Intrusive Activities Research Articles

Impact of AI on the Cyber Kill Chain: A Systematic Review

The Cyber Kill Chain (CKC) defense model aims to assist subject matter experts in planning, identifying, and executing against cyber intrusion activity, by outlining seven stages required for adversaries to execute an attack. Recent advancements in Artificial Intelligence (AI) have empowered adversaries to execute sophisticated attacks to exploit system vulnerabilities. As a result, it is essential to consider how AI-based tools change the cyber threat landscape and affects the current standard CKC model. Thus, this study examines and categorizes how attackers use AI-based tools and offers potential defense mechanisms. We conducted a systematic literature review of 62 papers published between 2013 and 2023 from the Web of Science and Google Scholar databases. Our findings indicate that AI-based tools are used most effectively in the initial stages of cyberattacks. However, we find that current defence tools are not designed to counter these sophisticated attacks during these stages. Thus, we provide insights to 1) highlight the changing threat landscape due to AI and 2) to guide the development of cyberdefense mechanisms.

Novel IDS Framework: Integrating GWO Feature Selection with KAN Classification

The past few decades have seen significant lifestyle improvements through cutting-edge innovations like AI and fog computing enabled by the World Wide Web, which are crucial for practical applications involving both symmetrical and asymmetrical information distributions. However, these advancements also come with the risk off requent and dangerous cyber-attacks. To mitigate these unwanted malwares, researchers must develop and implement novel intrusion detection systems (IDSs). Challenges such as inadequate accuracy scores due to numerous unnecessary and ineffective features, poor identification of attacks through specific deep learning classification methods, the costly and inefficient use of labeled training databases, and the excessive time required for system development and evaluation hinder there liability and efficiency of IDSs.This paper proposes a hybrid approach that combines the Grey Wolf Optimizer (GWO) for feature selection and the Kolmogorov-Arnold Network(KAN) algorithm for classification to address these challenges.The GWO is utilized to extract important features through meta-heuristic methods, demonstrating its effectiveness in feature selection. The proposed model achieves a high accuracy score, precision, recall, and F1-score of 92.09%, indicating its capability to accurately identify both normal and intrusive activities. The Matthews Correlation Coefficient (MCC) of 0.9019 further validates the model's robustness.

Improving IIoT security: Unveiling threats through advanced side-channel analysis

The widespread deployment of IIoT edge devices makes them attractive victims for malicious activities. Consequently, how to implement trustworthy operations becomes a realistic topic in embedded systems. While most current physical systems for detecting malicious activities primarily focus on identifying known intrusion codes at the block level, they ignore that even an unnoticeable injected function can result in system-wide loss of security. In this paper, we propose a framework called CNDSW built on deep-learning side-channel analysis for function-level industrial control flow integrity monitoring. By collaboratively utilizing correlation analysis and deep-learning techniques, the dual window sliding monitoring mechanism in the proposed CNDSW framework demonstrates a real-time code intrusion tracking capacity on embedded controllers with a 99% detection accuracy on average. Instead of focusing on known block-level intrusions, we experimentally show that our model is feasible to detect function-level code intrusions without knowing the potential threat type. Besides, we further explore how different configurations of the CNDSW framework can help the monitoring process with different emphases and to which extent the model can concurrently detect multiple code intrusion activities. All our experiments are conducted on 32-bit ARM Cortex-M4 and 8-bit RISC MCUs across five different control flow programs, providing a comprehensive evaluation of the framework’s capabilities.

Analyzing anonymous activities using Interrupt-aware Anonymous User-System Detection Method (IAU-S-DM) in IoT

The intrusion detection process is important in various applications to identify unauthorized Internet of Things (IoT) network access. IoT devices are accessed by intermediators while transmitting the information, which causes security issues. Several intrusion detection systems are developed to identify intruders and unauthorized access in different software applications. Existing systems consume high computation time, making it difficult to identify intruders accurately. This research issue is mitigated by applying the Interrupt-aware Anonymous User-System Detection Method (IAU-S-DM). The method uses concealed service sessions to identify the anonymous interrupts. During this process, the system is trained with the help of different parameters such as origin, session access demands, and legitimate and illegitimate users of various sessions. These parameters help to recognize the intruder’s activities with minimum computation time. In addition, the collected data is processed using the deep recurrent learning approach that identifies service failures and breaches, improving the overall intruder detection rate. The created system uses the TON-IoT dataset information that helps to identify the intruder activities while accessing the different data resources. This method’s consistency is verified using the metrics of service failures of 10.65%, detection precision of 14.63%, detection time of 15.54%, and classification ratio of 20.51%.

