Existing Detection Approaches Research Articles

A novel CNN‐based approach for detection and classification of DDoS attacks

SummaryAmong the recent network security issues, Distributed Denial of Service (DDoS) attack is one of the most dangerous threats in today's cyberspace that can disrupt essential services. These attacks compromise network security by flooding the target with malicious traffic. Several researchers have designed effective DDoS detection mechanisms using machine learning (ML) and deep learning (DL)‐based techniques. However, existing detection approaches paid less attention to issues such as class imbalance, multi‐classification, or computational cost of the models, especially time. In this study, we propose a novel framework for detecting and classifying DDoS attacks with high accuracy and low computational cost. To address the class imbalance, we employ random sampling, while feature selection techniques such as low information gain, quasi‐constant elimination, and principal component analysis are utilized for optimal feature selection and reduction. Our proposed CNN‐based model achieves outstanding performance, boasting an accuracy of 99.99% for binary classification and 98.44% for multi‐classification. The proposed model is compared to existing works and baseline line models and found to be effective in binary and multi‐classification.

Structural characterization, molecular dynamic simulation, and conformational visualization of a water-soluble glucan with high molecular weight from Gastrodia elata Blume

Polysaccharides have been widely used in the development of natural drugs and health food. However, polysaccharide characterization lags due to inherently complicated features and the limitations of existing detection approaches. We aimed to provide new insight into the fine structure and conformational visualization of polysaccharides from Gastrodia elata Blume, a medicinal and edible plant. A water-soluble polysaccharide (GEP2–6) with the high molecular weight of 2.7 × 106 Da was first obtained, and its purity reached 99.2 %. Chemical and spectroscopic analyses jointly revealed that GEP2–6 was a glucan linked by α-(1 → 4) and α-(1 → 6) glycosidic bonds. After enzymolysis, the local structure of GEP2–6 included α-1,4-Glcp, α-1,6-Glcp, α-1,4,6-Glcp, and α-1-Glcp at a molar ratio of 31.27∶1.32∶1.08∶0.93. The glycosidic linkage pattern of repeating units was further simulated by a glycan database and spatial examination software. The good dissolution performance was interpreted by dynamics simulation and practical molecular characteristics. Spherical flexible chains and the porous stable conformation were corroborated using atomic force microscopy. In addition, GEP2–6 could effectively scavenge DPPH and hydroxyl radicals as a promising natural antioxidant. These efforts will contribute to the expansion of clinical applications of this G. elata polysaccharide and the structural elucidation for macromolecular polysaccharides combined with traditional and modern analysis techniques.

Machine Learning-Based Predictive Models for Detection of Cardiovascular Diseases.

Cardiovascular diseases present a significant global health challenge that emphasizes the critical need for developing accurate and more effective detection methods. Several studies have contributed valuable insights in this field, but it is still necessary to advance the predictive models and address the gaps in the existing detection approaches. For instance, some of the previous studies have not considered the challenge of imbalanced datasets, which can lead to biased predictions, especially when the datasets include minority classes. This study's primary focus is the early detection of heart diseases, particularly myocardial infarction, using machine learning techniques. It tackles the challenge of imbalanced datasets by conducting a comprehensive literature review to identify effective strategies. Seven machine learning and deep learning classifiers, including K-Nearest Neighbors, Support Vector Machine, Logistic Regression, Convolutional Neural Network, Gradient Boost, XGBoost, and Random Forest, were deployed to enhance the accuracy of heart disease predictions. The research explores different classifiers and their performance, providing valuable insights for developing robust prediction models for myocardial infarction. The study's outcomes emphasize the effectiveness of meticulously fine-tuning an XGBoost model for cardiovascular diseases. This optimization yields remarkable results: 98.50% accuracy, 99.14% precision, 98.29% recall, and a 98.71% F1 score. Such optimization significantly enhances the model's diagnostic accuracy for heart disease.

