Different Types Of Malicious Attacks Research Articles

Detecting Malicious Accounts in Online Developer Communities Using Deep Learning

Online developer communities like GitHub allow a massive number of developers to collaborate. However, the openness of the communities makes them vulnerable to different types of malicious attacks, since attackers can easily join these communities and interact with legitimate users. In this work, we propose GitSec, a deep learning-based solution for detecting malicious accounts in online developer communities. GitSec distinguishes malicious accounts from legitimate ones based on the account profiles, dynamic activity characteristics, as well as social interactions. First, GitSec introduces two user activity sequences and applies a parallel neural network design with an attention mechanism to process the sequences. Second, GitSec constructs two graphs to represent the interactions between users according to their repository operations. Especially, graph neural networks and structural hole theory are employed to deal with the two constructed graphs. Third, GitSec makes use of the descriptive features to enhance the detection performance. The final judgement is made by a decision maker implemented by a supervised machine learning-based classifier. Based on the real-world data of GitHub users, our comprehensive evaluations show that GitSec achieves a better performance than state-of-the-art solutions, with an AUC value of 0.916.

The data flow risk monitoring system of the expressway networking system based on deep learning

To ensure the reliability and safety of expressway networking systems, this paper designs a data flow risk monitoring system for expressway networking systems based on deep learning. The monitoring system is composed of data flow risk analysis, formulation of safety strategy, real-time monitoring, and disaster recovery. Data flow risk analysis is the basis for the operation of each part of the system. Meanwhile, indexes such as network management, data assets, and network resources are selected to build a data flow risk monitoring index system. The deep convolution neural network model is constructed, and the data flow risk monitoring index data are input into the deep convolution neural network to extract the index data features through the convolution and pooling process. Based on this, feature mapping is realized with a multilayer perceptron, and the index data risk classification results of data flow risk monitoring are output by the SoftMax classifier. The experimental results show that the monitoring system can obtain accurate data flow risk analysis results which effectively reduces the data loss rate, alleviate the impact of different types of malicious attacks, and ensure the stability and security of the experimental object.

Representation learning-based network intrusion detection system by capturing explicit and implicit feature interactions

Network intrusion detection system is an important cyber defence tool to protect a system from illegal attacks. Building an effective network intrusion detection system that makes good use of deep learning methods is a challenging task. From the object perspective, different types of malicious attacks have a quite imbalance distribution, especially compared with normal network behaviour. From the feature perspective, the network behaviour description contains heterogeneous features, including numeric and categorical features and complex interactions among these features. To address these two challenges, we propose a novel Network Intrusion Detection System which by learning explicit and implicit feature interactions based on representation learning, i.e., RL-NIDS, which models the network behaviour by learning explicit and implicit feature interactions in both feature value representation and object representation spaces. Specifically, the RL-NIDS consists of two main modules, i.e., unsupervised Feature Value Representation Learning module (FVRL) which aims to learn the feature interactions among categorical features explicitly, and supervised Neural Network for object Representation Learning (NNRL) which aims to learn the implicit interactions in the representation space. Experiments show the effectiveness of RL-NIDS and the object representation learned by RL-NIDS with multiclass classification on two real-world datasets. The RL-NIDS outperforms the state-of-the-art feature selection-based methods and deep learning-based methods in terms of both overall accuracy, precision, recall, and F1 score. The accuracy of classification of NSL-KDD and AWIDS dataset is 81.38% and 95.72%, respectively, achieve 3.9% and 0.9% improvements compare to the second-best method. Moreover, a thorough ablation study demonstrates the contributions of both FVRL and NNRL which complement each other for capturing feature interactions.

A quantum voting protocol using single-particle states

Based on the single-particle states, we propose a novel quantum voting protocol which can select multiple winners from candidates. In this protocol, the voting intentions of voters can be expressed through unitary operation, the voter’s ID information is contained in the ballot, and each ballot is encrypted. In addition, legitimate vote can neither be forged by malicious attackers nor be denied by voters. Considering the influence of the number of candidates and voters on the preparation of quantum states, we propose corresponding grouping strategies, respectively, to reduce the level of d-level single-particle states and the number of quantum states. Security analysis shows that our proposed protocol can resist different types of malicious attacks.

