Malicious Activities In Network Research Articles

An improved focal loss for imbalanced network traffic classification

With the continued progress of the Internet, network security has become an increasingly significant issue that requires constant attention and research. Network traffic classification is a key technology used to detect and prevent malicious network activity, and it has accordingly received increasing attention and research. However, datasets related to malicious network traffic classification often have imbalanced characteristics. In conventional traffic classification problems with multiple categories, the sample size characteristics of small categories are often overlooked. To address this issue, the focal loss function was proposed, which focuses on small samples by modulating the trade-off between the positive and negative samples through two hyperparameters and . This article uses convolutional neural networks (CNN) to tackle traffic classification problem and explore the optimal values of parameters in this application scenario. Additionally, this work proposed a novel weight allocation formula to replace , which allowed small class traffic to obtain higher accuracy.

Intrusion Detection System

The use of encrypted data, the diversity of new protocols, and the surge in the number of malicious activities worldwide have posed new challenges for intrusion detection systems (IDS). In this scenario, existing signature-based IDS are not performing well. Various researchers have proposed machine learning-based IDS to detect unknown malicious activities based on behaviour patterns. Results have shown that machine learning-based IDS perform better than signature-based IDS (SIDS) in identifying new malicious activities in the communication network. In this paper, the authors have analyzed the IDS dataset that contains the most current common attacks and evaluated the performance of network intrusion detection systems by adopting two data resampling techniques and 10 machine learning classifiers. It has been observed that the top three IDS models—KNeighbors, XGBoost, and AdaBoost—outperform binary-class classification with 99.49%, 99.14%, and 98.75% accuracy, and XGBoost, KNneighbors, and GaussianNB outperform in multi-class classification with 99.30%, 98.88%, and 96.66% accuracy.

Discriminative spatial-temporal feature learning for modeling network intrusion detection systems

Increasing interest and advancement of internet and communication technologies have made network security rise as a vibrant research domain. Network intrusion detection systems (NIDSs) have developed as indispensable defense mechanisms in cybersecurity that are employed in discovery and prevention of malicious network activities. In the recent years, researchers have proposed deep learning approaches in the development of NIDSs owing to their ability to extract better representations from large corpus of data. In the literature, convolutional neural network architecture is extensively used for spatial feature learning, while the long short term memory networks are employed to learn temporal features. In this paper, a novel hybrid method that learn the discriminative spatial and temporal features from the network flow is proposed for detecting network intrusions. A two dimensional convolution neural network is proposed to intelligently extract the spatial characteristics whereas a bi-directional long short term memory is used to extract temporal features of network traffic data samples consequently, forming a deep hybrid neural network architecture for identification and classification of network intrusion samples. Extensive experimental evaluations were performed on two well-known benchmarks datasets: CIC-IDS 2017 and the NSL-KDD datasets. The proposed network model demonstrated state-of-the-art performance with experimental results showing that the accuracy and precision scores of the intrusion detection model are significantly better than those of other existing models. These results depicts the applicability of the proposed model in the spatial-temporal feature learning in network intrusion detection systems.

Anomaly detection system for network transport with machine learning approach

The rapid growth of network infrastructures and the increasing volume of data transmitted through them have led to a critical need for efficient and accurate anomaly detection systems in network transport. This paper proposes a novel anomaly detection system that utilizes machine learning techniques to identify abnormal patterns and deviations in network traffic. The proposed system follows a multi-layered approach, starting with the collection of network traffic data from various sources, including routers, switches, and gateways. The data is then preprocessed to extract relevant features and eliminate noise. Feature extraction is carried out using statistical, time-series, and flow-based analysis to capture the inherent characteristics of network communication. Machine learning algorithms, such as neural networks, or in this case, auto-encoders, will be trained to learn the patterns of normal network behavior and subsequently detect deviations from these patterns as anomalies. The system provides alerts and notifications to network administrators, allowing prompt investigation and response to potential security threats or network performance issues. It effectively differentiates between benign and malicious network activities, enabling network administrators to take proactive measures to secure their infrastructure and ensure uninterrupted communication.

