Detection Of Malicious Attacks Research Articles

CLUSTER ANALYSIS FOR RESEARCHING DIGITAL FOOTPRINTS OF STUDENTS IN EDUCATIONAL INSTITUTIONS

It is shown that Cluster Analysis (CA) can be used in the process of researching the Digital Traces (DT) of students of an educational institution, as well as other educational institutions that introduce a Digital Educational Environment (DEE) into the educational process. Cluster analysis can reveal behavioral patterns of education seekers. Also, the use of CA methods will improve the personalization of training and increase the effectiveness of educational programs. It is shown that in the context of ensuring Information Security (IS) of the DEE of educational institutions, technologies and methods of DT analysis can also be useful, for example, for: monitoring students’ network activity; analysis of student authorization and authentication logs; detection of malicious programs and attacks on the DEE; analysis of IS threats to the DEE as a whole; vulnerability prediction. It is shown that the application of CA methods can be useful in studying the degree of information security of the DEE of universities and other educational institutions. It has been established that CA methods can help identify groups of students with similar patterns of activity from the point of view of IS, both the DEE of the educational institution as a whole, and its computer networks and systems. It has been established that with the help of CA DT, it is possible to detect anomalous behavior of students, to detect unusual patterns of activity, facts of unauthorized use of resources or other deviations from the typical behavior of students in the network of the educational institution. The article also provides the results of experimental studies of the level of competences of students of various specialties at the university in IS and protection of information assets of the DEE. In this, CA methods were used in the process of studying students’ DT. Six types of users were distinguished on the basis of CA DT of different groups of students registered in the university DEE. As a result of the application of CA methods, students registered in the university’s DEE were divided into appropriate clusters according to criteria affecting IS risks.

Real-time detection of malicious intrusions and attacks in cybersecurity infrastructures enabled by IOT

Malicious software, PC infections, and other unfriendly attacks may all impact a PC organization. Interruption location, which is a functioning guarded instrument, is a basic part of organization security. Conventional interruption recognition frameworks incorporate issues like low accuracy, unfortunate identification, a high level of false positives, and a failure to deal with inventive sorts of interruptions. We present another deep learning-based approach for identifying network safety weaknesses and breaks in digital actual frameworks to address these worries. The proposed worldview analyses discriminative procedures in view of unsupervised and deep learning. To distinguish cyber threats in IoT-driven IICs organizations, we present a generative ill-disposed network. The discoveries show an improvement in exactness, unwavering quality, and productivity in recognizing all types of attacks. On the three informational collections, NSL-KDD, KDDCup99, and UNSW-NB15, the result of notable cutting-edge DL classifiers accomplished the highest true rate (TNR) and highest detection the rate accompanying assaults: Brute Force XXS, Brute Force WEB, DoS_Hulk_Attack, the preparation and testing stages, it likewise guaranteed the privacy and honesty of delicate data having a place with clients and frameworks.

A machine learning technique for Android malicious attacks detection based on API calls

Android malware is widespread and it is considered as one of the most threatening attacks recently. The threat is targeting to damage access data or information or leaking them; in general, malicious software consists of viruses, worms, and other malware. Current malware attempts to prevent being detected by any software or anti-virus. This paper describes recent Android malware detection static and interactive approaches as well as several open-source malware datasets. The paper also examines the most current state-of-the-art Android malware identification techniques including identifying by comparative evaluation the gaps between these techniques. As a result, an API-based dynamic malware detection framework is proposed for Android to provide a dynamic paradigm for malware detection. The proposed framework was closely inspected and checked for reliability where meaningful API packages and methods were discovered.

Research on Network Security Technology of Internet of Things Intelligent Information Terminal under the Background of Information Technology

Abstract This paper explores the application of network security technology within intelligent information terminals of the Internet of Things (IoT). It examines existing security issues and proposes a technical framework to address them. The technical framework starts from two aspects of data encryption and intrusion detection technology, in the data encryption technology, the CCA-ANC encryption algorithm is proposed to change the attacker in ANC from pure ciphertext attack to using the method of selective ciphertext attack. In intrusion detection technology, the DAGMM algorithm has been improved and optimized. The WEFS-DAGMM improved intrusion detection algorithm has been proposed, and an intrusion detection firewall has been constructed. In the performance test, the CCA-ANC encryption algorithm completes the encryption after inputting 1024MB of data in 13.6s, and the average speed of encryption reaches 71.54MB/s. The optimized WEFS-DAGMM algorithm achieves an accuracy of 0.952, which is 0.03 higher than the original DAGMM algorithm. The recall and F1 values are 0.03 higher than the original DAGMM algorithm, respectively. The algorithms have been improved by 0.03 and 0.037, respectively. Simulation experiments are conducted on the technical framework constructed in this paper. The success rate of malicious attack detection is greater than 90%, and the security protection rate reaches more than 99% in all of them.