Voice-Face Homogeneity Tells Deepfake

Detecting forgery videos is highly desirable due to the abuse of deepfake. Existing detection approaches contribute to exploring the specific artifacts in deepfake videos and fit well on certain data. However, the growing technique on these artifacts keeps challenging the robustness of traditional deepfake detectors. As a result, the development of these approaches has reached a blockage. In this article, we propose to perform deepfake detection from an unexplored voice-face matching view. Our approach is founded on two supporting points: first, there is a high degree of homogeneity between the voice and face of an individual (i.e., they are highly correlated), and second, deepfake videos often involve mismatched identities between the voice and face due to face-swapping techniques. To this end, we develop a voice-face matching method that measures the matching degree between these two modalities to identify deepfake videos. Nevertheless, training on specific deepfake datasets makes the model overfit certain traits of deepfake algorithms. We instead advocate a method that quickly adapts to untapped forgery, with a pre-training then fine-tuning paradigm. Specifically, we first pre-train the model on a generic audio-visual dataset, followed by the fine-tuning on downstream deepfake data. We conduct extensive experiments over three widely exploited deepfake datasets: DFDC, FakeAVCeleb, and DeepfakeTIMIT. Our method obtains significant performance gains as compared to other state-of-the-art competitors. For instance, our method outperforms the baselines by nearly 2%, achieving an AUC of 86.11% on FakeAVCeleb. It is also worth noting that our method already achieves competitive results when fine-tuned on limited deepfake data.

A graph neural network approach to detect original review spammers of astroturfing campaigns

Online reviews affect consumers’ buying decisions. When astroturfing happens, the posted fake reviews not only cause confusion to the consumers, but in extreme cases, harm the reputation of others. Identifying the original posters of fake review in a discussion forum from the interactions with the peers in a collusive effort is essential to an overall detection strategy. However, existing detection approaches that focus on the mechanic characteristics of the posted reviews may fall short, since fake reviews cause more harm when astroturfing campaign happens involving multiple accomplices. We propose a detection framework with graph neural network, which incorporates the original perpetrator’s stylometric patterns and relationships with other accomplices. The framework was tested against the data collected from real incidents. Multiple deep learning models with fusion techniques were tested. Managerial and theoretical implications are provided.

A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking.

Software-defined networking (SDN) is a revolutionary innovation in network technology with many desirable features, including flexibility and manageability. Despite those advantages, SDN is vulnerable to distributed denial of service (DDoS), which constitutes a significant threat due to its impact on the SDN network. Despite many security approaches to detect DDoS attacks, it remains an open research challenge. Therefore, this study presents a systematic literature review (SLR) to systematically investigate and critically analyze the existing DDoS attack approaches based on machine learning (ML), deep learning (DL), or hybrid approaches published between 2014 and 2022. We followed a predefined SLR protocol in two stages on eight online databases to comprehensively cover relevant studies. The two stages involve automatic and manual searching, resulting in 70 studies being identified as definitive primary studies. The trend indicates that the number of studies on SDN DDoS attacks has increased dramatically in the last few years. The analysis showed that the existing detection approaches primarily utilize ensemble, hybrid, and single ML-DL. Private synthetic datasets, followed by unrealistic datasets, are the most frequently used to evaluate those approaches. In addition, the review argues that the limited literature studies demand additional focus on resolving the remaining challenges and open issues stated in this SLR.

Denoising by Decorated Noise: An Interpretability-Based Framework for Adversarial Example Detection

The intelligent imaging sensors in IoT benefit a lot from the continuous renewal of deep neural networks (DNNs). However, the appearance of adversarial examples leads to skepticism about the trustworthiness of DNNs. Malicious perturbations, even unperceivable for humans, lead to incapacitations of a DNN, bringing about the security problem in the information integration of an IoT system. Adversarial example detection is an intuitive solution to judge if an input is malicious before acceptance. However, the existing detection approaches, more or less, have some shortcomings like (1) modifying the network structure, (2) extra training before deployment, and (3) requiring some prior knowledge about attacks. To address these problems, this paper proposes a novel framework to filter out the adversarial perturbations by superimposing the original images with the noises decorated by a new gradient-independent visualization method, namely, score class activation map (Score-CAM). We propose to trim the Gaussian noises in a way with more explicit semantic meaning and stronger explainability, which is different from the previous studies based on intuitive hypotheses or artificial denoisers. Our framework requires no extra training and gradient calculation, which is friendly to embedded devices with only inference capabilities. Extensive experiments demonstrate that the proposed framework is sufficiently general to detect a wide range of attacks and apply it to different models.

