Large-scale Network Attacks Research Articles

A method of classifying IoT devices based on attack sensitivity

The emergence of IoT has introduced new security concerns, particularly the detection of large-scale network attacks initiated by compromised IoT devices. The diverse nature of IoT devices adds complexity to attack detection, necessitating the classification of devices based on their unique characteristics and behavior patterns. This paper presents a novel device classification method grounded in traffic differentials before and after IoT devices succumb to compromise. The study defines the concept of attack sensitivity and designs a method for calculating the value. The K-means algorithm is used to classify devices into predefined categories based on their attack sensitivity values. The effectiveness of this method is demonstrated through experiments on a public dataset. Additionally, a multi-class classification model is developed to identify newly added devices to the IoT environment, with good results in accuracy, precision, recall, F1 score, and FPR (0.999, 0.997–1,0.997–1,0.998–1,0–0.001). Overall, The device classification method proposed in this paper, based on attack sensitivity, not only enables a rational definition of device categories but also ensures precise classification for devices newly integrated into the IoT environment. This lays the foundation for achieving more precise attack detection and protection, advancing the field towards enhanced cybersecurity measures.

NetSentry: A deep learning approach to detecting incipient large-scale network attacks

Machine Learning (ML) techniques are increasingly adopted to tackle ever-evolving high-profile network attacks, including Distributed Denial of Service (DDoS), botnet, and ransomware, due to their unique ability to extract complex patterns hidden in data streams. These approaches are however routinely validated with data collected in the same environment, and their performance degrades when deployed in different network topologies and/or applied on previously unseen traffic, as we uncover. This suggests malicious/benign behaviors are largely learned superficially and ML-based Network Intrusion Detection Systems (NIDS) need revisiting, to be effective in practice. In this paper we dive into the mechanics of large-scale network attacks, with a view to understanding how to use ML for Network Intrusion Detection (NID) in a principled way. We reveal that, although cyberattacks vary significantly in terms of payloads, vectors and targets, their early stages, which are critical to successful attack outcomes, share many similarities and exhibit important temporal correlations. Therefore, we treat NID as a time-sensitive task and propose NetSentry, perhaps the first of its kind NIDS that builds on Bidirectional Asymmetric LSTM (Bi-ALSTM), an original ensemble of sequential neural models, to detect network threats before they spread. We cross-evaluate NetSentry using two practical datasets, training on one and testing on the other, and demonstrate F1 score gains above 33% over the state-of-the-art, as well as up to 3× higher rates of detecting attacks such as Cross-Site Scripting (XSS) and web bruteforce. Further, we put forward a novel data augmentation technique that boosts the generalization abilities of a broad range of supervised deep learning algorithms, leading to average F1 score gains above 35%. Lastly, we shed light on the feasibility of deploying NetSentry in operational networks, demonstrating affordable computational overhead and robustness to evasion attacks.

Artificial Intelligence Enabled Cyberspace Security Defense

Cyberspace is regarded as the fifth largest activity space following land, sea, air, and space. Protecting cyberspace security is a major issue related to national security, national sovereignty, and the legitimate rights and interests of the people. With the rapid development of artificial intelligence (AI) technology and its application in various fields, cyberspace security has been facing new challenges. This study analyzes the new risks of cyberspace security in the era of AI, such as more intelligent network attacks, more frequent large-scale network attacks, higher concealment of network attacks, stronger confrontation game of network attacks, and easier exposure to stealing of important data. AI technology has significant advantages in dealing with massive data, multi-source heterogeneous data, and real-time dynamic data, which can significantly improve the defense capability of cyberspace. This study introduces some key problems and technologies of AI-enabled cyberspace security defense, particularly the construction of a cyberspace security knowledge brain and the detection of network attacks. Furthermore, we propose the corresponding countermeasures and suggestions from three aspects: the construction of a dynamic and scalable network secur security knowledge brain, the promotion of intelligent detection against network attacks, and the evaluation of AI technologies’ security.

RAFM: A Real-time Auto Detecting and Fingerprinting Method for IoT devices

In recent years, with the rapid development of Internet of Things (IoT) technology, a large number of Internet of things devices such as network printers, webcams and routers have emerged in the cyberspace. However, the situation of network security is increasingly serious. Large-scale network attacks launched by terminal devices connected to the Internet occur frequently, causing a series of adverse effects such as information leakage and property loss to people. The establishment of a set of fingerprint generation system for Internet of things devices to accurately identify the device type is of great significance for the unified security control of the Internet of things. We proposed a RAFM which is a detection and identification system of IoT. RAFM consists two major module including auto detection and fingerprinting. RAFM collects messages sent by different Internet of things devices by means of passive listening. Based on the differences in the header fields of different devices, it USES a series of multi-class classification algorithms to identify device types. Simulation experiments show that RAFM can achieve an average prediction accuracy of 93.75%.