Deep Belief Network-Based User and Entity Behavior Analytics (UEBA) for Web Applications

Machine learning (ML) is currently a crucial tool in the field of cyber security. Through the identification of patterns, the mapping of cybercrime in real time, and the execution of in-depth penetration tests, ML is able to counter cyber threats and strengthen security infrastructure. Security in any organization depends on monitoring and analyzing user actions and behaviors. Due to the fact that it frequently avoids security precautions and does not trigger any alerts or flags, it is much more challenging to detect than traditional malicious network activity. ML is an important and rapidly developing anomaly detection field in order to protect user security and privacy, a wide range of applications, including various social media platforms, have incorporated cutting-edge techniques to detect anomalies. A social network is a platform where various social groups can interact, express themselves, and share pertinent content. By spreading propaganda, unwelcome messages, false information, fake news, and rumours, as well as by posting harmful links, this social network also encourages deviant behavior. In this research, we introduce Deep Belief Network (DBN) with Triple DES, a hybrid approach to anomaly detection in unbalanced classification. The results show that the DBN-TDES model can typically detect anomalous user behaviors that other models in anomaly detection cannot.

Blockchain-Assisted Machine Learning with Hybrid Metaheuristics-Empowered Cyber Attack Detection and Classification Model

Cyber attack detection is the process of detecting and responding to malicious or unauthorized activities in networks, computer systems, and digital environments. The objective is to identify these attacks early, safeguard sensitive data, and minimize the potential damage. An intrusion detection system (IDS) is a cybersecurity tool mainly designed to monitor system activities or network traffic to detect and respond to malicious or suspicious behaviors that may indicate a cyber attack. IDSs that use machine learning (ML) and deep learning (DL) have played a pivotal role in helping organizations identify and respond to security risks in a prompt manner. ML and DL techniques can analyze large amounts of information and detect patterns that may indicate the presence of malicious or cyber attack activities. Therefore, this study focuses on the design of blockchain-assisted hybrid metaheuristics with a machine learning-based cyber attack detection and classification (BHMML-CADC) algorithm. The BHMML-CADC method focuses on the accurate recognition and classification of cyber attacks. Moreover, the BHMML-CADC technique applies Ethereum BC for attack detection. In addition, a hybrid enhanced glowworm swarm optimization (HEGSO) system is utilized for feature selection (FS). Moreover, cyber attacks can be identified with the design of a quasi-recurrent neural network (QRNN) model. Finally, hunter–prey optimization (HPO) algorithm is used for the optimal selection of the QRNN parameters. The experimental outcomes of the BHMML-CADC system were validated on the benchmark BoT-IoT dataset. The wide-ranging simulation analysis illustrates the superior performance of the BHMML-CADC method over other algorithms, with a maximum accuracy of 99.74%.

Maintainable Log Datasets for Evaluation of Intrusion Detection Systems

Intrusion detection systems (IDS) monitor system logs and network traffic to recognize malicious activities in computer networks. Evaluating and comparing IDSs with respect to their detection accuracies is thereby essential for their selection in specific use-cases. Despite a great need, hardly any labeled intrusion detection datasets are publicly available. As a consequence, evaluations are often carried out on datasets from real infrastructures, where analysts cannot control system parameters or generate a reliable ground truth, or private datasets that prevent reproducibility of results. As a solution, we present a collection of maintainable log datasets collected in a testbed representing a small enterprise. Thereby, we employ extensive state machines to simulate normal user behavior and inject a multi-step attack. For scalable testbed deployment, we use concepts from model-driven engineering that enable automatic generation and labeling of an arbitrary number of datasets that comprise repetitions of attack executions with variations of parameters. In total, we provide 8 datasets containing 20 distinct types of log files, of which we label 8 files for 10 unique attack steps. We publish the labeled log datasets and code for testbed setup and simulation online as open-source to enable others to reproduce and extend our results.

Preprocessing Impact Analysis for Machine Learning-Based Network Intrusion Detection

Machine learning (ML) has been frequently used to build intelligent systems in many problem domains, including cybersecurity. For malicious network activity detection, ML-based intrusion detection systems (IDSs) are promising due to their ability to classify attacks autonomously after learning process. However, this is a challenging task due to the vast number of available methods in the current literature, including ML classification algorithms and preprocessing techniques. For analysis the impact of preprocessing techniques on the ML algorithm, this study has conducted extensive experiments, using support vector machines (SVM), the classifier and the FS technique, several normalisation techniques, and a grid-search classifier optimisation algorithm. These methods were sequentially tested on three publicly available network intrusion datasets, NSL-KDD, UNSW-NB15, and CICIDS2017. Subsequently, the results were analysed to investigate the impact of each model and to extract the insights for building intelligent and efficient IDS. The results exhibited that data preprocessing significantly improves classification performance and log-scaling normalisation outperformed other techniques for intrusion detection datasets. Additionally, the results suggested that the embedded SVM-FS is accurate and classifier optimisation can improve performance of classifier-dependent FS techniques. However, feature selection in classifier optimisation is a critical problem that must be addressed. In conclusion, this study provides insights for building ML-based NIDS by revealing important information about data preprocessing.