DAG-based swarm learning: a secure asynchronous learning framework for Internet of Vehicles

To provide diversified services in the intelligent transportation systems, smart vehicles will generate unprecedented amounts of data every day. Due to data security and user privacy issues, Federated Learning (FL) is considered a potential solution to ensure privacy-preserving in data sharing. However, there are still many challenges to applying the traditional synchronous FL directly in the Internet of Vehicles (IoV), such as unreliable communications and malicious attacks. In this paper, we propose a Directed Acyclic Graph (DAG) based Swarm Learning (DSL), which integrates edge computing, FL, and blockchain technologies to provide secure data sharing and model training in IoVs. To deal with the high mobility of vehicles, the dynamic vehicle association algorithm is introduced, which could optimize the connections between vehicles and road side units to improve the training efficiency. Moreover, to enhance the anti-attack property of the DSL algorithm, a malicious attack detection method is adopted, which could recognize malicious vehicles by the site confirmation rate. Furthermore, an accuracy-based reward mechanism is developed to promote vehicles to participate in the model training with honest behaviors. Finally, simulation results demonstrate that the proposed DSL algorithm could achieve better performance in terms of model accuracy, convergence rates and security compared with existing algorithms.

TNN-IDS: Transformer neural network-based intrusion detection system for MQTT-enabled IoT Networks

The Internet of Things (IoT) is a global network that connects a large number of smart devices. MQTT is a de facto standard, lightweight, and reliable protocol for machine-to-machine communication, widely adopted in IoT networks. Various smart devices within these networks are employed to handle sensitive information. However, the scale and openness of IoT networks make them highly vulnerable to security breaches and attacks, such as eavesdropping, weak authentication, and malicious payloads. Hence, there is a need for advanced machine learning (ML) and deep learning (DL)-based intrusion detection systems (IDS). Existing ML-based IoT-IDSs face several limitations in effectively detecting malicious activities, mainly due to imbalanced training data. To address this, this study introduces a transformer neural network-based intrusion detection system (TNN-IDS) specifically designed for MQTT-enabled IoT networks. The proposed approach aims to enhance the detection of malicious activities within these networks. The TNN-IDS leverages the parallel processing capability of the Transformer Neural Network, which accelerates the learning process and results in improved detection of malicious attacks. To evaluate the performance of the proposed system, it was compared with various IDSs based on ML and DL approaches. The experimental results demonstrate that the proposed TNN-IDS outperforms other systems in terms of detecting malicious activity. The TNN-IDS achieved optimum accuracies reaching 99.9% in detecting malicious activities.

Novel Graph-Based Machine Learning Technique to Secure Smart Vehicles in Intelligent Transportation Systems

Intelligent Transport Systems (ITS) is a developing technology that will significantly alter the driving experience. In such systems, smart vehicles and Road-Side Units (RSUs) communicate through the VANET. Safety apps use these data to identify and prevent hazardous situations in real-time. Detection of malicious nodes and attack traffic in Intelligent Transportation Systems (ITS) is a current research subject. Recently, researchers are proposing graph-based machine learning techniques to identify malicious users in the ITS environment, through which it is easy to analyze the network traffic and detect the malicious devices. Therefore, graph-based machine learning techniques could be a technique that efficiently detect malicious nodes in the ITS environment. In this context, this article aims to provide a technique for resolving authentication and security issues in ITS using lightweight cryptography and graph-based machine learning. Our solution uses the concepts of identity based authentication technique and graph-based machine learning in order to provide authentication and security to the smart vehicle in ITS. By authenticating smart vehicles in ITS and identifying various cyber threats, our proposed method substantially contributes to the development of intelligent transportation communication environment.

