Including Intrusion Detection Systems Research Articles

Cybersecurity in Autonomous Vehicles—Are We Ready for the Challenge?

The rapid development and deployment of autonomous vehicles (AVs) present unprecedented opportunities and challenges in the transportation sector. While AVs promise enhanced safety, efficiency, and convenience, they also introduce significant cybersecurity vulnerabilities due to their reliance on advanced electronics, connectivity, and artificial intelligence (AI). This review examines the current state of cybersecurity in autonomous vehicles, identifying major threats such as remote hacking, sensor manipulation, data breaches, and denial of service (DoS) attacks. It also explores existing countermeasures including intrusion detection systems (IDSs), encryption, over-the-air (OTA) updates, and authentication protocols. Despite these efforts, numerous challenges remain, including the complexity of AV systems, lack of standardization, latency issues, and resource constraints. This review concludes by highlighting future directions in cybersecurity research and development, emphasizing the potential of AI and machine learning, blockchain technology, industry collaboration, and legislative measures to enhance the security of autonomous vehicles.

Knowledge graph reasoning for cyber attack detection

AbstractIn today's digital landscape, cybercriminals are constantly evolving their tactics, making it challenging for traditional cybersecurity methods to keep up. To address this issue, this study explores the potential of knowledge graph reasoning as a more adaptable and sophisticated approach to identify and counter network attacks. By leveraging graph structures imbued with human‐like thinking, this method enhances the resilience of cybersecurity systems. The study focuses on three critical aspects: data preparation, semantic foundations, and knowledge graph inference techniques. Through an in‐depth analysis of these components, the research aims to reveal how knowledge graph reasoning can improve cyberattack detection and enhance the overall efficacy of cybersecurity measures, including intrusion detection systems. The proposed approach has undergone extensive experimentation to validate its effectiveness compared to existing methods. The results of the experiment have shown a remarkable advancement in accuracy, speed, and recall for recognition, surpassing current methods. This achievement is a notable contribution in the realm of managing big data in cybersecurity. The study establishes a foundation for the automation of network attack detection, ultimately enhancing overall network security.

A Holistic Review of Machine Learning Adversarial Attacks in IoT Networks

With the rapid advancements and notable achievements across various application domains, Machine Learning (ML) has become a vital element within the Internet of Things (IoT) ecosystem. Among these use cases is IoT security, where numerous systems are deployed to identify or thwart attacks, including intrusion detection systems (IDSs), malware detection systems (MDSs), and device identification systems (DISs). Machine Learning-based (ML-based) IoT security systems can fulfill several security objectives, including detecting attacks, authenticating users before they gain access to the system, and categorizing suspicious activities. Nevertheless, ML faces numerous challenges, such as those resulting from the emergence of adversarial attacks crafted to mislead classifiers. This paper provides a comprehensive review of the body of knowledge about adversarial attacks and defense mechanisms, with a particular focus on three prominent IoT security systems: IDSs, MDSs, and DISs. The paper starts by establishing a taxonomy of adversarial attacks within the context of IoT. Then, various methodologies employed in the generation of adversarial attacks are described and classified within a two-dimensional framework. Additionally, we describe existing countermeasures for enhancing IoT security against adversarial attacks. Finally, we explore the most recent literature on the vulnerability of three ML-based IoT security systems to adversarial attacks.

Efficient Inductive Transfer Learning based Framework for Zero-Day Attack Detection

An Intrusion Detection System (IDS) is a type of security domain that tracks and evaluates network connections or system operations to detect potential security breaches, unauthorized usage, and malicious activity within computer networks. Machine learning (ML) and deep learning (DL) algorithms provide better IDS based on the labelled dataset. However, due to a lack of labelled data, its effectiveness in detecting zero-day attacks is limited. Anomaly detection methods frequently produce high False Positive Rates (FPR). Transfer learning (TL) is a powerful technique in various domains, including intrusion detection systems (IDS). It also creates advanced classifiers using knowledge extracted from the related source domain(s) with little or no labelled data. This paper introduced zero-day attack detection (ZDAD) model by combining it with transfer learning that helps classify the attacks and non-attacks from the given dataset. Using the UNSW-NB15 dataset, the authors created a Transfer Learning-based prototype in this study. The goal was to unify the feature space for distinguishing unlabeled Generic samples representing zero-day attacks from regular instances using labelled DoS samples. The ZDAD performed admirably, achieving 99.24% accuracy and a low False Positive Rate (FPR) of 0.02%. This performance outperforms current state-of-the-art methods.