Protecting Data at Risk of Unintentional Electromagnetic Emanation: TEMPEST Profiling

Unintentional electromagnetic (EM) emissions often include information about the data processed by electronic devices. Intrusion based on an unintentional EM emission leaves no evidence of an attacker’s activity, while the data owner is unaware that it has been lost. EM attacks can be performed without physically damaging a device that operates regularly. The most typical intrusion activities involve sensitive data exfiltration using various methods that do not require the physical connection of devices to the computer network or communication channels. This research examines EM emissions from computer monitors, wireless keyboards and mice, printers, scanners, conductors, piezoelectric sensors (PES), and radio frequency identification (RFID) devices. The telecommunication electronics material protected from emanating spurious transmissions (TEMPEST) profiling as a performance engineering of the EM footprint is discussed. This study also presents different TEMPEST standards and highlights their importance concerning unintentional EM radiation.

An Artificial Intelligence-Based Intrusion Detection System using Optimization and Deep Learning

The Intrusion Detection System (IDS) was developed to resolve the malicious activities on the networking. However, the existing IDS models face issues in achieving high accuracy, and it is prone to detection error. Hence, to address these challenges, an innovative Vulture-based Deep Belief System (VbDBNS) for enhancing the performance of detecting intrusion activity by monitoring their behaviour and features. This study utilized the NSL-KDD database for training and validating the system. Henceforth, pre-processing is employed to standardize the dataset using Min-Max normalization, and 1-N encoding, which transforms the categorical data variables. Moreover, feature extraction was utilized to capture the most significant 42 attributes from the pre-processed database. Further, a classification module was designed using VbDBN to categorize normal and malicious data in which the fitness of vulture was updated, which enables it to monitor and detect the intrusion continuously. The experimental results of the study illustrate that the designed methodology achieved better outcomes than the conventional techniques in terms of recall, accuracy, precision, F1-score, etc.

Optimization techniques for IDS‐Generated traffic congestion control in VANET

AbstractVehicular Ad‐hoc Network (VANET) is an emerging field of wireless networks that enables a variety of vehicle safety and convenience applications. It employs Intrusion Detection System (IDS) frameworks in its different tiers to ensure reliable and secure communication among nodes. However, IDS requires a significant amount of data to process for monitoring intrusive activities in the network. As a result, the volume of traffic increases, resulting in the network congestion. Motivated by this fact, this study provides an overview of the optimization techniques for VANET traffic congestion control. It discusses a state‐of‐the‐art analysis along with the requirements for IDS‐generated traffic congestion control. It highlights the congestion control approaches for the traffic generated by an IDS and identifies the challenges in this domain. This study also proposes a novel IDS framework for reducing IDS‐generated network traffic by combining the Local Outlier Factor and Random Forest classifier. The proposed study achieved a high precision while yielding low false positive and false negative rates. The study outperformed the existing studies with an increase in accuracy of 1.16% and a reduction in attack detection time of 1.1869 seconds. Additionally, it discusses the possible future research directions that can be applied to address the issues of IDS‐generated traffic congestion. Overall, this study serves as a comprehensive guide to the current status of IDS‐generated traffic congestion control and diverse approaches to lessen it that can be employed by academicians and researchers.

