, rendering them vulnerable to numerous cyber-attacks. Consequently, ensuring SCADA security has become a crucial area of research. This paper focuses on detecting attacks that manipulate the timing of commands within the system, while maintaining their original order and content. To address this challenge, we propose several machine-learning-based methods. The first approach relies on Long-Short-Term Memory model, and the second utilizes Hierarchical Temporal Memory model, both renowned for their effectiveness in detecting patterns in time-series data. We rigorously evaluate our methods using a real-life SCADA system dataset and show that they outperform previous techniques designed to combat such attacks.

Safeguarding Smart Horizons: Crafting the Future of IOT Security Through Intrusion Detection and Prevention

It is crucial to secure digital assets and networks against harmful activity in the linked world of today. Through the detection and mitigation of unauthorized access, malicious activity, and possible security threats, Intrusion Detection and Prevention Systems (IDPS) are essential to the protection of systems and networks. The development, approaches, technologies, difficulties, and future directions of intrusion detection and prevention systems are all covered in detail in this research paper. The study examines the advantages and disadvantages of several IDPS methodologies, such as hybrid, anomaly-based, and signature-based techniques. It also addresses how to improve the efficacy and efficiency of IDPS using cutting- edge methods like big data analytics, artificial intelligence, and machine learning. In addition, the study discusses and suggests possible solutions for the problems that IDPS faces, including false positives, evasion strategies, and scalability concerns. In order to assist academics, researchers, and practitioners with insights, it concludes by outlining future directions for study and development in the field of intrusion detection and prevention systems.

Unveiling The Detection of File Less Malware from Dark Web: A Stealthy Arsenal for Web Application Exploitation

The proliferation of fileless malware poses a significant threat to web application security, especially when sourced from the dark web. This paper presents a novel detection tool designed to identify and mitigate fileless malware sourced from the dark web, specifically targeting web applications. Leveraging advanced anomaly detection and behavioral analysis techniques, the tool monitors real-time traffic and user interactions, enabling the early detection of malicious activities. Additionally, the tool integrates seamlessly with threat intelligence sources, enhancing its ability to recognize emerging threats. A user-centric alerting system ensures that administrators are promptly notified of potential security breaches, allowing for immediate remediation actions. The tool's adaptability and continuous enhancement mechanisms ensure that it stays ahead of evolving threats. By employing this detection tool, organizations can bolster their web application security posture and protect sensitive data from sophisticated fileless malware attacks.

Improved sand cat swarm optimization with deep learning based enhanced malicious activity recognition for cybersecurity

The main concept of a smart city is to join manual items with electronics, software, sensors, and network connectivity for data contact via Internet of Things (IoT) gadgets. IoT improves production and efficiency by cleverly utilizing remote management, but security as well as privacy risk, rises. Cyber threats are progressing every day, affecting inadequate actions of safety and privacy. In a smart city, the exposed action of an individual or business can keep the whole city in danger. Owing to the trust of numerous modules of smart cities on data and communication techniques, cybersecurity tasks like information leakage and mischievous cyber-attacks. Malicious Activity Detection in the area of cybersecurity for smart cities is dominant in protecting the consistent organization of urban atmospheres. Leveraging innovative machine learning (ML) and deep learning (DL) approaches, mainly anomaly detection methods permits the identification of abnormal patterns and probable threats within the massive streams of data produced by smart city methods. So, this paper designs a Fusion of Optimization Algorithms and DL for Enhanced Malicious Activity Recognition (FOADL-EMAR) technique for cybersecurity in smart cities. The purpose of the FOADL-EMAR technique is to recognize the presence of malicious activities using optimal DL techniques in the environment of a smart city. To accomplish this, the FOADL-EMAR technique uses a Z-score data normalization model to measure the input dataset into a useful format. In addition, the FOADL-EMAR technique uses an improved sand cat swarm optimization (ISCSO) algorithm that can be applied to select an optimal subset of features. An ensemble of three DL techniques is used namely long short-term memory (LSTM), deep neural networks (DNNs), and extreme learning machine (ELM) for malicious activity detection. The Harris Hawks Optimization (HHO) approach has been applied to improve the detection results of the ensemble models. The simulation analysis of the FOADL-EMAR methodology occurs utilizing a benchmark database. The experimentation values demonstrate the improved detection outcomes of the FOADL-EMAR algorithm over other existing methods in terms of different measures.