An interpretable approach for trustworthy intrusion detection systems against evasion samples

In recent years, Deep Neural Networks (DNN) have demonstrated remarkable success in various domains, including Intrusion Detection Systems (IDS). The ability of DNN to learn complex patterns from large datasets has significantly improved IDS performance, leading to more accurate and efficient threat detection. Despite their effectiveness, DNN models exhibit vulnerabilities to adversarial attacks, where malicious inputs are specifically crafted to deceive the models and evade detection. This paper provides insights into the effectiveness of deep learning-based IDS (DL-IDS) against adversarial example (AE) attacks. We tackle the weaknesses of DNN in detecting adversarial attacks by proposing the Convolutional Neural Network (CNN), which serves as an AE detector. We also utilize one of the XAI techniques, specifically SHAP, to enhance the transparency of the AE detector. Our results show that the AE detector has obvious effects for detecting adversarial examples and achieves an impressive 99.46% accuracy in our experimental environment.

Security assessment of in-vehicle communication protocols

As the automotive industry has progressed in recent years, in-vehicle networks have also changed. In contrast to traditional vehicles, modern vehicles communicate through connecting interfaces, Electronic Control Units (ECUs), sensors, and gateways over different communication channels called buses. While LIN, CAN, FlexRay, MOST, and Automotive Ethernet protocols facilitate vehicle communication, they expose vehicles to various security risks. Electronics in vehicles must be advanced to improve passenger safety, comfort, and vehicle performance. However, security issues must also be addressed to ensure vehicle resilience. This paper presents an in-depth and comprehensive analysis of the security issues associated with in-vehicle network protocols. We examine the feasibility, severity, and potential consequences of these security issues, which can be used to better understand the risks and vulnerabilities within in-vehicle networks. Furthermore, the paper examines existing solutions that aim to mitigate the identified attacks, including intrusion detection systems (IDSs), firewalls, authentication, and schedulers, while evaluating their effectiveness and drawbacks. Hence, we enable automotive security engineers to comprehend the current state of security measures used to protect in-vehicle networks and identify areas where further research is needed to develop more effective and tailored security solutions. Finally, the paper provides recommendations for future research and the development of security solutions that researchers can use to guide their research efforts for in-vehicle network security.

Enhancing feature selection with GMSMFO: A global optimization algorithm for machine learning with application to intrusion detection

Abstract The paper addresses the limitations of the Moth-Flame Optimization (MFO) algorithm, a meta-heuristic used to solve optimization problems. The MFO algorithm, which employs moths' transverse orientation navigation technique, has been used to generate solutions for such problems. However, the performance of MFO is dependent on the flame production and spiral search components, and the search mechanism could still be improved concerning the diversity of flames and the moths' ability to find solutions. The authors propose a revised version called GMSMFO, which uses a Novel Gaussian mutation mechanism and shrink MFO to enhance population diversity and balance exploration and exploitation capabilities. The study evaluates the performance of GMSMFO using the CEC 2017 benchmark and 20 datasets, including a high-dimensional intrusion detection system dataset. The proposed algorithm is compared to other advanced metaheuristics, and its performance is evaluated using statistical tests such as Friedman and Wilcoxon rank-sum. The study shows that GMSMFO is highly competitive and frequently superior to other algorithms. It can identify the ideal feature subset, improving classification accuracy and reducing the number of features used. The main contribution of this research paper includes the improvement of the exploration/exploitation balance and the expansion of the local search. The ranging controller and Gaussian mutation enhance navigation and diversity. The research paper compares GMSMFO with traditional and advanced metaheuristic algorithms on 29 benchmarks and its application to binary feature selection on 20 benchmarks, including intrusion detection systems. The statistical tests (Wilcoxon rank-sum and Friedman) evaluate the performance of GMSMFO compared to other algorithms. The algorithm source code is available at https://github.com/MohammedQaraad/GMSMFO-algorithm.

