Network Anomaly Detection Research Articles

DETECTION OF NETWORK ANOMALIES WITH NEURAL NETWORKS ALGORITHMS

The rapid digitalization of the world has led to various attacks on computer systems and networks, so network security is an extremely important and relevant component of information security today. Creating effective cybersecurity tools and mechanisms is becoming increasingly difficult as the number of different devices and services grows. Identification of malicious traffic using deep learning methods has become a key component of intrusion detection systems (IDS). This article compares two deep learning models (recurrent neural network and convolutional neural network) for detecting anomalies in networks. Both neural networks were found to be useful in a wide range of applications. It has been shown that convolutional neural networks are best at detecting network anomalies in synergy with layers of long short-term memory. The development of deep learning technologies, including the considered neural network algorithms, is a promising direction in promoting the development of cybersecurity of information systems. These technologies are unique because they are at the initial stage of creation. The aforementioned technologies are currently not widespread in intrusion detection and network anomaly detection systems due to their novelty, so they require more thorough research. Conventional machine learning algorithms will eventually become insufficient, as they do not have such a good learning capability as deep learning neural networks do. The article provides a detailed analysis of the capabilities of recurrent and convolutional neural networks along with long short-term memory layers, which may be useful for use in further research.

Anomaly Detection in Complex Power Grid using Organic Combination of Various Deep Learning (OC-VDL)

The development of power industries creates impacts on the intelligent power grids. The power grids are more valuable for transmitting information over the network. Several intermediate activities influence the networks, which are interrupted by traffic, creating network security issues. Therefore, the threats highly influence power grids, and the number of attacks also increased gradually. Several conceptual approaches are introduced to overcome the security issues; however, computation complexity is still a significant problem while detecting network anomalies. This research problem is overcome by applying the Organic Combination of Various Deep Learning (OC-VDL) approach. The introduced method observes the industry standards with the help of the Innovative Blockchain Network (IBN). During this process, IBN observes the infrastructure using the communication protocol and Manufacturing Internet of Things (IoT). The collected information is processed with the help of the Intense Autoencoder Classifier Model (IACM), which manages bilateral traffic control and helps predict abnormal activities. The effective prediction of network traffic minimizes the intermediate activities and improves the overall security up to 98.8% accuracy.

Network Anomaly Detection Through IP Traffic Analysis With Variable Granularity

Network Anomaly Detection Through IP Traffic Analysis With Variable Granularity

Federated Graph Neural Network for Fast Anomaly Detection in Controller Area Networks

Due to the lack of CAN frame encryption and authentication, CAN bus is vulnerable to various attacks, which can in general be divided into message injection, suspension, and falsification. Existing CAN bus anomaly detection mechanisms either can only detect one or two of these attacks, or require numerous CAN messages during predictions, which can hardly realize real-time performance. In this paper, we propose a CAN bus anomaly detection system that can detect all these attacks simultaneously in as short as 3 milliseconds (ms) based on Graph Neural Network (GNN). This work generates directed attributed graphs based on CAN message streams in given message intervals. Node attributes denote data contents in CAN messages while each edge attribute represents the frequency of a typical CAN ID pair in the given interval. Afterwards, a GNN is trained based on generated CAN message graphs. Considering highly imbalanced training data, a two-stage classifier cascade is developed in this paper, which is composed of a one-class classifier for anomaly detection and a multi-class classifier for attack classification. An openmax layer is further introduced to the multi-class classifier to tackle new anomalies from unknown classes. To take advantage of crowdsourcing while protecting user data privacy, we adopt federated learning to train a universal model that covers different driving scenarios and vehicle states. Extensive experiment results show the effectiveness and efficiency of our methodology.

A new model for security analysis of network anomalies for IoT devices

In the era of IoT gaining traction, attacks on IoT-enabled devices are the order of the day that emanates the need for more protected IoT networks. IoT's key feature deals with massive amounts of data sensed by numerous heterogeneous IoT devices. Numerous machine learning techniques are used to collect data from different types of sensors on the objects and transform them into information relevant to the application. Furthermore, business and data analytics algorithms help in event prediction based on observed behavior and information. Routing information securely over the internet with limited resources in IoT applications is a key problem. The study proposes a model for detecting network anomalies in IoT devices to enhance the security of the devices. The study employed the IoT Botnet dataset, and K-fold cross-validation tests were used for validating the values of evaluation metrics. The average values of Accuracy, Precision, Recall, and F Score was 97.4.