Detection of Malicious Network Activity by Artificial Neural Network

This paper presents a deep learning approach to detect malicious communication in a computer network. The intercepted communication is transformed into behavioral feature vectors that are reduced (using principal component analysis and stepwise selection methods) and normalized to create training and test sets. A feed-forward artificial neural network is then used as a classifier to determine the type of malicious communication. Three training algorithms were used to train the neural network: the Levenberg-Marquardt algorithm, Bayesian regularization, and the scaled conjugate gradient backpropagation algorithm. The proposed artificial neural network topology after reducing the size of the training and test sets achieves a correct classification probability of 81.5 % for each type of malicious communication and of 99.6 % (and better) for normal communication.

A gradient-based approach for adversarial attack on deep learning-based network intrusion detection systems

Intrusion detection systems are an essential part of any cybersecurity architecture. These systems are critical in defending networks against a variety of security threats. In recent years, deep neural networks have proved their performance and efficiency in various machine learning tasks, including intrusion detection. However, it is shown that deep learning models are highly vulnerable to adversarial attacks. This paper proposes a new approach for performing an adversarial attack against deep learning-based malicious network activity classification. We use the Jacobian Saliency Map to find the best group of features, with different features and perturbation magnitude, to generate adversarial examples. We evaluate our method on three CIC-IDS2017, CIC-IDS2018, and CIC-DDoS2019 datasets. Our experiments show that our proposed method can achieve better performance while using fewer features in adversarial sample generation than other attacks that depend on a higher number of features. Our technique can generate adversarial samples for more than 18% of samples in CIC-IDS2017, 15% of samples in CIC-IDS2018, and 14% of samples in CIC-DDoS2019, using only three features and 0.1 as the perturbation magnitude. We do a deeper analysis of the attack based on its parameters, distance metrics, and the target model performance. Also, an evaluation model with three criteria, including success rates of the best feature sets, average confidence of the adversarial class, and adversarial samples transferability, is used in our analysis.

FECC: DNS tunnel detection model based on CNN and clustering

As the basic service of the network, the Domain Name System (DNS) is almost never blocked by the firewall. DNS tunnel takes advantage of this feature of DNS service to achieve barrier-free communication between the internal network and the external network, thereby implementing malicious network activities such as data theft and Command & Control (C2) control. As an intrusion means, DNS tunnel constitutes a serious threat to network security. At present, some research work on DNS tunnel detection is implemented based on manual features, which are “explicit” features. DNS tunnels can specifically circumvent these “explicit” features as they are designed, rendering detection methods ineffective. Additionally, the quality of these manual features also relies heavily on expert knowledge. The features extracted by the detection method based on convolutional neural network (CNN) have the characteristics of “implicit” that are not easily circumvented by DNS tunnels. However, the homogeneity and exclusivity of features are not considered in the existing research works that only perform the model training for classification tasks on datasets with limited sample types. This can cause the model to fail when detecting variants or new types of DNS tunnels. This paper proposes a novel DNS tunnel detection model, called FECC (Feature Extraction CNN and Clustering), to effectively detect various DNS Tunnel traffic. FECC takes the payload of the transport layer as input without preprocessing. The model uses a CNN-based module to extract features, then the homogeneity and exclusivity of features are evaluated based on the clustering method. FECC uses a cluster-based loss function to optimize the model parameters, which greatly improves the detection rate of the model for both classification tasks and unknown types of DNS tunnels, and further reduces the false positive rate. We have deployed a variety of DNS tunnel tools in the laboratory environment and constructed multiple datasets for sufficient comparison experiments. The experimental results show that FECC is a very effective DNS tunnel detection model.

Defending against adversarial machine learning attacks using hierarchical learning: A case study on network traffic attack classification

Machine learning is key for automated detection of malicious network activity to ensure that computer networks and organizations are protected against cyber security attacks. Recently, there has been growing interest in the domain of adversarial machine learning, which explores how a machine learning model can be compromised by an adversary, resulting in misclassified output. Whilst to date, most focus has been given to visual domains, the challenge is present in all applications of machine learning where a malicious attacker would want to cause unintended functionality, including cyber security and network traffic analysis. We first present a study on conducting adversarial attacks against a well-trained network traffic classification model. We show how well-crafted adversarial examples can be constructed so that known attack types are misclassified by the model as benign activity. To combat this, we present a novel defensive strategy based on hierarchical learning to help reduce the attack surface that an adversarial example can exploit within the constraints of the parameter space of the intended attack. Our results show that our defensive learning model can withstand crafted adversarial attacks and can achieve classification accuracy in line with our original model when not under attack.