A Cloud Intrusion Detection Systems Based on DNN Using Backpropagation and PSO on the CSE-CIC-IDS2018 Dataset

Cloud computing (CC) is becoming an essential technology worldwide. This approach represents a revolution in data storage and collaborative services. Nevertheless, security issues have grown with the move to CC, including intrusion detection systems (IDSs). Intruders have developed advanced tools that trick the traditional IDS. This study attempts to contribute toward solving this problem and reducing its harmful effects by boosting IDS performance and efficiency in a cloud environment. We build two models based on deep neural networks (DNNs) for this study: the first model is built on a multi-layer perceptron (MLP) with backpropagation (BP), and the other is trained by MLP with particle swarm optimization (PSO). We use these models to deal with binary and multi-class classification on the updated cybersecurity CSE-CIC-IDS2018 dataset. This study aims to improve the accuracy of detecting intrusion attacks for IDSs in a cloud environment and to enhance other performance metrics. In this study, we document all aspects of our experiments in depth. The results show that the best accuracy obtained for binary classification was 98.97% and that for multi-class classification was 98.41%. Furthermore, the results are compared with those from the related literature.

Explainable Intrusion Detection for Cyber Defences in the Internet of Things: Opportunities and Solutions

The field of Explainable Artificial Intelligence (XAI) has garnered considerable research attention in recent years, aiming to provide interpretability and confidence to the inner workings of state-of-the-art deep learning models. However, XAI-enhanced cybersecurity measures in the Internet of Things (IoT) and its sub-domains, require further investigation to provide effective discovery of attack surfaces, their corresponding vectors, and interpretable justification of model outputs. Cyber defence involves operations conducted in the cybersecurity field supporting mission objectives to identify and prevent cyberattacks using various tools and techniques, including intrusion detection systems (IDS), threat intelligence and hunting, and intrusion prevention. In cyber defence, especially anomaly-based IDS, the emerging applications of deep learning models require the interpretation of the models’ architecture and the explanation of models’ prediction to examine how cyberattacks would occur. This paper presents a comprehensive review of XAI techniques for anomaly-based intrusion detection in IoT networks. Firstly, we review IDSs focusing on anomaly-based detection techniques in IoT and how XAI models can augment them to provide trust and confidence in their detections. Secondly, we review AI models, including machine learning (ML) and deep learning (DL), for anomaly detection applications and IoT ecosystems. Moreover, we discuss DL’s ability to effectively learn from large-scale IoT datasets, accomplishing high performances in discovering and interpreting security events. Thirdly, we demonstrate recent research on the intersection of XAI, anomaly-based IDS and IoT. Finally, we discuss the current challenges and solutions of XAI for security applications in the cyber defence perspective of IoT networks, revealing future research directions. By analysing our findings, new cybersecurity applications that require XAI models emerge, assisting decision-makers in understanding and explaining security events in compromised IoT networks.

STUDY OF THE STRUCTURE OF THE SYSTEM FOR DETECTING AND PREVENTING RANSOMWARE ATTACKS BASED ON ENDPOINT DETECTION AND RESPONSE