Classification of malicious insiders and the association of the forms of attacks

Purpose The authors argue that the current studies about malicious insiders confuse the fact that malicious attacks belong to two different categories, namely, those that launch instrumental attacks and expressive attacks. The authors collect malicious insider data from publicly available sources and use text-mining techniques to analyze the association between malicious insiders’ characteristics and the different types of attack. Design/methodology/approach The authors investigated the relationship between personality characteristics and different types of malicious attacks. For the personality characteristics, the authors use the same method as Liang et al. (2016), which extracted these characteristics based on a keyword-characteristic dictionary. For different types of malicious attacks, two raters rated each case based on criteria modified from criminology research to determine the degree of expressiveness and instrumentality. Findings The results show that malicious insiders who are manipulative or seeking personal gain tend to carry out instrumental attacks. Malicious insiders who are arrogant tend to conduct expressive attacks. Research limitations/implications This study uses third party articles to identify the personality characteristics of known malicious insiders. As such, not all personality characteristics may have been reported. Data availability was an issue. Practical implications Understanding if different personality characteristics lead different types of attacks can help managers identify employees who exhibit them and mitigate an attack before it occurs. Social implications Malicious insider attacks can have devastating results on businesses and employees. Help to identify potential malicious insiders before they act, may prevent undue harm. Originality/value This study used 132 cases of none malicious insiders to examine their attack objectives. No other study that the authors know of used that many cases.

Experimental Study of Machine-Learning-Based Detection and Identification of Physical-Layer Attacks in Optical Networks

Optical networks are critical infrastructure supporting vital services and are vulnerable to different types of malicious attacks targeting service disruption at the optical layer. Due to the various attack techniques causing diverse physical-layer effects, as well as the limitations and sparse placement of optical performance monitoring devices, such attacks are difficult to detect, and their signatures are unknown. This paper presents an experimental investigation of a machine learning (ML) framework for detection and identification of physical-layer attacks, based on experimental attack traces from an operator field deployed testbed with coherent receivers. We perform in-band and out-of-band jamming signal insertion attacks, as well as polarization scrambling attacks, each with varying intensities. We then evaluate eight different ML classifiers in terms of their accuracy, and scalability in processing experimental data. The optical parameters critical for accurate attack identification are identified and the generalization of the models is validated. Results indicate that artificial neural networks achieve 99.9% accuracy in attack type and intensity classification, and are capable of processing 1 million samples in less than 10 seconds.

Analysis of Wireless Sensor Networks Security Solutions and Countermeasures

Wireless Sensor Network is special type of Ad-hoc network formed with autonomous motes with power and memory constraint. WSN is used in various applications such as healthcare, Environmental monitoring, habitat monitoring military, ecology, home and many more practicable solution for challenging applications of different areas. When wireless sensor networks are deployed in an open, hostile or specific defense environment the security becomes extremely important, since WSN motes are resource constraint there is scope for different types of malicious attacks on them. This paper analyses the security solutions and the security mechanisms that will overcome security issues and attacks and recommends adequate solution for the WSN threats.

CEAP: SVM-based intelligent detection model for clustered vehicular ad hoc networks