A DIABETES PREDICTION CLASSIFIER MODEL USING NAIVE BAYES ALGORITHM

One serious health condition which has made people to suffer from uncontrollable high blood sugar is diabetes. The problems of existing detection approaches are data imbalance, feature selection, and lack of generic framework for diabetes classification. In this research, developed an ontology-based diabetes classification model using naïve Bayes classifier was developed. The model is divided into five modules: data collection, feature selection, ontology construction, classification, and document query. The data collection module adapted PIMA Indian Diabetes Database to predict diabetes. The feature selection module employed multi-step approach for selecting the most important features from dataset. For automatically constructing ontology rules based on the chosen features, the ontology generation module used a decision tree classifier. Based on the user's question, the classification module employed a Nave Bayes classifier to automatically classify the built ontology as having diabetes. Based on the ontology-based nave Bayes classification, the document query module searches and returns the anticipated documents requested by users. The proposed model using a 10-fold cross validation performed better in diabetes in precision, accuracy, recall and F1-score of 96.5%, 93.55%, 79.2% and 87.0%, respectively. Benchmarking tools included K-Nearest Neighbor (KNN), Decision Tree (DT), Multilayer Perceptron (MLP), Logistic Regression (LR), Hidden Markov Model (HMM), Support Vector Machine (SVM), Naive Bayes (NB), Random Forest (RF), and Deep Convolutional Neural Network (DCNN). With an area of 0.9578 in compared to other relevant methods, the created model suggested a more accurate test. They demonstrated that the model's cost-effectiveness for predicting diabetes outweighs its value.

Collaborative prediction and detection of DDoS attacks in edge computing: A deep learning-based approach with distributed SDN

Edge computing (EC) has greatly facilitated the deployment of networked services with fast responses and low bandwidth, by deploying computing and storage at the network edge which is closer to the data sources. However, it is challenging to have the EC servers gain security protections like those in centralized data centers, making them more vulnerable to security attacks, especially distributed denial-of-service (DDoS) attacks. Existing detection approaches relying on the feedback from EC servers under the attacks can incur high bandwidth costs and service performance degradation. In this paper, we propose a new framework CoWatch for collaborative prediction and detection of DDoS Attacks in EC scenarios. Based on the distributed software-defined networking (SDN) architecture, CoWatch can collaboratively predict the DDoS attacks towards the EC servers and detect the attack flows in time. To efficiently filter the suspicious flows in distributed SDN, we devise an optimal threshold model by balancing the trade-off between collaboration efficiency and prediction effectiveness. We also explore and build on the LSTM model to design an algorithm for collaborative prediction and detection of DDoS Attacks. Experiment results on a number of datasets demonstrate the promising performance of CoWatch in effectiveness and efficiency.

Vizard: Passing Over Profiling-Based Detection by Manipulating Performance Counters

Cache side-channel attacks have been serious security threats to server computer systems, thus researchers have proposed software-based defense approaches that can detect the security attacks. Profiling-based detectors are lightweight detection solutions that rely on hardware performance counters to identify unique cache performance behaviors by cache side-channel attacks. The detectors typically need to set appropriate criteria to differentiate between attack processes and normal applications. In this paper, we explore the limitations of profiling-based detectors that rely on hardware performance counters.We present an attack scenario, called Vizard, that can bypass the existing profiling-based detectors by manipulating cache performance behaviors of an attack process. Our analysis discloses that cache side-channel attacks include idle periods that can be exploited as attack windows for creating cache events. Vizard generates counterbalancing cache events within the attack windows to hide particular cache performance behaviors of cache side-channel attacks. Our evaluation exhibits that Vizard can effectively bypass profiling-based detectors while maintaining high attack success rates. Our research work represents that attackers can bypass the existing detection approaches by manipulating performance counters.