The paper discusses the challenges and limitations of current ransomware detection and prevention systems, as well as potential future developments in the field. One key challenge is the constantly evolving nature of ransomware attacks, which requires systems to be regularly updated and adapted to stay effective. Another challenge is the need for systems to be able to distinguish between legitimate and malicious software, as well as different types of ransomware. To address these challenges, the paper proposes a number of functional and non-functional requirements for ransomware detection and counteraction systems. These include the ability to detect and respond to attacks in real time or close to it, the ability to analyze and classify different types of ransomware, and the ability to integrate with other security systems and tools. Additionally, non-functional requirements such as scalability, performance, and security should also be considered.The paper also presents a detailed analysis of the different types of ransomware detection and counteraction systems currently available, including intrusion detection systems (IDS), endpoint detection and response (EDR), and modern antiviruses. It also provides a comparison of their strengths and weaknesses, and a classification of existing solutions according to their similarity. Finally, the paper presents an evaluation algorithm for assessing the quality of products for detecting and countering ransomware. The algorithm is based on a set of functional and non-functional requirements and is designed to provide a comprehensive and objective assessment of the capabilities of different systems. The algorithm is validated through a series of tests and experiments, which demonstrate its effectiveness in identifying the best solutions for detecting and countering ransomware. Overall, this paper provides valuable insights and practical guidance for organizations looking to improve their defenses against ransomware attacks.

NETWORK ANOMALY DETECTION BASED ON WEIGHTED AGGREGATION TAKING INTO ACCOUNT NODAL PARAMETERS

The bulk move of employees to a remote mode of work, as well as the intensified information confrontation, led to the emergence and aggravation of many problems related to security in corporate networks. Cases of attacks on local area networks, in particular, using phishing and social engineering techniques, distribution of malicious code, and DDoS attacks, have become more frequent. To ensure the security of corporate networks, layered protection systems, including intrusion detection systems, firewalls, antivirus protection tools, various system analyzers etc., are increasingly being used. The use of several types of information protection tools not only reduces the load on individual tools, but also facilitates ability to identify actual attacks on the protected system. This article proposes a hybrid approach to anomaly detection, taking into account the parameters of the end nodes of the network. Enriching with values of these parameters makes it possible to detect low-intensity distributed attacks, thereby increasing the accuracy of the defense system. The transformation of parameters of network end nodes to the format of network session parameters is implemented using regrouping and dimensionality reduction. Ensembles of classifiers which inputs receive the session parameters and the parameters of the network nodes respectively, provide determining anomalies. Ensembles are based on logistic regression, stochastic gradient descent and decision trees. Combining of the classification results is accomplished through the weighted aggregation with anxiety threshold as a weighting factor. An experimental evaluation of the developed approach showed its advantages in comparison with the detection of anomalies without taking into account the parameters of the nodes.

Online Distributed Denial of Service (DDoS) intrusion detection based on adaptive sliding window and morphological fractal dimension

Distributed Denial of Service (DDOS) attacks are important threats to network services and applications. Studies in literature have proposed various approaches including Intrusion Detection Systems (IDS) based on the application of machine learning and deep learning, but their computational cost can be significant. For this reason, other studies have proposed efficient IDS algorithms based on the online real-time analysis of the network traffic with a sliding window and entropy or other statistical measures. This paper proposes an online algorithm based on a sliding window with the novel application of the Morphological Fractal Dimension (MFD) to this problem. The results presented in this study show that the application of MFD to the recent CICIDS2017 public data set can obtain a significant improvement in the detection of the DDoS attack in comparison to entropy based approaches. In addition, this paper proposes a novel algorithm for the automatic definition of the sliding window size. This paper reports the impact of the different hyper-parameters, including the parameters present in the definition of MFD and the evaluation of the distance measures, where the Chebyschev distance provides the optimal detection accuracy. The results show a detection accuracy of 99.30%, which performs better than similar approaches on the same data set.

An Effective Feature Selection Model Using Hybrid Metaheuristic Algorithms for IoT Intrusion Detection.