Pilot Study on Web Server HoneyPot Integration Using Injection Approach for Malware Intrusion Detection

The digital world is rapidly coming together as well as transforming a lot of our valued data onto digital forms. Its consequent dissemination eased via the advent of the Internet has also encountered many attacks due to predictable responses from many users – leading up to social engineering and exploits on trust-level of users. The use of deception is now playing a very prominent role in enhancing data security. Several approaches abound to discourage and redirect challenges (via the use of honeypot), and to detect such intrusive activities (via an intrusion detection systems). These have been successfully used to minimize security breaches. We explore a deep learning deception-based honeypot to minimize breaches by adversaries. Used on web servers, it is equipped with identification capabilities as the system learns and defends a user system against intrusive actions. Our confusion matrix shows model has sensitivity of 0.81, specificity 0.08, and prediction accuracy of 0.991 with an improvement rate of 0.39 for data that were not originally used to train. . Keywords: Web Server, HoneyPot, Integratio, Injection Approach, Malware Intrusion Detection CISDI Journal Reference Format Malasowe B., Aghware, F. & Edim, B.E. (2024): Pilot Study on Web Server HoneyPot Integration Using Injection Approach for Malware Intrusion Detection. Computing, Information Systems, Development Informatics & Allied Research Journal. Vol 15 No 1, Pp 13-.28. dx.doi.org/10.22624/AIMS/CISDI/V15N1P2. Available online at www.isteams.net/cisdijournal

WIRELESS LAN DESIGN AND FUTURE INTERNET ARCHITECTURE

In this research thesis, an advance work is being done on the Wireless Local Area Network (WLAN) design and future internet architecture for intrusion detection. There has been a large shift worldwide in using technology in almost every aspect of our lives. This trend has been termed in many industries as the "Internet of Things" (IoT), where the Internet and cloud- based activities are seeing more and more use for control, monitoring and data storage applications. As stated earlier, these assumptions were made because of the extreme difficulty in obtaining any related telemetry from an actual WLAN system or business-critical network. To improve the validity of the simulation, it would be beneficial to obtain even sanitized telemetry from an actual system. Then, the simulation could be refined to better reflect the dynamics of the signals in a real system. If actual WLAN system data is unobtainable, then the test by itself can be modified to reflect more processes seen in these systems. First, a small flow loop with sensing and control elements could be constructed and driven by the servers of the test bed. The primary server in the test bed that acts as the WLAN server could then be programmed to poll the sensors, issue commands and collect data. Time synchronous averaging techniques are used to resample telemetry sources that have different sampling rates. The research provides several case studies to prove the efficacy of the newly developed variable grouping technique for WLAN. Recall that variable grouping methods are needed to extract sets or subsets of variables that give the lowest model prediction errors. The research also presents AAKR and AAMSET model results for several successfully detected intrusion activities from two different data sets. The models utilized four different clusters of telemetry taken from the Linux kernel to determine which class of telemetry was more effective for intrusion detection. The knowledge-based system is certainly the most numerous and widely used type that uses signatures or features of known wireless network attacks for detection purposes. While this type is easy to implement and has a low rate of false/missed alarms, it will always miss the so-called zero-day wireless network attacks. Recall that a zero-day wireless network attack is a new, unknown intrusion. Because the knowledge-based system has never seen a zero-day intrusion event, it will classify this new behavior as normal. In contrast, the behavior-based system can detect known and zero-day wireless network attacks with an accuracy of 97.86% correctly. This type uses data-driven modeling techniques to learn normal system behavior. Once trained, any future monitored telemetry that deviates from this learned behavior will be labeled as an intrusion event.

A secure edge computing model using machine learning and IDS to detect and isolate intruders

The article presents a secure edge computing model that utilizes machine learning for intrusion detection and isolation. It addresses the security challenges arising from the rapid expansion of IoT and edge computing. The proposed Intrusion Detection System (IDS) combines Linear Discriminant Analysis (LDA) and Logistic Regression (LR) to swiftly and accurately identify intrusions without alerting neighboring devices. The model outperforms existing solutions with an accuracy of 96.56%, precision of 95.78%, and quick training time (0.04 s). It is effective against various types of attacks, enhancing the security of edge networks for IoT applications.•The methodology employs a hybrid model that combines LDA and LR for intrusion detection.•Machine learning techniques are used to analyze and identify intrusive activities during data acquisition by edge nodes.•The methodology includes a mechanism to isolate suspected devices and data without notifying neighboring edge nodes to prevent intruders from gaining control over the edge network.