MATHEMATICAL METHODS IN CYBERSECURITY: CATASTROPHE THEORY

The improvement of protection systems is based on the introduction and use of a mathematical apparatus. Ensuring the confidentiality, integrity and availability of information is an urgent and important problem in the modern world. Crisis processes are characteristic phenomena in security systems, so stochastic models cannot always describe their functioning and give a solution. An effective tool for solving this problem can be the use of dynamic models based on the provisions of catastrophe theory. This study is devoted to the analysis of modern approaches to the use of the basic provisions of catastrophe theory in cybersecurity systems. The work presents a brief historical view of the development of this theory and highlights the main definitions: bifurcations, attractors, catastrophes. Elementary catastrophes, their forms and features are characterized. A review of the literary sources of the use of catastrophe theory in information and cyber security was carried out. The analysis made it possible to single out that this theory has not yet been widely implemented, but there are point scientific developments in the process of detecting network anomalies in the cloud environment. The considered approaches to the application of catastrophe theory in information and cyber security can be used to train specialists in the specialty 125 Cybersecurity in the process of research

DEVELOPMENT OF A NEURAL NETWORK STRUCTURE FOR INTRUSION DETECTION ANALYSIS

The right security solutions in the information and communication world are critical to network security by providing real-time network protection against network vulnerabilities and data usage. An effective intrusion detection strategy is able to use a holistic approach to protect critical systems from unauthorized access or attacks. The paper examines the latest scientific achievements and research related to the analysis of detection of network intrusions using machine learning (ML) methods. The article describes a complex security solution based on machine learning (ML) for network intrusion detection using a complex controlled ML structure and ensemble feature selection methods. In addition, a comparative analysis of several MH models and function selection methods is provided. The article develops a general mechanism for detecting and achieving higher accuracy with a minimum frequency of false positive results (FPR). The paper uses datasets and the results show that the detection model can successfully identify 99.3% of intrusions with the lowest error rate of 0.5%, which shows better performance compared to existing solutions. The article combines the selection of ensemble functions and ensemble machine learning approaches as a detection mechanism in SBB to detect network anomalies. An experimental study was conducted with feature sets obtained from nine feature selection methods, and then these feature sets were combined to obtain the minimum number of features using majority voting. A comparative analysis of sets of functions was carried out. Controlled methods are used, which are more efficient with a balanced data set. To make the training dataset balanced, the data type (benign or attacking) with the minimum number of data instances in that training dataset was first selected. An ensemble feature selection and ensemble classification algorithm is implemented to improve the overall performance of the proposed machine learning model. Prospects for the development of further research are proposed.

CNN-BiLSTM Hybrid Model for Network Anomaly Detection in Internet of Things

Anomaly detection in internet of things network traffic is a critical aspect of intrusion and attack detection, in which a deviation from typical behavior signals the existence of malicious or inadvertent assaults, faults, flaws, and other issues. The necessity to examine a large number of security events to identify anomalous behavior of smart devices adds to the urgency of addressing the challenge of picking machine-learning and deep learning models for identifying anomalies in network traffic. For the challenge of binary data categorization, a software implementation of an intrusion detection system based on supervised-learning algorithms has been completed. The UNSW-NB15 open dataset, which contains 2,540,044 records - vectors of TCP/IP network connection signals and their associated class labels are used to train and test the system. This research compares different machine-learning models and proposes CNN-BiLSTM hybrid model for IoT network intrusion detection. The metrics for measuring the quality of classification and the running duration of algorithms for different ratios of train and test samples are the result of the built framework testing.

Retracted: A Deep Spiking Neural Network Anomaly Detection Method.

[This retracts the article DOI: 10.1155/2022/6391750.].

IPFS based storage Authentication and access control model with optimization enabled deep learning for intrusion detection

Network security has benefited from intrusion detection, which may spot unexpected threats from network traffic. Modern methods for detecting network anomalies typically rely on conventional machine learning models. The human construction of traffic features that these systems mainly rely on, which is no longer relevant in the age of big data, results in relatively low accuracy and certain exceptional features. A storage authentication and access control model based on Interplanetary File System (IPFS) and a network intrusion detection system based on Chronological Anticorona Virus Optimization are hence the main goals of this research (CACVO-based DRN).The setup, user registration, initialization, data encryption and storage, authentication, testing, access control, and decryption stages are used here to perform the blockchain authentication and access control. After then, DRN is used to perform network intrusion detection. To do this, the recorded data log file is initially sent to the feature fusion module, which uses Deep Belief Network and hybrid correlation factors (DBN). After the feature fusion is complete, the proposed optimization technique, CACVO, which was recently developed by fusing the Chronological Concept with Anti Corona virus Optimization (ACVO) algorithm, is used to perform intrusion detection utilizing DRN. The experimental outcome shows that, based on the f-measure value of 0.939 and 0.938, respectively, the developed model achieved greater performance.