The increasing use of Internet of Things (IoT) applications in various aspects of our lives has created a huge amount of data. IoT applications often require the presence of many technologies such as cloud computing and fog computing, which have led to serious challenges to security. As a result of the use of these technologies, cyberattacks are also on the rise because current security methods are ineffective. Several artificial intelligence (AI)-based security solutions have been presented in recent years, including intrusion detection systems (IDS). Feature selection (FS) approaches are required for the development of intelligent analytic tools that need data pretreatment and machine-learning algorithm-performance enhancement. By reducing the number of selected features, FS aims to improve classification accuracy. This article presents a new FS method through boosting the performance of Gorilla Troops Optimizer (GTO) based on the algorithm for bird swarms (BSA). This BSA is used to boost performance exploitation of GTO in the newly developed GTO-BSA because it has a strong ability to find feasible regions with optimal solutions. As a result, the quality of the final output will increase, improving convergence. GTO-BSA’s performance was evaluated using a variety of performance measures on four IoT-IDS datasets: NSL-KDD, CICIDS-2017, UNSW-NB15 and BoT-IoT. The results were compared to those of the original GTO, BSA, and several state-of-the-art techniques in the literature. According to the findings of the experiments, GTO-BSA had a better convergence rate and higher-quality solutions.

Using statistical traffic analysis to calculate the confidential means of information transmission

The article considers the modeling of security problems in the Internet as stochastic systems. This allows you to find flaws in existing security systems and offer new solutions. Studying the vulnerabilities of existing security tools can prevent cyber-attacks from taking advantage of weak systems. New, flexible and adaptive security schemes are necessary for emerging security threats elimination. A hybrid network security scheme, including intrusion detection systems and baits, scattered throughout the network is proposed. This combines the advantages of two security technologies. Honeypot is an activity-based network security system that can be a logical addition to the passive detection policies used by the IDS. This integration forces us to balance the safety indicators compared to costs, planning the operation of the device for the proposed system. Formulation of planning problems as a decentralized partially observable Markov decision-making process (DEC-POMDP) allows to make decisions in a distributed manner on each device without the need of centralized management.

A Deep Learning Method With Filter Based Feature Engineering for Wireless Intrusion Detection System

In recent years, the increased use of wireless networks for the transmission of large volumes of information has generated a myriad of security threats and privacy concerns; consequently, there has been the development of a number of preventive and protective measures including intrusion detection systems (IDS). Intrusion detection mechanisms play a pivotal role in securing computer and network systems; however, for various IDS, the performance remains a major issue. Moreover, the accuracy of existing methodologies for IDS using machine learning is heavily affected when the feature space grows. In this paper, we propose a IDS based on deep learning using feed forward deep neural networks (FFDNNs) coupled with a filter-based feature selection algorithm. The FFDNN-IDS is evaluated using the well-known NSL-knowledge discovery and data mining (NSL-KDD) dataset and it is compared to the following existing machine learning methods: support vectors machines, decision tree, K-Nearest Neighbor, and Naive Bayes. The experimental results prove that the FFDNN-IDS achieves an increase in accuracy in comparison to other methods.

Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-Scale IoT Exploitations

The security issue impacting the Internet-of-Things (IoT) paradigm has recently attracted significant attention from the research community. To this end, several surveys were put forward addressing various IoT-centric topics, including intrusion detection systems, threat modeling, and emerging technologies. In contrast, in this paper, we exclusively focus on the ever-evolving IoT vulnerabilities. In this context, we initially provide a comprehensive classification of state-of-the-art surveys, which address various dimensions of the IoT paradigm. This aims at facilitating IoT research endeavors by amalgamating, comparing, and contrasting dispersed research contributions. Subsequently, we provide a unique taxonomy, which sheds the light on IoT vulnerabilities, their attack vectors, impacts on numerous security objectives, attacks which exploit such vulnerabilities, corresponding remediation methodologies and currently offered operational cyber security capabilities to infer and monitor such weaknesses. This aims at providing the reader with a multidimensional research perspective related to IoT vulnerabilities, including their technical details and consequences, which is postulated to be leveraged for remediation objectives. Additionally, motivated by the lack of empirical (and malicious) data related to the IoT paradigm, this paper also presents a first look on Internet-scale IoT exploitations by drawing upon more than 1.2 GB of macroscopic, passive measurements’ data. This aims at practically highlighting the severity of the IoT problem, while providing operational situational awareness capabilities, which undoubtedly would aid in the mitigation task, at large. Insightful findings, inferences and outcomes in addition to open challenges and research problems are also disclosed in this paper, which we hope would pave the way for future research endeavors addressing theoretical and empirical aspects related to the imperative topic of IoT security.