AI Cyber Defense and eBPF

This paper will delve into the integration of Artificial Intelligence (AI) and extended Berkeley Packet Filter (eBPF) technology to enhance cyber defense capability. The most important aspect of AI is detection of threats where it employs sophisticated algorithms in the analysis of large data sets to identify any form of pattern which signals a threat in cyberspace. It enhances behavioral analysis in the monitoring of user and system behavior to identify suspicious activities. AI also helps to instantly react against the threats by automatically taking actions like isolating an infected machine or blocking the suspicious network traffic in order to minimize the response time and consequent damage. AI can predict the attacks based on historical data and current trends and design proactive defense strategies. On the other hand. eBPF technology complements AI by providing programmable kernel tracing, real-time monitoring, low overhead, and security enhancements. Attaching eBPF programs to kernel hooks provides insights into network traffic, system events, and application behavior, intrusion detection, performance monitoring, and troubleshooting. Its implementation is still optimal with less performance impact on the system. The system retains its robust security stance due to the deployment of eBPF, enforcement of kernel-level security policies, and detection of malicious activities. This synergy between AI and eBPF would mean smarter cybersecurity solutions that can change adeptly with each emerging threat and help raise defenses for the organization.

An efficient cloud-integrated distributed deep neural network framework for IoT malware classification

The proliferation of interconnected devices in the Internet of Things (IoT) landscape has introduced significant security concerns. With the integration of android devices, the potential for attackers to exploit vulnerabilities becomes a crucial issue. Timely detection of malware attacks has emerged as a critical challenge, especially in industrial IoT (IIoT), to prevent permanent damage. The slow inference speed of the current algorithms causes limited performance and a significant delay in the detection and mitigation of malware, especially in large-scale environments such as IIoT. High resource utilization can limit the size of the model (number of parameters), which could be implemented in embedded devices, which causes lower accuracy of the model. Hence, we proposed a HierarchicalCloudDNN, a distributed malware detection framework that used modified state-of-the-art deep learning algorithms in a boosting ensemble architecture. The proposed method could scale efficiently from IIoT devices up to the edge and cloud to speed up malware detection, simultaneously reduce resource utilization, and maintain a controllable level of accuracy compared to rival methods in malware detection. The objective is to minimize both run-time and resource consumption while maintaining performance characteristics. The performance analysis of the HierarchicalCloudDNN method was evaluated using standard performance measures on the frequently used BIG 2015 dataset. Based on evaluations, the proposed approach has demonstrated an impressive accuracy rate of 98.90%, outperforming many state-of-the-art models in performance, response time, and resource utilization. These findings suggest a notable decrease in both false positives and false negatives while maintaining accuracy. The proposed distributed malware analysis framework is scalable, robust, and helpful for the timely detection of malicious activity, especially in geographically distributed environments such as the IIoT.

VADIA-Verkle Tree-based Approach for Dealing Data Integrity Attacks in Opportunistic Mobile Social Networks

Opportunistic Mobile Social Networks (OMSN) are prone to data integrity attacks that jeopardize the integrity of the routing data inside the network. Among the several techniques that cope with these attacks in OMSN, tree-based approaches have proven to be the most effective due to its ease of data verification and ensurance in data integrity. This paper evaluates two tree-based data structures, Merkle tree and Verkle tree in terms of their effectiveness in detecting and preventing such attacks. The evaluation considers tree-generation time and proof-checking time, and the results demonstrate that the Verkle tree is a bandwidth-efficient solution and have lower proof-checking time, with a reduction of 98.33% than Merkle tree. This makes Verkle tree a good choice for handling data integrity attacks in OMSN. A Verkle tree-based approach, named VADIA, is proposed to handle data integrity attacks such as packet dropping, packet modification and pollution attack in OMSN. The proposed approach is implemented in the Opportunistic Network Environment (ONE) simulator and is shown to be effective in detecting malicious nodes and paths, reducing false negative rates, and improving accuracy in detecting malicious activities. The results demonstrate a 47%, 84% and 69% improvement in malicious node, malicious path and malicious activity detection over a period of time. Furthermore, the approach achieves an 80% reduction in false negative rates.