EWMA control charts using generalized centrality measures for social network monitoring

The monitoring and detection of network anomalies have become an interesting topic in social network analysis. One approach for detecting such anomalies is to apply conventional centrality measures, such as degree centrality, closeness centrality, and betweenness centrality, to control charts. Another approach involves the use of hybrid centrality measures, such as degree-degree, degree-closeness, and degree-betweenness, which are generated by combining traditional centrality measures and emphasize the importance of actors in the network. From another perspective, most studies on weighted networks have used centrality measures based on tie weights alone and have not accounted for the number of ties. In this paper, we propose exponentially weighted moving average (EWMA) charting procedures that use several types of centrality measures based on the number and weights of ties in undirected weighted networks. We then evaluate the anomaly-detection performance of these measures on weighted networks using EWMA charts. Simulation results indicate that degree and degree-degree centralities perform well for small changes, while betweenness and degree centralities perform well for large changes. In addition, centrality measures that consider both the number and weights of ties, with more importance given to the weights were determined to be better at detecting anomalies.

A multi-scale reconstruction method for the anomaly detection in stochastic dynamic networks

Detecting anomalous edges and/or nodes is a challenging problem for dynamic networks, due to the spatio-temporal (ST) patterns and randomness underneath the time-varying topology and node attributes. Existing methods commonly ignore randomness, and the anomaly detectors would be sensitive, especially in highly variable dynamic networks. In this paper, a new reconstruction method, the multi-scale variational graph recurrent autoencoder (M-VGRAE), is designed to detect anomalies in stochastic dynamic networks. Overall, upon the framework of Learning from Pure Normal (LPN), the M-VGRAE is trained to reconstruct the normal nodes and edges, and is used to detect the anomalies that cannot be reconstructed well by the trained M-VGRAE. To reduce sensitivity against the high variability, the reconstruction of stochastic dynamic networks is performed in a multi-scale manner. Specifically, the randomness is modeled by introducing multiple latent random variables at each node, each of which models the local randomness of attributes and connectivity within the temporal neighborhoods in a specific hop and historical interval. Then, the local randomness is approximated by employing the variational autoencoder (VAE) with a designed multi-scale ST feature extractor based on graph neural networks and recurrent neural networks. By such design, the capture of ST patterns and the modeling of randomness are jointly achieved. To show the effectiveness of the M-VGRAE in detecting anomalous edges and nodes, experiments are conducted on four real-world datasets of dynamic networks. The results demonstrate that the M-VGRAE consistently outperforms the existing baselines in terms of AUC score on anomaly detection.

Monitoring unweighted networks with communities based on latent logit model

Nowadays it is common to see information exchange among certain nodes in various network systems such as Internet of Things (IoT) and social networks. Once anomalies occur in a network system, the interaction frequency will increase or decrease abruptly. Detecting such changes has attracted much attention in the field of statistical process control (SPC). However, limited number of research incorporate the heterogeneity and community information of nodes simultaneously. The loss of information refrains the control chart from detecting network anomalies in a timely manner. In this regard, we propose a logit model with latent factors of nodes and communities to describe the variation of communications within unweighted networks, where the presence and absence of communication between each pair of nodes is regarded as a Bernoulli variable. Then the proposed model is expressed in a matrix form to enable easy parameter estimation and derivation of monitoring statistic. A new control chart is established based on generalized likelihood ratio test (GLRT). The simulation results and two real examples demonstrate the effectiveness and advantages of proposed control chart in comparison with two alternative methods.

Computer cyberspace security mechanism supported by cloud computing.