Anomaly Detection in Industrial IoT Using Distributional Reinforcement Learning and Generative Adversarial Networks.

Anomaly detection is one of the biggest issues of security in the Industrial Internet of Things (IIoT) due to the increase in cyber attack dangers for distributed devices and critical infrastructure networks. To face these challenges, the Intrusion Detection System (IDS) is suggested as a robust mechanism to protect and monitor malicious activities in IIoT networks. In this work, we suggest a new mechanism to improve the efficiency and robustness of the IDS system using Distributional Reinforcement Learning (DRL) and the Generative Adversarial Network (GAN). We aim to develop realistic and equilibrated distribution for a given feature set using artificial data in order to overcome the issue of data imbalance. We show how the GAN can efficiently assist the distributional RL-based-IDS in enhancing the detection of minority attacks. To assess the taxonomy of our approach, we verified the effectiveness of our algorithm by using the Distributed Smart Space Orchestration System (DS2OS) dataset. The performance of the normal DRL and DRL-GAN models in binary and multiclass classifications was evaluated based on anomaly detection datasets. The proposed models outperformed the normal DRL in the standard metrics of accuracy, precision, recall, and F1 score. We demonstrated that the GAN introduced in the training process of DRL with the aim of improving the detection of a specific class of data achieves the best results.

Hybrid Bayesian optimization hypertuned catboost approach for malicious access and anomaly detection in IoT nomalyframework

The successful applications and diversified popularity of the Internet of Things (IoT) present various advantages and opportunities in broad characteristics of our lives. However, unfortunately, the IoT is allied with several types of defenseless attacks and illegitimate exploits. Security specialists specify voluminous threats imposed by the IoT devices in various aspects. Therefore, security and intrusion detection have constantly been growing areas of distress for any field of IoT research. This paper introduces a new hybrid ensemble hyper-tuned model (i.e., Catboost) that efficiently recognizes IoT sensor attacks and anomalies. The hyper-parameters are optimized with Bayesian optimization to develop security-based models effectively. The significant contributions of this work are the design of an intelligent model-based security framework based on the advanced ensemble learning Catboost model for detecting malicious IoT activities in the IoT network, the use of a Bayesian optimization approach to find an optimal set of Catboost hyper-parameters, and evaluate the model with a new real dataset (DOS2DOS) from a large-scale IoT network. The performance of the proposed model is compared with other state-of-the-art approaches, and the experimental results are evident towards a high detection rate of 99.9%.

Light gradient boosting machine with optimized hyperparameters for identification of malicious access in IoT network

In this paper, an advanced and optimized Light Gradient Boosting Machine (LGBM) technique is proposed to identify the intrusive activities in the Internet of Things (IoT) network. The followings are the major contributions: i) An optimized LGBM model has been developed for the identification of malicious IoT activities in the IoT network; ii) An efficient evolutionary optimization approach has been adopted for finding the optimal set of hyper-parameters of LGBM for the projected problem. Here, a Genetic Algorithm (GA) with k-way tournament selection and uniform crossover operation is used for efficient exploration of hyper-parameter search space; iii) Finally, the performance of the proposed model is evaluated using state-of-the-art ensemble learning and machine learning-based model to achieve overall generalized performance and efficiency. Simulation outcomes reveal that the proposed approach is superior to other considered methods and proves to be a robust approach to intrusion detection in an IoT environment.

A secure healthcare 5.0 system based on blockchain technology entangled with federated learning technique

In recent years, the global Internet of Medical Things (IoMT) industry has evolved at a tremendous speed. Security and privacy are key concerns on the IoMT, owing to the huge scale and deployment of IoMT networks. Machine learning (ML) and blockchain (BC) technologies have significantly enhanced the capabilities and facilities of healthcare 5.0, spawning a new area known as “Smart Healthcare.” By identifying concerns early, a smart healthcare system can help avoid long-term damage. This will enhance the quality of life for patients while reducing their stress and healthcare costs. The IoMT enables a range of functionalities in the field of information technology, one of which is smart and interactive health care. However, combining medical data into a single storage location to train a powerful machine learning model raises concerns about privacy, ownership, and compliance with greater concentration. Federated learning (FL) overcomes the preceding difficulties by utilizing a centralized aggregate server to disseminate a global learning model. Simultaneously, the local participant keeps control of patient information, assuring data confidentiality and security. This article conducts a comprehensive analysis of the findings on blockchain technology entangled with federated learning in healthcare. 5.0. The purpose of this study is to construct a secure health monitoring system in healthcare 5.0 by utilizing a blockchain technology and Intrusion Detection System (IDS) to detect any malicious activity in a healthcare network and enables physicians to monitor patients through medical sensors and take necessary measures periodically by predicting diseases. The proposed system demonstrates that the approach is optimized effectively for healthcare monitoring. In contrast, the proposed healthcare 5.0 system entangled with FL Approach achieves 93.22% accuracy for disease prediction, and the proposed RTS-DELM-based secure healthcare 5.0 system achieves 96.18% accuracy for the estimation of intrusion detection.