Malicious attack detection based on continuous Hidden Markov Models in Wireless sensor networks

Alongside the rapid progress of Wireless sensor networks (WSNs) technologies, sensors and networks can rapidly be a victim of distributed attacks. Attackers can perform intrusions to break down the network during the routing process and intercept gathered data by dropping them for example. To prevent the increase of security issues in WSN, many attack identification methods and models were proposed in which detection systems are deployed to collect sensed data and categorize them using machine learning and stochastic binary-classification techniques. For this work, a new method is introduced to analyze and classify an own WSN dataset. We aim to design an anomaly identification approach to improve the sensor network security and its efficiency with high accuracy. To reach this goal, machine learning approaches are used to define a detection system that learns from routing datasets to identify network malicious entries. The proposed models are based on Hidden Markov Model (HMM), and Gaussian Mixture Model (GMM) stochastic assumptions. Also, the dimensionality reduction technique was deployed to select the most relevant features for the training. The experimentation phase was realized on its own and made the dataset that reflects different network situations of normal and attacked cases. The outcomes performances of the proposed method were obtained with a classification accuracy of 92.18% using a 2 HMM/3 GMM classifier. This result demonstrates the quality of our proposed approach compared with existing literature and its usefulness to improve the security of WSN.

Energy Analysis-Based Cyber Attack Detection by IoT with Artificial Intelligence in a Sustainable Smart City

Cybersecurity continues to be a major issue for all industries engaged in digital activity given the cyclical surge in security incidents. Since more Internet of Things (IoT) devices are being used in homes, offices, transportation, healthcare, and other venues, malicious attacks are happening more frequently. Since distance between IoT as well as fog devices is closer than distance between IoT devices as well as the cloud, attacks can be quickly detected by integrating fog computing into IoT. Due to the vast amount of data produced by IoT devices, ML is commonly employed for attack detection. This research proposes novel technique in cybersecurity-based network traffic analysis and malicious attack detection using IoT artificial intelligence techniques for a sustainable smart city. A traffic analysis has been carried out using a kernel quadratic vector discriminant machine which enhances the data transmission by reducing network traffic. This enhances energy efficiency with reduced traffic. Then, the malicious attack detection is carried out using adversarial Bayesian belief networks. The experimental analysis has been carried out in terms of throughput, data traffic analysis, end-end delay, packet delivery ratio, energy efficiency, and QoS. The proposed technique attained a throughput of 98%, data traffic analysis of 74%, end-end delay of 45%, packet delivery ratio of 92%, energy efficiency of 92%, and QoS of 79%.

A Network Intrusion Detection Method Based on Improved Bi-LSTM in Internet of Things Environment

When performing malicious network attack detection, traditional intrusion detection methods show their disadvantage of low accuracy and high false detection rate. To address these problems, this paper proposes a novel network intrusion detection scheme based on an improved bi-directional long short-term memory (Bi-LSTM) model under the emerging internet of things (IoT) environment. Firstly, this paper analyzes Bi-LSTM model. Then, it introduces a two-layer attention network structure into Bi-LSTM network. Finally, the corresponding network intrusion detection system is constructed based on the improved Bi STM model. Through simulation experiments, the proposed network intrusion detection method and other three methods are compared under five identical databases. Experimental results show that the false detection rate and detection accuracy of the proposed method are optimal on all sample data, the detection accuracy reaches 97.24% and the false detection rate drops to 5.13%.

Game-Theoretic Switching Detection of Malicious Attacks in Switched Systems

This paper is concerned with the detection of malicious attacks during the operation of switched systems. A novel game-theoretic switching detection scheme is proposed where the switching between subsystems is constructed aiming to reveal the existence of malicious attacks. The Kullback-Leibler (K-L) divergence between the legitimate and potentially falsified innovations is utilized as the stealthiness metric. Thereupon, a Stackelberg game is established to characterize the competition for stealthiness without any <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a priori</i> restriction on the antagonistic attacker. Furthermore, the Stackelberg equilibrium switching strategy of the detector is implemented to orchestrate the activation among subsystems during the detection procedure, and the K-L divergence corresponding to the Stackelberg equilibrium is adopted as the detection threshold. Finally, as an example, a continuous stirred tank reactor is employed to demonstrate the effectiveness and applicability of the proposed results.

GOSVM: Gannet optimization based support vector machine for malicious attack detection in cloud environment

GOSVM: Gannet optimization based support vector machine for malicious attack detection in cloud environment

Localization and Detection of Multiple Attacks in Wireless Sensor Networks Using Artificial Neural Network