To improve the cybersecurity of Cloud Computing (CC) system. This paper proposes a Network Anomaly Detection (NAD) model based on the Fuzzy-C-Means (FCM) clustering algorithm. Secondly, the Cybersecurity Assessment Model (CAM) based on Grey Relational Grade (GRG) is creatively constructed. Finally, combined with Rivest Shamir Adleman (RSA) algorithm, this work proposes a CC network-oriented data encryption technology, selects different data sets for different models, and tests each model through design experiments. The results show that the average Correct Detection Rate (CDR) of the NAD model for different types of abnormal data is 93.33%. The average False Positive Rate (FPR) and the average Unreported Rate (UR) are 6.65% and 16.27%, respectively. Thus, the NAD model can ensure a high detection accuracy in the case of sufficient data. Meanwhile, the cybersecurity situation prediction by the CAM is in good agreement with the actual situation. The error between the average value of cybersecurity situation prediction and the actual value is only 0.82%, and the prediction accuracy is high. The RSA algorithm can control the average encryption time for very large text, about 12s. The decryption time is slightly longer but within a reasonable range. For different-size text, the encryption time is maintained within 0.5s. This work aims to provide important technical support for anomaly detection, overall security situation analysis, and data transmission security protection of CC systems to improve their cybersecurity.

Social Network Anomaly Detection for Optimized Decision Development

The paper presents the development of systems for improved source selection in a process that creates real-time categorization of events using only posts collected through various sensing applications that use social networks (such as Twitter or other mass dissemination networks) for reporting. The system recognizes critical instances in applications and simply views essential information from users (either by explicit user action or by default, as on Twitter) within the event and provides a textual description. As a result, social networks open up unprecedented possibilities for creating sensing applications by representing a set of tweets generated in a limited timeframe as a weighted network for influence concerning users. Obtaining data from a network of social site users substantiates the quality and dependability of data. It collects many users' dynamic behavior to construct and disseminate related information across the channel. The goal is to find a link between various data sources for event abnormalities.

Research on Security Anomaly Detection for Big Data Platforms Based on Quantum Optimization Clustering

Due to the explosive growth of data in the Internet, more and more applications are being deployed on Big Data platforms. However, as the scale of data continues to increase, the probability of anomalies in the platform is also increasing. However, traditional anomaly detection techniques cannot effectively handle the massive amount of historical data and can hardly meet the security requirements of big data platforms. In order to solve the above problems, this paper proposes a security anomaly detection method for big data platforms based on quantum optimization clustering. Firstly, a framework of big data platform anomaly detection system is designed based on distributed software architecture through Hadoop and Spark big data open source technology. The system achieves effective detection of network anomalies by collecting and analyzing big data platform server log data. Secondly, an offline anomaly detection algorithm based on quantum ant colony optimized affinity propagation clustering is designed for various anomalies mined from historical data. The bias parameters of the affinity propagation clustering are treated as individual ants to construct an ant colony, and the clustering accuracy is set as fitness. Finally, in order to improve the accuracy of the optimal path search of the ant colony, quantum bit encoding is applied to the ant colony position to refine the granularity of the individual ant colony position update. The experimental results show that the proposed method can effectively complete the anomaly clustering detection of massive data. With a reasonable threshold, the quantum ant colony–based affinity propagation clustering has high detection accuracy.

Network Intrusion Detection with 1D Convolutional Neural Networks

Computer network assets expose to various cyber threats in today’s digital era. Network Anomaly Detection Systems (NADS) play a vital role in protecting digital assets in the purview of network security. Intrusion detection systems data are imbalanced and high dimensioned, affecting models’ performance in classifying malicious traffic. This paper uses a denoising autoencoder (DAE) for feature selection to reduce data dimension. To balance the data, the authors use a combined approach of oversampling technique, adaptive synthetic (ADASYN) and a cluster-based under-sampling method using a clustering algorithm, Kmeans. Then, a one-dimensional convolutional neural network (1D-CNN) is used to perform classification. The performance of the proposed model is evaluated on UNSW-NB15 and NSL-KDD datasets. The experimental results show that the model produces a detection rate of 98.79% and 97.23% on UNSW-NB15 for binary classification and multiclass classification, respectively. In the evaluation using NSL-KDD, the model yields a detection rate of 98.52% for binary type classification and 98.16% for multiclass type classification.