A Method For Network Intrusion Detection Using Deep Learning

In an increasingly digitally reliant world, organizations are facing the ever more challenging problem of how to best defend their digital information and infrastructure. Current non-machine learning methods for detecting network intrusion, like signature-based and anomaly-based algorithms, are slow and unreliable. Signature based detection holds signatures, or known information and warning signs, about a known attack and compares them to the current flow of data. If a signature matches with the network activity, users and network administrators are notified. Anomaly based detection is where the system monitors current network traffic and compares it to a set baseline traffic. Again, if any unusual traffic occurs, members of the network are notified. In this research, new advancements in deep learning algorithms are used to bolster the defenses of digital networks. Neural networks are used to create a multi-class classifier, which will determine whether the network activity is a certain type of malicious attack or benign. We will use the CICIDS2017 dataset (Canadian Institute of Cybersecurity), which is a state-of-the-art network intrusion dataset composed of computer network activity, including multiple types of attacks such as DDoS, SQL Injection, and Brute Force. This research proposes a more precise network intrusion detection system (NIDS) to accurately detect malicious network activity. Better NIDSs will also prevent cybercrime and create a safer internet for all users.

Editorial For Vol.29, No.3

The four papers that make up the September 2021 issue (Vol. 29, No. 3) of CIT. Journal of Computing and Information Technology cover the areas of countering malicious activities in social networks, predictions in intelligent agriculture, use of artificial intelligence in the judiciary, and modeling of intelligent logistics.

Performance Comparison of Ensemble Learning and Supervised Algorithms in Classifying Multi-label Network Traffic Flow

Network traffic classification is of significant importance. It helps identify network anomalies and assists in taking measures to avoid them. However, classifying network traffic correctly is a challenging task. This study aims to compare ensemble learning methods with normal supervised classification to come up with improved classification methods. Three types of network traffic were classified (Benign, Malicious, and Outliers). The data were collected experimentally by using Paessler Router Traffic Grapher software and online and were analyzed by R software. The datasets were used to train five supervised models (k-nearest neighbors, mixture discriminant analysis, Naïve Bayes, C5.0 classification model, and regularized discriminant analysis). The models were trained by 70% of the samples and the rest 30% were used for validation. The same samples were used separately in predicting individual accuracy. The results were compared to the ensemble learning models which were built with the use of the same datasets. Among the five supervised classifiers, k-nearest neighbors and C5.0 classification scored the highest accuracy of 0.868 and 0.761. The ensemble learning classifiers Bagging (Random Forest) and Boosting (eXtreme Gradient Boosting) had accuracy of 0.904 and 0.902 respectively. The results show that the ensemble learning method has higher accuracy compared to the normal supervised classifiers. Therefore, it can be used to detect malicious activities in network traffic as well as anomalies with improved accuracy.

AAAN: Anomaly Alignment in Attributed Networks

Anomaly subgraph detection is an important problem that has been well researched in various applications, ranging from cyberattacks in computer networks to malicious activities in social networks. Most existing approaches detect anomaly subgraphs in attributed networks with sufficient features. However, multitudinous industry data with insufficient anomalous attributes are the main challenge for traditional anomaly subgraph detection algorithms. In particular, none of the literature focuses on connected anomaly subgraph detection with insufficient anomalous features. To address this problem, we propose Anomaly Alignment in Attributed Networks (AAAN), which first detects connected anomaly subgraphs by aligning anomalies in two attributed networks (one with insufficient anomalous features and the other with sufficient anomalous features). Extensive experiments on three real-world datasets (the Weibo, Baidu migration network, and COVID-19 pandemic datasets) show the effectiveness and efficiency of our algorithm. We can identify the crime hotspots in terms of city blocks from urban traffic networks, which are aligned with the criminal events reported on social networks. The results also demonstrate how AAAN outperforms competitive approaches in the COVID-19 outbreak anomaly subgraph detection and urban crime hotspot detection tasks.