Security enhancement in wireless sensor networks (WSNs) is significant in different applications. The advancement of routing attack localization is a crucial security research scenario. Various routing attacks degrade the network performance by injecting malicious nodes into wireless sensor networks. Sybil attacks are the most prominent ones generating false nodes similar to the station node. This paper proposed detection and localization against multiple attacks using security localization based on an optimized multilayer perceptron artificial neural network (MLPANN). The proposed scheme has two major part localization techniques and machine learning techniques for detection and localization WSN DoS attacks. The proposed system is implemented using MATLAB simulation and processed with the IBM SPSS toolbox and Python. The dataset is classified into training and testing using the multilayer perceptron artificial neural network to detect ten classes of attacks, including denial-of-service (DoS) attacks. Using the UNSW-NB, WSN-DS, NSL-KDD, and CICIDS2018 benchmark datasets, the results reveal that the suggested system improved with an average detection accuracy of 100%, 99.65%, 98.95%, and 99.83% for various DoS attacks. In terms of localization precision, recall, accuracy, and f-score, the suggested system outperforms state-of-the-art alternatives. Finally, simulations are done to assess how well the suggested method for detecting and localizing harmful nodes performs in terms of security. This method provides a close approximation of the unknown node position with low localization error. The simulation findings show that the proposed system is effective for the detection and secure localization of malicious attacks for scalable and hierarchically distributed wireless sensor networks. This achieved a maximum localization error of 0.49% and average localization accuracy of 99.51% using a secure and scalable design and planning approach.

Detection of Real-Time Malicious Intrusions and Attacks in IoT Empowered Cybersecurity Infrastructures

Computer viruses, malicious, and other hostile attacks can affect a computer network. Intrusion detection is a key component of network security as an active defence technology. Traditional intrusion detection systems struggle with issues like poor accuracy, ineffective detection, a high percentage of false positives, and an inability to handle new types of intrusions. To address these issues, we propose a deep learning-based novel method to detect cybersecurity vulnerabilities and breaches in cyber-physical systems. The proposed framework contrasts the unsupervised and deep learning-based discriminative approaches. This paper presents a generative adversarial network to detect cyber threats in IoT-driven IICs networks. The results demonstrate a performance increase of approximately 95% to 97% in terms of accuracy, reliability, and efficiency in detecting all types of attacks with a dropout value of 0.2 and an epoch value of 25. The output of well-known state-of-the-art DL classifiers achieved the highest true rate (TNR) and highest detection rate (HDR) when detecting the following attacks: (BruteForceXXS, BruteForceWEB, DoS_Hulk_Attack, and DOS_LOIC_HTTP_Attack) on the NSL-KDD, KDDCup99, and UNSW-NB15 datasets. It also maintained the confidentiality and integrity of users’ and systems’ sensitive information during the training and testing phases.

Android malicious attacks detection models using machine learning techniques based on permissions

The Android operating system is the most used mobile operating system in the world, and it is one of the most popular operating systems for different kinds of devices from smartwatches, IoT, and TVs to mobiles and cockpits in cars. Security is the main challenge to any operating system. Android malware attacks and vulnerabilities are known as emerging risks for mobile devices. The development of Android malware has been observed to be at an accelerated speed. Most Android security breaches permitted by permission misuse are amongst the most critical and prevalent issues threatening Android OS security. This research performs several studies on malware and non-malware applications to provide a recently updated dataset. The goal of proposed models is to find a combination of noise-cleaning algorithms, features selection techniques, and classification algorithms that are noise-tolerant and can achieve high accuracy results in detecting new Android malware. The results from the empirical experiments show that the proposed models are able to detect Android malware with an accuracy that reaches 87%, despite the noise in the dataset. We also find that the best classification results are achieved using the RF algorithm. This work can be extended in many ways by applying higher noise ratios and running more classifiers and optimizers.

DoS attack detection in identification of FIR systems with binary‐valued observations

AbstractTimely and effective detection of malicious attacks is a primary problem in cyber‐physical system security. This paper studies the detection of DoS (denial of service) attacks in identification of FIR (finite impulse response) systems with binary‐valued observations. Based on the prior information of the system, an attack detection algorithm is designed, and its online form is given. The detectability is discussed for the ability of detection algorithm, and the necessary and sufficient condition for the attack strategy to be detectable is obtained. The concepts of the missed detection rate and false alarm rate are introduced, and their calculation methods and approximate formulas under large samples are provided. Furthermore, it is analyzed the influence of prior information of system parameters and data length on the performance of detection algorithm. The rationality of theoretical results is verified by numerical simulation.