Anomaly Detection for Hyperspectral Imagery via Tensor Low-Rank Approximation With Multiple Subspace Learning

Hyperspectral anomaly detection (HAD) is regarded as an indispensable, pivotal technology in remote sensing and earth science domains. Nevertheless, most existing detection approaches for anomaly targets flatten 3-D hyperspectral images (HSIs) with spatial and spectral information into 2-D spectral vector data, which virtually breaks up the internal spatial structure in HSIs and degenerates the detection performance. To this end, we directly consider the HSI data cube as a 3-D tensor and develop a novel tensor low-rank approximation (TLRA) detection algorithm to separate the sparse anomalous component from the background with low-rank characteristics. Then, in light of the multi-subspace structure in heterogeneous backgrounds, we utilize multiple subspace learning (MSL) theory to encode the background tensor with a coefficient tensor and corresponding dictionary tensor. In addition, considering that different singular values indicate different information quantities and should be penalized to different extents, we introduce a tighter tensor rank surrogate named the ϵ-shrinkage tensor nuclear norm (ϵ-TNN) to recover the low-rank component more accurately. Meanwhile, concerning the sparse anomaly target, the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">l</i> <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2,1</sub> constraint is incorporated to represent the group sparsity of the abnormal component. Finally, an effective iterative optimization algorithm based on the alternating direction method of multipliers (ADMM) is devised to solve the proposed TLRA-MSL model. We conduct extensive experiments on six hyperspectral datasets to prove the effectiveness and robustness of our method. The experimental results illustrate that better detection performance is obtained using the proposed model compared with other state-of-the-art algorithms.

ConstDet: Control Semantics-Based Detection for GPS Spoofing Attacks on UAVs

UAVs are widely used in agriculture, the military, and industry. However, it is easy to perform GPS spoofing attacks on UAVs, which can lead to catastrophic consequences. In this paper, we propose ConstDet, a control semantics-based detection approach for GPS spoofing attacks of UAVs using machine learning algorithms. Various real experiments are conducted to collect real flight data, on the basis of which ConstDet is designed as a practical detection framework. To train models for the detection of GPS spoofing attacks, specified flight data types are selected as features based on the control semantics, including the altitude control process and the horizontal position control process, since these data are able to represent the dynamic flight and control processes. Multiple machine learning algorithms are used to train and generate the best classifier for GPS spoofing attacks. ConstDet is further implemented and deployed on a real UAV to support onboard detection. Experiments and evaluations validate that ConstDet can effectively detect GPS spoofing attacks and the detection rate can reach 97.70%. The experimental comparison demonstrates that ConstDet has better performance than existing detection approaches.

Detection of Floating Garbage on Water Surface Based on PC-Net

In the detection of surface floating garbage, the existence of complex backgrounds and the small target sizes make the surface floating garbage easy to mis-detect. Existing approaches cannot yet provide a solution to the aforementioned problems and they are typically limited to addressing specific issues. This paper proposes a PC-Net algorithm for floating garbage detection. First, a pyramid anchor generation approach is proposed, which makes the anchor to be generated centrally near the target and reduces the interference of background information in the anchor generation. Then, in the RoI Pooling feature map import stage, the classification map is used as the feature map. This approach generates feature maps with a higher resolution and more distinct features, thereby enhancing the feature information of small targets and enhancing the classification accuracy. Experimental results on floating garbage dataset indicate that the average detection accuracy of the proposed approach is 86.4%. Compared with existing detection approaches, such as Faster R-CNN, YOLOv3, YOLOX, and Dynamic R-CNN, the average accuracy of detection is increased by 4.1%, 3.6%, and 2.8%, respectively.