PISketch: Finding Persistent and Infrequent Flows

Finding persistent and low-active activity periods is very helpful in practice, for example to detect intrusion activities. Most of the literature focuses on finding persistent flows or frequent flows. No previous work is able to find persistent and infrequent flows. In this paper, we propose a novel sketch data structure, PISketch, to find persistent and infrequent flows in real time. The key idea of is to define a weight and its Reward and Penalty System for each flow to combine and balance the information of both persistency and infrequency, and to keep high-weighted flows in a limited space through a strategy. We implement PISketch on P4, FPGA, and CPU platforms, and compare the performance of PISketch with two strawman solutions (On-Off + CM sketch, and PIE + CM sketch), in terms of finding persistent and infrequent flows. Our experimental results demonstrate the advantage of PISketch, by comparing it to two strawman solutions: 1) The F1 Score of is around 22.1% and 57.6% higher than two strawman solutions, respectively; 2) The Average Relative Error (ARE) of is around 820.9 (up to 1188.8) and 126.2 (up to 265.6) times lower than two strawman solutions, respectively; 3) The insertion throughput of is around 1.23 and 16.5 times higher than two strawman solutions, respectively. Moreover, we implement two concrete cases of PISketch through end-to-end experiments. All of our codes are available at GitHub.

Collaborative Federated Learning-Based Model for Alert Correlation and Attack Scenario Recognition

Planned and targeted attacks, such as the advanced persistent threat (APT), are highly sophisticated forms of attack. They involve numerous steps and are intended to remain within a system for an extended length of period before progressing to the next stage of action. Anticipating the next behaviors of attackers is a challenging and crucial task due to the stealthy nature of advanced attack scenarios, in addition to the possible high volumes of false positive alerts generated by different security tools such as intrusion detection systems (IDSs). Intelligent models that are capable of establishing a correlation individual between individual security alerts in order to reconstruct attack scenarios and to extract a holistic view of intrusion activities are required to exploit hidden links between different attack stages. Federated learning models performed in distributed settings have achieved successful and reliable implementations. Alerts from distributed security devices can be utilized in a collaborative manner based on several learning models to construct a federated model. Therefore, we propose an intelligent detection system that employs federated learning models to identify advanced attack scenarios such as APT. Features extracted from alerts are preprocessed and engineered to produce a model with high accuracy and fewer false positives. We conducted training on four machine learning models in a centralized learning; these models are XGBoost, Random Forest, CatBoost, and an ensemble learning model. To maintain privacy and ensure the integrity of the global model, the proposed model has been implemented using conventional neural network federated learning (CNN_FL) across several clients during the process of updating weights. The experimental findings indicate that ensemble learning achieved the highest accuracy of 88.15% in the context of centralized learning. CNN_FL has demonstrated an accuracy of 90.18% in detecting various attacks of APTs while maintaining a low false alarm rate.

DCIDS—Distributed Container IDS

Intrusion Detection Systems (IDS) still prevail as an important line of defense in modern computing environments. Cloud environment characteristics such as resource sharing, extensive connectivity, and agility in deploying new applications pose security risks that are increasingly exploited. New technologies like container platforms require IDS to evolve to effectively detect intrusive activities in these environments, and advancements in this regard are still necessary. In this context, this work proposes a framework for implementing an IDS focused on container platforms using machine learning techniques for anomaly detection in system calls. We contribute with the ability to build a dataset of system calls and share it with the community; the generation of anomaly detection alerts in open-source applications to support the SOC through the analysis of these system calls; the possibility of implementing different machine learning algorithms and approaches to detect anomalies in system calls (such as frequency, sequence, and arguments among other type of data) aiming greater detection efficiency; and the ability to integrate the framework with other tools, improving collaborative security. A five-layer architecture was built using free tools and tested in a corporate environment emulated in the GNS3 software version 2.2.29. In an experiment conducted with a public system call dataset, it was possible to validate the operation and integration of the framework layers, achieving detection results superior to the work that originated the dataset.