Deep Learning-based Framework for Detecting Malicious Insider-Inspired Cyberattacks Activities in Organisations


 Abstract— Cyberattacks are happening at an alarming rate both in developed and developing countries. This is due to more users now being connected to the global village (internet). Significant strides have been taken by organisations to protect information technology assets together with data, by doing defense-in-depth, using firewalls and access control approaches collectively. These approaches work well in detecting attacks by outsider cyber-attackers. In recent cyberattacks the perpetrators have been those within the organisation, as they can easily bypass security measures especially those with high privileges and they can go undetected for quite a long time. We propose a deep learning approach termed Automatic_ IDS_ Deep model (framework) that is infused with intrusion detection systems to give timely detection of malicious activities by those within the organisation. Experiments were conducted and averaging of results was done to determine accuracy, recall, and precision of the proposed model. The model (framework) offers better results on its performance in detecting attacks that are perpetrated within the organisation.
 
 
 

An effective MLP model for detecting malicious nodes in PoS permissionless blockchains

With the proliferation of blockchain technology, ensuring the security and integrity of permissionless Proof-of-Stake (PoS) blockchain networks has become imperative. This paper addresses the persistent need for an effective system to detect and mitigate malicious nodes in such environments. Leveraging Deep Learning (DL) techniques, specifically Multi-Layer Perceptron (MLP), a novel model is proposed for real-time identification and detection of malicious nodes in PoS blockchain networks. The model integrates components for data collection, feature extraction, and model training using MLP. The proposed model is trained on labelled data representing both benign and malicious node activities, utilising transaction volumes, frequencies, timestamps, and node reputation scores to identify anomalous behaviour indicative of malicious activity. The experimental results validate the efficacy of the proposed model in distinguishing between normal and malicious nodes within blockchain networks. The model demonstrates exceptional performance in classification tasks with an accuracy of 99%, precision, recall, and F1-score values hovering around 0.99 for both classes. The experimental results verify the proposed model as a dependable tool for enhancing the security and integrity of PoS blockchain networks, offering superior performance in real-time detection and mitigation of malicious activities.

Enhancing Malicious Activity Detection in IoT-Enabled Network and IoMT Systems Through Metaheuristic Optimization and Machine Learning

Enhancing Malicious Activity Detection in IoT-Enabled Network and IoMT Systems Through Metaheuristic Optimization and Machine Learning

Network anomaly detection and performance evaluation of Convolutional Neural Networks on UNSW-NB15 dataset

The present study uses the benchmark UNSW-NB15 datasets to detect network anomalies using the proposed deep learning-based Convolutional Neural Network (CNN) model. Several studies have already worked on network anomaly detection with some limits. However, earlier research has used old datasets and obtained limited accuracy. In addition, previous studies could not detect the latest malicious activities. Therefore, in the present study, firstly, we implemented the machine learning-based random forest method to diminish the dimensionality of the dataset and pick the most notable features. In this case, the random forest method has set only fifteen features from the forty-one and reduced the complexity of the data. Subsequently, the CNN model was trained and tested on the UNSW-NB15 dataset with 99.00% testing accuracy. The performance of the offered CNN model was assessed using precision, recall and the f1-values. The present study’s outcome can be used in real-time malicious activity detection.

Machine Learning based Network Packet Classification

Network packet classification plays an important role in modern networks irrespective of host or network-based classification, serving as the foundation for efficient routing, malicious activity detection, and security enforcement. With the continuous growth of network traffic volume and complexity, traditional static rule-based classification methods have faced difficulties in scalability and adaptability. As a solution, the study decided to enforce machine learning techniques to tackle these challenges effectively. This study presents an extensive and original review of machine learning- based approaches for network packet classification. The smart Intrusion Detection System framework with network packet classification evolution looks forward to designing and deploying security systems that use various parameters for analysing current and dynamic traffic trends and are highly time-efficient in predicting intrusions. Various machine learning algorithms commonly employed in packet classification, such as decision trees, support vector machines, and neural networks are analysed and their merits and demerits are compared with their behaviour and accuracy percentage in this study. machine learning-based techniques offer an efficient and accurate network packet classification for the protection of the systems when compared to the conventional methods of packet classification. By leveraging the power of machine learning algorithms and intelligent feature selection, network administrators and Security Operation Center (SOC) analyst can enhance network performance, improve security, and the robustness of the log generated in the network.