Hybrid model for bot group activity detection using similarity and correlation approaches based on network traffic flows analysis

In this cyber era, botnets have been a serious threat to computer network security in that they can infect computers connected to a network through malicious applications known as malware. Unlike their previous behavior, botnets have evolved from being centralized to decentralized. Thus, detecting and handling bots' activity is challenging. On the other hand, botnets can actively infect and attack the target concurrently, called bot group activities. Existing detection approaches cannot recognize the activity relation between bots in their group, called activity correlation. This correlation is crucial in obtaining the activity causality between bots because it can identify which bot activity affects the other bot activities during the attack. It is the causality of bot activities that helps prevent bot group attacks. This paper proposes a new model for detecting bot group activity using a hybrid analysis approach, which includes extracting activity patterns using a sliding window segmentation technique, analyzing activity similarities between bots, and analyzing their correlation. The experiment uses two public datasets to evaluate the proposed method. The results show that it can detect bot group activity with as high as 99.73% accuracy, which is better than others, with less than 1% of the false-positive rate.

A Correlation-Based Anomaly Detection Model for Wireless Body Area Networks Using Convolutional Long Short-Term Memory Neural Network.

As the Internet of Healthcare Things (IoHT) concept emerges today, Wireless Body Area Networks (WBAN) constitute one of the most prominent technologies for improving healthcare services. WBANs are made up of tiny devices that can effectively enhance patient quality of life by collecting and monitoring physiological data and sending it to healthcare givers to assess the criticality of a patient and act accordingly. The collected data must be reliable and correct, and represent the real context to facilitate right and prompt decisions by healthcare personnel. Anomaly detection becomes a field of interest to ensure the reliability of collected data by detecting malicious data patterns that result due to various reasons such as sensor faults, error readings and possible malicious activities. Various anomaly detection solutions have been proposed for WBAN. However, existing detection approaches, which are mostly based on statistical and machine learning techniques, become ineffective in dealing with big data streams and novel context anomalous patterns in WBAN. Therefore, this paper proposed a model that employs the correlations that exist in the different physiological data attributes with the ability of the hybrid Convolutional Long Short-Term Memory (ConvLSTM) techniques to detect both simple point anomalies as well as contextual anomalies in the big data stream of WBAN. Experimental evaluations revealed that an average of 98% of F1-measure and 99% accuracy were reported by the proposed model on different subjects of the datasets compared to 64% achieved by both CNN and LSTM separately.

Detecting Correlated Residuals in Exploratory Factor Analysis: New Proposals and a Comparison of Procedures

ABSTRACT In the classical exploratory factor analysis (EFA) model, residuals are constrained to be uncorrelated. However, since the 1960s, extensions of the classical model that allow correlated residuals to be modeled exist. Furthermore, in many EFA applications (especially those intended for item analysis) it is highly relevant to decide whether an extended solution is more appropriate than the simpler classical solution. This decision, in turn, requires effective and powerful methods for detecting correlated residuals (doublets) when they are really present to be available. This paper discusses two existing detection approaches in the EFA context, and proposes a third, new procedure. Reference values, based on the concept of parallel analysis, are proposed for deciding the relevance of the flagged doublets in all the considered procedures. The functioning of the three procedures is assessed by using simulation, and illustrated with an illustrative example. The proposal, finally, has been implemented in a well-known noncommercial EFA program, and an implementation in R is being developed.

Mycobacterium tuberculosis piezoelectric sensor based on AuNPs-mediated enzyme assisted signal amplification

Rapid diagnosis of tuberculosis disease (TB) still remained a pressing need for TB control efforts all over the world. However, the existing detection approaches cannot satisfy demand of rapid detection of clinical Mycobacterium tuberculosis (M. tuberculosis) because of the long detection time and high cost. Herein, we proposed a new M. tuberculosis piezoelectric sensor based on AuNPs-mediated enzyme assisted signal amplification. A hairpin-shaped DNA duplex with a protrusion of the 3′ end was designed. In the presence of specific 16 S rDNA fragment of M. tuberculosis, the hairpin probe was opened, which triggered the selective cleavage of hairpin probe by Exonuclease III (Exo III), resulting in the release of uncut DNA probe and target DNA. The released target DNA hybridized with another hairpin-shaped DNA duplex, and a new digestion cycle was started, thus generating large amounts of uncut DNA probes. The uncut DNA was pulled to the electrode surface by the hybridization with capture probe modified on the electrode. Subsequently detection probe labeled AuNPs was hybridized with uncut DNA and entered between the two electrodes. The AuNPs linked to hybridized detection probe were grown in the HAuCl4 and Nicotinamide adenine dinucleotide (NADH) solution and offered the conductive connection between the gaps of electrode. The changes were monitored by the piezoelectric sensor. The piezoelectric biosensor could achieve a detection of M. tuberculosis (102–108 CFU mL−1) within 3 h, the detection limit (LOD) was 30 CFU mL−1. The methodology could be transformed into different microbial targets, which is suitable for further development of small portable equipment and multifunctional detection.