CAPTAIN: Community-based Advanced Persistent Threat Analysis in IT Networks

Organizations that possess valuable information assets and critical infrastructure are prone to Advanced Persistent Threats (APTs). The life cycle of this type of modern attack consists of multiple stages called Intrusion Kill Chain (IKC). As one of the most common approaches to deal with these attacks, organizations’ security staff use various heterogeneous security and non-security sensors in different lines of defense (Network, Host, and Application) as the primary detection levels in the monitored IT network to log the attacker’s intrusive activities. They then model their behaviors by using logged events to detect the IKC of APT attacks. However, numerous methods proposed in the literature have three primary drawbacks: 1) the inability to use both security and non-security sensors of the three mentioned detection levels in event correlation analysis, 2) high dependence on expert knowledge in setting up and maintaining common attack patterns, and 3) incapability to provide a visual representation of the attack path for security administrators to better track on-the-fly attacks in a monitored network. This paper presents a system for Community-based Advanced Persistent Threat Analysis in IT Networks (CAPTAIN) to address the aforementioned issues and challenges. The CAPTAIN framework comprises two distinct phases (including 12 different activities) that receive raw events logged by heterogeneous sensors as input and detect possible IKCs of the APT attacks as output. This system implements a novel graph-based attackers’ behavior modeling technique for detecting the IKC of APT attacks by correlating analysis of logged events and leveraging knowledge discovery on the graph. Our evaluation of the two publicly available standard datasets, Bryant and DARPA Transparent Computing, indicates that the CAPTAIN is robust, reliable against high volume events, and can detect the IKC of APT attacks with high accuracy and low false positive rates.

Coralline algal and foraminiferal records of the Pliocene paleoclimatic conditions and water-depth changes in the northern South China Sea

Detailed paleontological and sedimentological data from the Pliocene interval of core XK-1 allow for a detailed documentation of the carbonate system in the northern South China Sea (SCS). Six facies are identified. Based on a comprehensive analysis of facies changes, the paleoclimatic conditions and paleowater depths during the Pliocene in the Xisha area in the northern SCS are reconstructed. The changes in the abundance of the algal genus Sporolithon and the planktonic foraminifera species Orbulina universa, Globigerinoides quadrilobatus, Globorotalia menardii, and Globigerinoides obliquus indicate that the climate in the SCS gradually became warmer from 5.3 to 4.3 Ma and then cooled from 4.3 to 2.6 Ma, which was attributed to the changes in atmospheric pCO2. The high abundance of encrusting acervulinids and coralline algae and the low coral abundance suggest periods of elevated nutrient level, possibly linked to increases in nutrient input from the higher latitudes. Distinct changes in coralline algal and foraminiferal facies help the reconstruction of paleowater depths during the Pliocene in the Xisha area. The water depth was generally rising from 5.3 to 4.3 Ma and declining afterward, which was similar to that in the Yinggehai–Qiongdongnan Basin (located on the northern part of the Xisha area). This similarity indicates that there was a common factor controlling the long-term variation in water depth in the northern SCS. The comparison between paleowater depth changes and global eustatic sea-level fluctuations indicates that the regional tectonic subsidence was important from 5.3 to 4.7 Ma. Such subsidence was probably related to thermal subsidence after the magmatism intrusion activity beneath the basement at the initial stage of the Pliocene. This study indicates that the comprehensive analysis of algal and foraminiferal facies has great potential to reconstruct the climatic conditions and water depths in the ancient times.

Seismic Signal Analysis Based on Variational Mode Decomposition and Hilbert Transform for Ground Intrusion Activity Classification.