Development of a model for detecting network traffic anomalies in distributed wireless ad hoc networks

Mobile ad hoc networks are one of the promising directions of the edge computing technology and they are used in various applications, in particular, in the development of intelligent transport systems. A feature of mobile ad hoc networks lies in the constantly changing dynamic network topology, as a result of which it is necessary to use reactive routing protocols when transmitting packets between nodes. Mobile ad hoc networks are vulnerable to cyber-attacks, so there is a need to develop measures to identify network threats and develop rules for responding to them based on machine learning models. The subject of this study is the development of a dynamic model for detecting network traffic anomalies in wireless distributed ad hoc networks. Within the framework of this study, methods and algorithms of data mining and machine learning were applied. The proposed approach to traffic monitoring in wireless distributed ad hoc networks consists in the implementation of two stages: initial traffic analysis to identify anomalous events and subsequent in-depth study of cybersecurity incidents to classify the type of attack. Within the framework of this approach, the corresponding models are constructed based on ensemble methods of machine learning. A comparative analysis and selection of the most efficient machine learning algorithms and their optimal hyperparameters has been carried out. In this paper, a formalization of the traffic anomaly detection model in distributed wireless ad hoc networks is carried out, the main quantitative metrics of network performance are identified, a generalized algorithm for detecting traffic anomalies in mobile ad hoc networks is presented, and an experimental study of the network segment simulation is carried out from the point of view of performance degradation during the implementation of various network attack scenarios. Network distributed denial of service attacks and cooperative blackhole attacks have the greatest negative impact on the performance of the mobile ad hoc network segment. In addition, the network simulation results were used to build a machine learning model to detect anomalies and classify types of attacks. The results of a comparative analysis of machine learning algorithms showed that the use of the LightGBM method is the most effective for detecting network traffic anomalies with an accuracy of 91 %, and for determining directly the type of attack being carried out with an accuracy of 90 %. The proposed approach for network anomalies detection through the use of trained traffic analysis models makes it possible to identify the considered types of attacks in due time. The future development direction of this research is the consideration of new scenarios for the emergence of network attacks and online additional training of the constructed identification models. The developed software tool for detecting network traffic anomalies in distributed mobile ad hoc networks can be used for any type of wireless ad hoc networks.

Peer-to-peer disaggregated telemetry for autonomic machine-learning-driven transceiver operation

Autonomic networking and monitoring will drive the evolution of next generation software defined networking (SDN) optical networks towards the zero touch networking paradigm. Optical telemetry services will play a key role to enable advanced network awareness at device and component granularity. Optical disaggregation is pushing the adoption of open models, enabling multi-vendor interoperability, including telemetry. Moreover, due to whitebox programmability and the adoption of open source micro services, it is becoming feasible to monitor data streams from optical devices related to quality of transmission key performance indicators. Finally, due to mature big data analytics platforms, including machine learning and artificial intelligence, the telemetry data lake is processed to effectively detect network anomalies. However, current centralized telemetry architectures are prone to scalability issues, suboptimal soft failure recovery due to operational mode limitations, and/or the inability of the SDN controller of tuning finer or proprietary transmission parameters. Conversely, a number of soft failures might be detected and recovered directly at the optical card transmitter, often in a hitless fashion, also relying on optimized vendor-proprietary configurations. The paper proposes what we believe to be a novel peer-to-peer telemetry (P2PT) service ready for next generation digital coherent optics cards, for local processing and soft failure recovery at the transceiver agent level. The P2PT architecture, workflow, and subscription extensions are conceived to enable direct and fast recovery at the transceiver level, resorting to optical signal retuning and adaptations. Experimental evaluations, including lightweight machine learning detection at the card agent, are provided in a multi-vendor disaggregated optical network testbed to assess different soft failure use cases and P2PT service scalability.

Detection and quantification of anomalies in communication networks based on LSTM-ARIMA combined model.

The anomaly detection for communication networks is significant for improve the quality of communication services and network reliability. However, traditional communication monitoring methods lack proactive monitoring and real-time alerts and the prediction effect of a single machine learning model on communication data containing multiple features is not ideal. To solve the problem, A prediction-then-detection anomaly detection method was proposed, and quantitative assessment of network anomalies was developed. Specifically, anomaly-free data was obtained by eliminating outliers, and the long short-term memory (LSTM) and autoregressive integral moving average (ARIMA) were combined via residual weighting to predict the future state of the key performance indicators (KPI) without outliers. Anomalies were identified using the error comparison between the prediction and actual values, and the network condition was quantified using the scoring method. It is observed that the proposed LSTM-ARIMA hybrid model has better prediction effect, which can well represent the performance of KPIs of the future state, and the prediction-then-detection anomaly detection method has excellent performance on both precision and recall.