HMCMA: Design of an Efficient Model with Hybrid Machine Learning in Cyber security for Enhanced Detection of Malicious Activities

HMCMA: Design of an Efficient Model with Hybrid Machine Learning in Cyber security for Enhanced Detection of Malicious Activities

TNN-IDS: Transformer neural network-based intrusion detection system for MQTT-enabled IoT Networks

The Internet of Things (IoT) is a global network that connects a large number of smart devices. MQTT is a de facto standard, lightweight, and reliable protocol for machine-to-machine communication, widely adopted in IoT networks. Various smart devices within these networks are employed to handle sensitive information. However, the scale and openness of IoT networks make them highly vulnerable to security breaches and attacks, such as eavesdropping, weak authentication, and malicious payloads. Hence, there is a need for advanced machine learning (ML) and deep learning (DL)-based intrusion detection systems (IDS). Existing ML-based IoT-IDSs face several limitations in effectively detecting malicious activities, mainly due to imbalanced training data. To address this, this study introduces a transformer neural network-based intrusion detection system (TNN-IDS) specifically designed for MQTT-enabled IoT networks. The proposed approach aims to enhance the detection of malicious activities within these networks. The TNN-IDS leverages the parallel processing capability of the Transformer Neural Network, which accelerates the learning process and results in improved detection of malicious attacks. To evaluate the performance of the proposed system, it was compared with various IDSs based on ML and DL approaches. The experimental results demonstrate that the proposed TNN-IDS outperforms other systems in terms of detecting malicious activity. The TNN-IDS achieved optimum accuracies reaching 99.9% in detecting malicious activities.

Universal and Accurate Sketch for Estimating Heavy Hitters and Moments in Data Streams

In computer networks, traffic measurement is a module in a network probe to measure flow-level statistics from an IP packet stream, which are the basis for network performance monitoring and malicious activity detection. This module extracts the flow IDs from incoming IP packets, classifies packets into flows, and counts the number of packets (or bytes) for each flow. It is a great challenge to measure the per-flow statistics for a high-speed network device, using only the size-limited SRAM on its line cards. Therefore, many algorithms using sublinear memory have been proposed, such as CountMin and CountSketch. However, most of previous algorithms are designed for specific measurement tasks. To obtain multiple types of statistics, people have to deploy multiple sketches, which demands more resources of a network device. It is useful to design a universal sketch that can track not only the top- <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$k$</tex-math> </inline-formula> largest individual flows (called heavy hitters) but also the overall traffic distribution statistics (called moments). Prior work named UnivMon successfully tackled this ambitious quest. However, it incurs large and variable per-packet processing overhead, which may result in a significant throughput bottleneck in high-rate packet stream, given that each packet requires 33 hashes and 32 memory accesses on average and many times of that in the worst case. To address this performance issue, we fundamentally redesign the solution architecture from hierarchical sampling to new progressive sampling and from CountSketch to new GenericCM, which ensure that per-packet overhead is a small constant (5 hashes and 8 memory accesses in the worst case), making it more suitable for online operations, especially for hardware pipeline implementation. This new design also makes effort to reduce memory footprint or equivalently improve measurement accuracy under the same memory. Our experiments show that our solution reduces measurement error by roughly 98.1% for second-order moment and by 91.5% for entropy, when given the same 0.2MB memory as UnivMon.