The identification of ground intrusion is a key and important technology in the national public security field. In this paper, a novel variational mode decomposition (VMD) and Hilbert transform (HT) is proposed for the classification of seismic signals generated by ground intrusion activities using a seismic sensing system. Firstly, the representative seismic data, including bicycles, vehicles, footsteps, excavations, and environmental noises, were collected through the designed experiment. Secondly, each original datum is decomposed through VMD and five Band-limited intrinsic mode functions (BIMF) are obtained, respectively, which will be used to generate a corresponding marginal spectrum that can reflect the actual frequency component of the signal accurately by HT. Then, three features related to the marginal spectrum, including marginal spectrum energy, marginal spectrum entropy, and marginal spectrum dominant frequency, are extracted for the analysis of the multi-classification using the support vector machine (SVM) classifier with the LIBSVM library. For the sake of testing and verifying the effectiveness of the proposed variational mode decomposition and Hilbert transform (VMD-HT) technique, the evaluation indicators including accuracy, precision, recall, and F1-Score are used and the results are compared with the time domain, frequency domain, ensemble empirical mode decomposition (EEMD), and empirical wavelet transform (EWT) combined with the HT analysis method. The performance of the VMD-HT method for ground intrusion activity classification provides an average value of 99.50%, 98.76%, 98.76%, and 98.75% for the four evaluation indicators, which are higher than all the other contrasted methods.

An Efficient Intrusion Detection Framework for Industrial Internet of Things Security

Recently, the Internet of Things (IoT) has been used in various applications such as manufacturing, transportation, agriculture, and healthcare that can enhance efficiency and productivity via an intelligent management console remotely. With the increased use of Industrial IoT (IIoT) applications, the risk of brutal cyber-attacks also increased. This leads researchers worldwide to work on developing effective Intrusion Detection Systems (IDS) for IoT infrastructure against any malicious activities. Therefore, this paper provides effective IDS to detect and classify unpredicted and unpredictable severe attacks in contradiction to the IoT infrastructure. A comprehensive evaluation examined on a new available benchmark TON_IoT dataset is introduced. The data-driven IoT/IIoT dataset incorporates a label feature indicating classes of normal and attack-targeting IoT/IIoT applications. Correspondingly, this data involves IoT/IIoT services-based telemetry data that involves operating systems logs and IoT-based traffic networks collected from a realistic medium-scale IoT network. This is to classify and recognize the intrusion activity and provide the intrusion detection objectives in IoT environments in an efficient fashion. Therefore, several machine learning algorithms such as Logistic Regression (LR), Linear Discriminant Analysis (LDA), K-Nearest Neighbors (KNN), Gaussian Naive Bayes (NB), Classification and Regression Tree (CART), Random Forest (RF), and AdaBoost (AB) are used for the detection intent on thirteen different intrusion datasets. Several performance metrics like accuracy, precision, recall, and F1-score are used to estimate the proposed framework. The experimental results show that the CART surpasses the other algorithms with the highest accuracy values like 0.97, 1.00, 0.99, 0.99, 1.00, 1.00, and 1.00 for effectively detecting the intrusion activities on the IoT/IIoT infrastructure on most of the employed datasets. In addition, the proposed work accomplishes high performance compared to other recent related works in terms of different security and detection evaluation parameters.

Napadi na sajber bezbednost - koji skup podataka treba koristiti za evaluaciju sistema za detekciju upada?

Introduction: Analyzing the high-dimensional datasets used for intrusion detection becomes a challenge for researchers. This paper presents the most often used data sets. ADFA contains two data sets containing records from Linux/Unix. AWID is based on actual traces of normal and intrusion activity of an IEEE 802.11 Wi-Fi network. CAIDA collects data types in geographically and topologically diverse regions. In CIC-IDS2017, HTTP, HTTPS, FTP, SSH, and email protocols are examined. CSECIC-2018 includes abstract distribution models for applications, protocols, or lower-level network entities. DARPA contains data of network traffic. ISCX 2012 dataset has profiles on various multi-stage attacks and actual network traffic with background noise. KDD Cup '99 is a collection of data transfer from a virtual environment. Kyoto 2006+ contains records of real network traffic. It is used only for anomaly detection. NSL-KDD corrects flaws in the KDD Cup '99 caused by redundant and duplicate records. UNSW-NB-15 is derived from real normal data and the synthesized contemporary attack activities of the network traffic. Methods: This study uses both quantitative and qualitative techniques. The scientific references and publicly accessible information about given dataset are used. Results: Datasets are often simulated to meet objectives required by a particular organization. The number of real datasets are very small compared to simulated dataset. Anomaly detection is rarely used today. Conclusion: 95 The main characteristics and a comparative analysis of the data sets in terms of the date they were created, the size, the number of features, the traffic types, and the purpose are presented.