Interview with Helen Ashman

Helen Ashman has been interested in hypertext and user profiling for two decades now, initially in adaptive hypermedia systems, later including intrusion detection systems, and now in authorship attribution applications such as plagiarism detection and astroturfing detection. She was at the Australian Defence Science and Technology Organisation until 1997, during which time she was posted to the University of Southampton for one year. Later she moved to the University of Nottingham, returning in 2007 to Australia to join the University of South Australia where she is now. She was General Chair of ACM Hypertext 2003 in Nottingham, and joint programme chair in 2004 and 2016, as well as joint programme chair of Adaptive Hypermedia in 2006. She was joint Editor-in-Chief of the ACM Transactions on the Web 2005-2011. She served on the SIGWEB executive 2003-2005.

A framework to facilitate cyber defense situational awareness modeled in an emulated virtual machine testbed

Modern computer networks and the cyber attacks launched against them grow more complex each year. Analyzing network information can be complex and time consuming. Network defenders are routinely unable to orient themselves quickly enough to determine the expected system impact, much less defend the networks’ resources. The network operator’s time would be better spent finding and executing event responses to minimize damage. Current automated response systems are mostly limited to scripted responses based on data from a single source. Better automation is required. This paper presents a framework that aggregates data from heterogeneous network sensors, including intrusion detection systems and network vulnerability assessment tools. An impact rating system is proposed and tested that estimates the feasibility of an attack and its potential impact. The impact assessments allow decision makers to prioritize attacks in real time and attempt to mitigate the attacks in order of their estimated network impact to the network. Experimental results indicated that when administrators are only concerned with high-level attacks, impact assessments could eliminate a mean 51.21% of irrelevant data. When only concerned with high- and medium-level attacks, a mean of 34.03% of the data was irrelevant. This represents a significant reduction in the information administrators must process.

Decision-cache based XACML authorisation and anonymisation for XML documents

This paper describes a decision cache for the eXtensible Access Control Markup Language (XACML) that supports fine-grained authorisation and anonymisation of XML based messages and documents down to XML attribute and element level. The decision cache is implemented as an XACML obligation service, where a specification of the XML elements to be authorised and anonymised is sent to the Policy Enforcement Point (PEP) during initial authorisation. Further authorisation of individual XML elements according to the authorisation specification is then performed on all matching XML resources, and decisions are stored in the decision cache. This makes it possible to cache fine-grained XACML authorisation and anonymisation decisions, which reduces the authorisation load on the Policy Decision Point (PDP). The theoretical solution is related to a practical case study consisting of a privacy-enhanced intrusion detection system that needs to perform anonymisation of Intrusion Detection Message Exchange Format (IDMEF) XML messages before they are sent to a security operations centre that operates in privacy-preserving mode. The solution increases the scalability of XACML based authorisation significantly, and may be instrumental in implementing federated authorisation and anonymisation based on XACML in several areas, including intrusion detection systems, web services, content management systems and GRID based authentication and authorisation.

Active Security—A proactive approach for computer security systems

Computer systems and especially networking environments are growing and changing very rapidly. Such growth introduces major security risks, as current computer and networking security components are not able to dynamically adopt themselves for the changing needs. Especially the growth of the Internet and electronic commerce have made it necessary to have centralized security policies in place which are enforced by a distributed environment. ‘Active Security’ is the result of a research and development project, introducing a new approach for implementing security systems, being able to automatically respond to new security threats. The focus of this work is encompassing a security infrastructure where multiple components including intrusion detection systems, vulnerability assessment scanners, firewalls and other security devices are able to communicate and respond to changing security threats. Design and implementation of Active Security is based on a public key infrastructure using digital certificates for providing authenticated communication. A number of sites on the Internet have participated during the pilot phase of Active Security protecting their networks. The United States patent titled ‘Active Firewall System and Methodology’ is pending for this architecture.