A new deep boosted CNN and ensemble learning based IoT malware detection

Security issues are threatened in various types of networks, especially in the Internet of Things (IoT) environment that requires early detection. IoT is the network of real-time devices like home automation systems and can be controlled by open-source android devices, which can be an open ground for attackers. Attackers can access the network credentials, initiate a different kind of security breach, and compromises network control. Therefore, timely detecting the increasing number of sophisticated malware attacks is the challenge to ensure the credibility of network protection. In this regard, we have developed a new malware detection framework, Deep Squeezed-Boosted and Ensemble Learning (DSBEL), comprised of novel Squeezed-Boosted Boundary-Region Split-Transform-Merge (SB-BR-STM) CNN and ensemble learning. The proposed STM block employs multi-path dilated convolutional, Boundary, and regional operations to capture the homogenous and heterogeneous global malicious patterns. Moreover, diverse feature maps are achieved using transfer learning and multi-path-based squeezing and boosting at initial and final levels to learn minute pattern variations. Finally, the boosted discriminative features are extracted from the developed deep SB-BR-STM CNN and provided to the ensemble classifiers (SVM, MLP, and AdabooSTM1) to improve the hybrid learning generalization. The performance analysis of the proposed DSBEL framework and SB-BR-STM CNN against the existing techniques have been evaluated by the IOT_Malware dataset on standard performance measures. Evaluation results show progressive performance as 98.50% accuracy, 97.12% F1-Score, 91.91% MCC, 95.97 % Recall, and 98.42 % Precision. The proposed malware analysis framework is robust and helpful for the timely detection of malicious activity and suggests future strategies.

Preprocessing Impact Analysis for Machine Learning-Based Network Intrusion Detection

Machine learning (ML) has been frequently used to build intelligent systems in many problem domains, including cybersecurity. For malicious network activity detection, ML-based intrusion detection systems (IDSs) are promising due to their ability to classify attacks autonomously after learning process. However, this is a challenging task due to the vast number of available methods in the current literature, including ML classification algorithms and preprocessing techniques. For analysis the impact of preprocessing techniques on the ML algorithm, this study has conducted extensive experiments, using support vector machines (SVM), the classifier and the FS technique, several normalisation techniques, and a grid-search classifier optimisation algorithm. These methods were sequentially tested on three publicly available network intrusion datasets, NSL-KDD, UNSW-NB15, and CICIDS2017. Subsequently, the results were analysed to investigate the impact of each model and to extract the insights for building intelligent and efficient IDS. The results exhibited that data preprocessing significantly improves classification performance and log-scaling normalisation outperformed other techniques for intrusion detection datasets. Additionally, the results suggested that the embedded SVM-FS is accurate and classifier optimisation can improve performance of classifier-dependent FS techniques. However, feature selection in classifier optimisation is a critical problem that must be addressed. In conclusion, this study provides insights for building ML-based NIDS by revealing important information about data preprocessing.

Detection of Malicious Network Activity by Artificial Neural Network

This paper presents a deep learning approach to detect malicious communication in a computer network. The intercepted communication is transformed into behavioral feature vectors that are reduced (using principal component analysis and stepwise selection methods) and normalized to create training and test sets. A feed-forward artificial neural network is then used as a classifier to determine the type of malicious communication. Three training algorithms were used to train the neural network: the Levenberg-Marquardt algorithm, Bayesian regularization, and the scaled conjugate gradient backpropagation algorithm. The proposed artificial neural network topology after reducing the size of the training and test sets achieves a correct classification probability of 81.5 % for each type of malicious communication and of 99.6 % (and better) for normal communication.

Детектирование и классификация сетевых атак с помощью Splunk Machine Learning Toolkit

In modern conditions of digital technologies implementation in various sectors of the economy, the digitalization of public administration, healthcare, education, and science, the growth in the number of Internet services and mobile devices the issues of ensuring the security of cellular communication systems are becoming increasingly relevant. It is becoming increasingly difficult to detect multiple and complex cyber security threats as the sources and methods ofcyber-attacks evolve and expand. Classic network attack detection approaches that rely heavily on static matching, such as signature analysis, blacklisting, or regular expression patterns, are limited in flexibility and are ineffective for early anomaly detection and rapid response to information security incidents. To solve this problem, the use of machine learning (ML) algorithms is proposed. ML methods can provide new approaches and higher rates of detection of malicious activity on the network. In this work, the Splunk Enterprise data analysis platform and the Splunk Machine Learning Toolkit for creating, training, testing, and validating a network attack classifier are used. The performance of the proposed model was evaluatedby applying four machine learning algorithms such as a decision tree, a support vector machine, a random forest, and adouble random forest. Experimental results show that all used ML algorithms can be effectively used to detect network attacks, and the double random forest method has the best accuracy in detecting distributed denial-of-service attacks.