Multi-stage ore forming history of the Variscan porphyry Mo-Cu-W Myszków deposit (Poland): Evidence from trace elements of pyrite

Four generations of pyrite (Py I-IV) from the porphyry-type Mo-Cu-W Myszków deposit are investigated using electron-probe microanalysis and laser ablation inductively coupled plasma mass spectrometry. Pyrite-I, representing skarn-forming stage of mineralization associated with magma intrusion activity, was formed in a relatively high-temperature environment. It has high contents of Co (up to 3966.11 ppm), Ni (up to 2552.62 ppm), Mn (up to 70.32 ppm), and Se (up to 103.94 ppm), but is depleted in As, Te, V, and devoid of Sb. Pyrite-II, representing the main hydrothermal stage of ore mineralization under the vigorous boiling conditions, contains elevated levels of Co (up to 1962.31 ppm), Ni (up to 1080.86 ppm), and Se (up to 153.03 ppm) with a high Se/Te ratio of 28.30. Pyrite-III, formed under vigorous to gentle boiling conditions, is also enriched in Co (up to 3312.65 ppm), Ni (up to 1469.09 ppm), Se (up to 184.24 ppm), and Te (up to 117.50 ppm), but depleted in As, Mn, V. The latest, low-temperature generation of pyrite, Py-IV is characterized by the highest contents of As (up to 3331.79 ppm), Mn (up to 141.91 ppm), the elevated levels of Te (up to 62.51 ppm), but depletion in Co, Ni, Se, V. Cu (mostly Py-I and Py-II), Pb (mainly Py-II and Py-IV), Bi (mainly Py-IV), Ag and Au (mainly Py-IV) are found as trace elements of solid micro-sized inclusions hosted by various generations of pyrite. The results of the study seem to demonstrate the sequence of metal precipitation in the ore system. At the relatively high-temperature conditions (the contact metamorphism down to hydrothermal stage), the deposition of Co, Ni, Mn, and later Se in pyrite occurred. Additionally, cobalt and nickel concentrations might suggest a contribution from magmas of mafic composition. Copper was mobilized and formed solid micro-inclusions in the host pyrite. Later, along with the evolution of the ore-forming system, and lower temperature rate, tellurium entered the structure of pyrite, when the redox condition temporarily changed from oxidizing to more reducing. With the further temperature drop and likely rising oxidation, arsenic entered the pyrite structure in the most recent episode of the main hydrothermal ore-mineralization stage. Also, the highest budget of Bi, Pb, and Ag with traces of Au was deposited as micro-inclusions in pyrite during this period. The concentration of these elements can be related to the same mechanism, as revealed by their positive correlations, i.e. Bi vs Pb in Py-IV (R = 0.95) Ag vs Pb in Py-IV (R = 0.94), Ag vs Bi in Py-IV (R = 0.97).

Light gradient boosting machine with optimized hyperparameters for identification of malicious access in IoT network

In this paper, an advanced and optimized Light Gradient Boosting Machine (LGBM) technique is proposed to identify the intrusive activities in the Internet of Things (IoT) network. The followings are the major contributions: i) An optimized LGBM model has been developed for the identification of malicious IoT activities in the IoT network; ii) An efficient evolutionary optimization approach has been adopted for finding the optimal set of hyper-parameters of LGBM for the projected problem. Here, a Genetic Algorithm (GA) with k-way tournament selection and uniform crossover operation is used for efficient exploration of hyper-parameter search space; iii) Finally, the performance of the proposed model is evaluated using state-of-the-art ensemble learning and machine learning-based model to achieve overall generalized performance and efficiency. Simulation outcomes reveal that the proposed approach is superior to other considered methods and proves to be a robust approach to intrusion detection in an IoT environment.