The infrastructureless and decentralized nature of Vehicular Ad Hoc Network (VANET) makes it quite vulnerable to different types of malicious attacks. Detecting such attacks has attracted several contributions in the past few years. Nonetheless, the applicability of the current detection mechanisms in the deployed vehicular networks is hindered by two main challenges imposed by the special characteristics of VANETs. The first challenge is related to the highly mobile nature of vehicles that complicates the processes of monitoring, buffering, and analyzing observations on these vehicles as they are continuously moving and changing their locations. The second challenge is concerned with the limited resources of the vehicles especially in terms of storage space that restricts the vehicles’ capacity of storing a huge amount of observations and applying complex detection mechanisms. To tackle these challenges, we propose a multi-decision intelligent detection model called CEAP that complies with the highly mobile nature of VANET with increased detection rate and minimal overhead. The basic idea is to launch cooperative monitoring between vehicles to build a training dataset that is analyzed by the Support Vector Machine (SVM) learning technique in online and incremental fashions to classify the smart vehicles either cooperative or malicious. To adapt the proposed model to the high mobility, we design it on top of the VANET QoS-OLSR protocol, which is a clustering protocol that maintains the stability of the clusters and prolongs the network’s lifetime by considering the mobility metrics of vehicles during clusters formation. To reduce the overhead of the proposed detection model and make it feasible for the resource-constrained nodes, we reduce the size of the training dataset by (1) restricting the data collection, storage, and analysis to concern only a set of specialized nodes (i.e., Multi-Point Relays) that are responsible for forwarding packets on behalf of their clusters; and (2) migrating only few tuples (i.e., support vectors) from one detection iteration to another. We propose as well a propagation algorithm that disseminates only the final decisions (instead of the whole dataset) among clusters with the aim of reducing the overhead of either exchanging results between each set of vehicles or repeating the detection steps for the already detected malicious vehicles. Simulation results show that our model is able to increase the accuracy of detections, enhance the attack detection rate, decrease the false positive rate, and improve the packet delivery ratio in the presence of high mobility compared to the classical SVM-based, Dempster–Shafer-based, and averaging-based detection techniques.

Special issue on trust and security in wireless sensor networks

Special issue on trust and security in wireless sensor networks

A lightweight security scheme for query processing in clustered wireless sensor networks

When wireless sensor networks (WSNs) are deployed in areas inaccessible by human beings, security becomes extremely important, as they are prone to different types of malicious attacks. We propose a scheme to build a security mechanism in a query-processing paradigm within WSNs with clustered architecture. This work aims to preserve the basic security features such as confidentiality and integrity as well as to protect from replay attack in presence of mote class attacker. Considering the limitations of such an attacker, the probability of attacking cluster head and member nodes is higher than attacking the base station. Paying attention to this fact, in all communication between cluster head and member nodes, the key is neither transmitted nor pre-deployed. Performance of the scheme is evaluated and compared through qualitative and quantitative analyses; results show the present scheme’s dominance over the competing schemes.

Key Dissemination Protocol for Data Filtering in Wireless Sensor Networks

Sensor networks may suffer different types of malicious attacks like false report injection attacks, Selective forwarding attacks. Military uses sensor networks for battlefield surveillance. Sensors could monitor vehicular traffic and track the position of the enemy. Recently, a number of filtering schemes against false reports have been proposed. However, they either lack strong filtering capacity or cannot support highly dynamic sensor networks very well. Moreover, few of them can deal with DoS attacks simultaneously. We design the Hill Climbing key dissemination approach and Greedy perimeter stateless routing for wireless networks, that ensures the nodes closer to data sources have stronger filtering capacity. Moreover, we exploit the broadcast property of wireless communication to defeat DoS attacks and adopt multipath routing to deal with the topology changes of sensor networks. Simulation results show that compared to existing solutions, our scheme can drop false reports earlier with less memory consuming and should deliver fast filtering report.

Security Threats and its Countermeasures in Wireless Sensor Networks: An Overview

ireless sensor networks (WSN) have lot of interest in research due to their wide range of typical application areas such as environmental, military and commercial enterprises. Sensor network possesses unique challenges to protocol builders, because these tiny wireless devices are often deployed in unattended environment with limited capabilities. Hence these networks are vulnerable to different types of malicious attacks. This paper surveyed the different types of attacks and security related issues in WSN. Moreover an analysis about some of the security protocols in two major domains namely, cryptography based protocols and en-route filtering schemes have been done.

Identification of malicious nodes in an AODV pure ad hoc network through guard nodes

This paper presents a guard node based scheme to identify malicious nodes in Ad hoc On-Demand Distance Vector (AODV) protocol. In this scheme each node calculates trust level of its neighboring nodes for route selection. Trust calculation process involves opinions of other nodes about the node whose trust level is to be determined. If a neighboring node has a trust level lower than a predefined threshold value, it is identified as malicious and it is not considered for route selection. The proposed model does not use any key distribution process and no changes are made in control packets of AODV. Simulation results show that the proposed scheme improves performance of AODV by identifying and removing malicious nodes. Performance of the scheme has been evaluated for three different types of malicious attacks (impersonation attack, colluding nodes attack and black hole attack).