Malware Threats Analysis and Mitigation Techniques for Compromised Systems

On Friday October 21, 2016 there was a Distributed Denial of Service (DDoS) attack that took place on a DNS provider. Its objective was against major websites such as GitHub, Etsy, Twitter, Netflix, and Spotify. This paper is created in order to utilize the Free and Open Source Software (FOSS) available online to identify, classify and remove malware from a compromised system. Presenting an in-depth security analysis of Mirai botnet, a malware that convert devices running Linux into remotely controlled Bots, especially IoT devices, all the compromised systems were used as part of the Mirai botnet for performing large-scale network attacks. The methods presented in this article are generic and can be used as part of an incident response strategy to mitigate any malware of the same nature.

An Alert Correlation Analysis Oriented Incremental Mining Algorithm of Closed Sequential Patterns with Gap Constraints

Large-scale network attacks will bring great damage to the network. Although the existing detection systems are able to detect a large number of known attacks, when facing large-scale network attacks, log data generated by these systems usually increases rapidly, which forms vast amount of alert information in a short period of time. This paper researches on picking up alert information efficiently and timely, which is an important need. According to the characte ristics of intrusion detection log, we put forward the method of using incremental mining algorithm of closed sequential patterns with gap constraints - cispan algorithm to analyze the growing log database, we also compare the performance of cispan algorithm, prefi xspan algorithm and clospan algorithm in analyzing intrusion detection log, and proves that cispan algorithm has higher efficiency in an alyzing alert log.

An Approach for Description of Computer Network Defense Scheme and Its Simulation Verification

In order to solve the problem of which the existing defense policy description languages can only describe some aspects of defense, such as protection or detection, but cannot express relationship among actions and to cope with large-scale network attack, we proposed an approach for description of computer network defense scheme and its simulation verification. A computer network defense-oriented scheme description language (CNDSDL) was designed to describe actions of protection (i.e., access control, encryption communication, backup), detection (i.e., intrusion detection, vulnerability detection), analysis (i.e., log auditing), response (i.e., system rebooting, shutdown), recovery (i.e., rebuild, patch making), and relationship among actions (i.e., sequence-and, sequence-or, concurrent-and, concurrent-or, and xor). The Extend Backus-Naur Form (EBNF) of CNDSDL was provided. At last, we provided an implementation mechanism of CNDSDL. A task deadlock detection algorithm was given for the defense scheme. The simulation was completed in simulation platform of GTNetS. Three simulation experiments verified the description capability and effectiveness of CNDSDL. The results of the experiments show that the defense scheme described by CNDSDL can be transformed to detailed technique rules and realize the defense effect of expression.

Building resilient low-diameter peer-to-peer topologies

As more applications rely on underlying peer-to-peer topologies, the need for efficient and resilient infrastructure has become more pressing. A number of important classes of topologies have emerged over the last several years, all with various strengths and weaknesses. For example, the popular structured peer-to-peer topologies based on distributed hash tables (DHTs) offer applications assured performance, but are not resilient to attacks and major disruptions that are likely in the overlay. In contrast, unstructured topologies where nodes create random connections among themselves on-the-fly, are resilient to attacks but can not offer performance assurances because they often create overlays with large diameters, making some nodes practically unreachable. We propose Phenix, a peer-to-peer algorithm for building resilient low-diameter peer-to-peer topologies that can resist different types of organized and targeted malicious behavior. Phenix leverages the strengths of these existing approaches without inheriting their weaknesses and is capable of building topologies of nodes that follow a power-law while being fully distributed requiring no central server, thus, eliminating the possibility of a single point of failure in the system. We present the design and evaluation of the algorithm and show through extensive analysis, simulation, and experimental results obtained from an implementation on the PlanetLab testbed that Phenix is robust to network dynamics such as bootstrapping mechanisms, joins/leaves, node failure and large-scale network attacks, while maintaining low overhead when implemented in an experimental network.

Image-Based Anomaly Detection Technique: Algorithm, Implementation and Effectiveness

The frequent and large-scale network attacks have led to an increased need for developing techniques for analyzing network traffic. This paper presents NetViewer, a network measurement approach that can simultaneously detect, identify, and visualize attacks and anomalous traffic in real-time by passively monitoring packet headers. We propose to represent samples of network packet header data as frames or images. With such a formulation, a series of samples can be seen as a sequence of frames or video, revealing certain kinds of attacks to the human eye. This enables techniques from image processing and video compression to be applied to the packet header data to reveal interesting properties of traffic. We show that "scene change analysis" can reveal sudden changes in traffic behavior or anomalies. We also show that "motion prediction" techniques can be employed to understand the patterns of some of the attacks. We show that it may be feasible to represent multiple pieces of data as different colors of an image enabling a uniform treatment of multidimensional packet header data. We compare the effectiveness of NetViewer with classical detection theory-based Neyman-Pearson test