ENetRM: ElasticNet Regression Model based malicious cyber-attacks prediction in real-time server

Recently, cyber-attacks used unusual different malicious code or highly developed attack approaches like zero-day attacks which makes the process of detection more complex and difficult and thus traditional intrusion detection systems are unsuitable. For instance, 'botnet attacks are recent cyber-security threats. The endpoints are attacked either through malicious code or vulnerabilities. This affected system connects a communications channel to a command and control (C&C) server and issues comments to attack target servers.Malicious attacks are slow in carrying out denial of service (DoS) against webserver son protocols at application level like HTTP. Conventional signature-based intrusion detection systems are not appropriate to detect these attacks. To overcome this challenge, an artificial intelligence regression based malicious attack detection system is proposed for real-time attack detection of over encrypted traffic at application level. The process of malicious attack detection is done by the proposed ElasticNet Regression Model (ENetRM). The method has been validated in a real time application which proved its feasibility and ability to detect various slow DoS attacks over trafficin real-time. This goal is consistently achieved and thus the proposed model outperforms few standard approaches which are considered like Intrusion Detection System (NIDS), Novel Nested-Arc Hidden semi-Markov Model (NAHSMM) and Density-Based Spatial Clustering of Applications with Noise (DBSCAN).It is found that the proposed ENetRM method achieves 0.946 of precision. 0.9764 of recall, 0.9221 of F1-score, 97.04% of throughput and 53.48% of computation overhead.

Secure Data Transmission and Trustworthiness Judgement Approaches Against Cyber-Physical Attacks in an Integrated Data-Driven Framework

Threats of cyberattacks have penetrated from disclosing critical user information to destroying/manipulating industrial control systems. Study on data security during network transmission has raised increasing attention in the systems and control community, which is found very necessary and timely in the context of Industry 4.0. In most existing approaches, the protection of the transmitted data from eavesdropping attacks and the detection of malicious integrity attacks are usually carried out separately. In this study, an integrated data-driven framework applicable at the control level is proposed to deal with secure transmission and attack detection simultaneously. In the framework, a secure correlation-based encryption/decryption approach and a trustworthiness judgement approach are proposed. Comprehensive discussions are made regarding the analysis of the sensitivity to attacks, the introduced time delay, and the design degree-of-free. Executable algorithms are presented, corresponding to which hardware is modularized and can work standalone independent from the configuration of the monitoring and control systems or any third-party authentication agencies. Evaluation results on a simulated two-area frequency-load control power grid system are provided to show the effectiveness and performance of the proposed approaches.

Malicious attacks detection using GRU-BWFA classifier in pervasive computing

With the advanced trends in pervasive computing, the data users were subjected to face different kinds of attacks. Several algorithms for attack detection was performed with minimal accuracy in prediction and consideration of performance metrics was not effective. Hence effective and prompt detection of malicious attacks must be optimized in terms of confidentiality, privacy, availability and integrity. Accordingly, the proposed research paper provides an effective mechanism for detecting and classifying DDoS attacks such as TCP-SYN, UDP flood, ICMP echo, HTTP flood, Slow Loris Slow Post and Brute Force attack, by utilizing machine learning methods within the UNSW-NB15 dataset and NSL-KDD dataset. Significantly, Gated Recurrent Unit Neural Network based on Bidirectional Weighted Feature Averaging (GRU-BWFA) classifier is utilized as a proposed classifier approach for high detection rate and accuracy in distinguishing the mentioned DDoS attacks. Feature selection is performed using the Enhanced Salp Swarm Optimization technique to select the optimal features for identifying the attacks. The proposed classifier evaluates with other different classifiers which provide a detailed study in detecting DDoS attacks using the UNSW-NB15 dataset and NSL-KDD dataset. The proposed model results 0.9936 accuracy for UNSW-NB 15 dataset and 0.9918 accuracy for NSL-KDD dataset. Empirical findings indicate that machine learning methods are highly effective at detecting and classifying attacks with a higher accuracy rate.

Toward Efficient Intrusion Detection System Using Hybrid Deep Learning Approach

The increased adoption of cloud computing resources produces major loopholes in cloud computing for cybersecurity attacks. An intrusion detection system (IDS) is one of the vital defenses against threats and attacks to cloud computing. Current IDSs encounter two challenges, namely, low accuracy and a high false alarm rate. Due to these challenges, additional efforts are required by network experts to respond to abnormal traffic alerts. To improve IDS efficiency in detecting abnormal network traffic, this work develops an IDS using a recurrent neural network based on gated recurrent units (GRUs) and improved long short-term memory (LSTM) through a computing unit to form Cu-LSTMGRU. The proposed system efficiently classifies the network flow instances as benign or malevolent. This system is examined using the most up-to-date dataset CICIDS2018. To further optimize computational complexity, the dataset is optimized through the Pearson correlation feature selection algorithm. The proposed model is evaluated using several metrics. The results show that the proposed model remarkably outperforms benchmarks by up to 12.045%. Therefore, the Cu-LSTMGRU model provides a high level of symmetry between cloud computing security and the detection of intrusions and malicious attacks.