NIR-II Photoacoustic Reporter for Biopsy-Free and Real-Time Assessment of Wilson's Disease.

Wilson's disease (WD) is a rare inherited disorder of copper metabolism with pathological copper hyperaccumulation in some vital organs. However, the clinical diagnosis technique of WD is complicated, aggressive, and time-consuming. In this work, a novel ratiometric photoacoustic (PA) imaging nanoprobe in the NIR-II window is developed to achieve noninvasive, rapid, and accurate Cu2+ quantitative detection in vitro and in vivo. The nanoprobe consists of Cu2+ -responsive IR970 dye and a nonresponsive palladium-coated gold nanorod (AuNR-Pd), achieving a concentration-dependent ratiometric PA970 /PA1260 signal change. The urinary Cu2+ content is detectable within minutes down to a detection limit of 76× 10-9 m. This report acquisition time is several orders of magnitude shorter than those of existing detection approaches requiring complex procedure. Moreover, utilizing the ratiometric PA nanoprobe, PA imaging enables biopsy-free measurement of the liver Cu2+ content and visualization of the liver Cu2+ biodistribution of WD patient, which avoid the body injury during the clinical Cu2+ test using liver biopsy method. The NIR-II ratiometric PA detection method is simple and noninvasive with super precision, celerity, and simplification, which holds great promise as an alternative to liver biopsy for clinical diagnosis of WD.

Maximizing cohesion and separation for detecting protein functional modules in protein-protein interaction networks.

Protein Function Module (PFM) identification in Protein-Protein Interaction Networks (PPINs) is one of the most important and challenging tasks in computational biology. The quick and accurate detection of PFMs in PPINs can contribute greatly to the understanding of the functions, properties, and biological mechanisms in research on various diseases and the development of new medicines. Despite the performance of existing detection approaches being improved to some extent, there are still opportunities for further enhancements in the efficiency, accuracy, and robustness of such detection methods. Based on the uniqueness of the network-clustering problem in the context of PPINs, this study proposed a very effective and efficient model based on the Lin-Kernighan-Helsgaun algorithm for detecting PFMs in PPINs. To demonstrate the effectiveness and efficiency of the proposed model, computational experiments are performed using three different categories of species datasets. The computational results reveal that the proposed model outperforms existing detection techniques in terms of two key performance indices, i.e., the degree of polymerization inside PFMs (cohesion) and the deviation degree between PFMs (separation), while being very fast and robust. The proposed model can be used to help researchers decide whether to conduct further expensive and time-consuming biological experiments and to select target proteins from large-scale PPI data for further detailed research.

Sato

Detecting the semantic types of data columns in relational tables is important for various data preparation and information retrieval tasks such as data cleaning, schema matching, data discovery, and semantic search. However, existing detection approaches either perform poorly with dirty data, support only a limited number of semantic types, fail to incorporate the table context of columns or rely on large sample sizes for training data. We introduce Sato, a hybrid machine learning model to automatically detect the semantic types of columns in tables, exploiting the signals from the table context as well as the column values. Sato combines a deep learning model trained on a large-scale table corpus with topic modeling and structured prediction to achieve support-weighted and macro average F1 scores of 0.925 and 0.735, respectively, exceeding the state-of-the-art performance by a significant margin. We extensively analyze the overall and per-type performance of Sato, discussing how individual modeling components, as well as feature categories, contribute to its performance.