Network Attack Detection Research Articles

Exploring a novel framework for DoS/DDoS attack detection and simulation in contemporary networks

Currently, the internet serves as the predominant means of communication and is utilized by a vast number of individuals worldwide. Simultaneously, the commercial aspect of the internet is contributing to a rise in susceptibility to cybercrimes, leading to a significant surge in the occurrence of distributed Denial of Service (DDoS) assaults over the last decade. DoS/DDoS assaults primarily target network resources such as network bandwidth, CPU time, memory consumption, web servers, and network switches. Network security is an essential and crucial problem in the modern interconnected society. Numerous studies have been undertaken by multiple researchers thus far in order to identify this attack. However, there is still room for improvement in past investigations. This paper presents a novel approach for detecting and simulating DoS/DDoS attacks in modern networking environments, introducing a new paradigm. It is done in a controlled environment. The primary focus of this work is to simulate an attacker's perspective of a DoS/DDoS attack by repeatedly sending huge SYN flood packets to a specific target or network server using the hping3 tool. On the server side, the proposed attacker detector script continuously monitors incoming network connections on the network server using the netstat command. It identifies potential DoS/DDoS attacks by analyzing the connection count and comparing connections count with an assumed threshold. This experiment results in 61% CPU usage and 7.1% memory consumption while a DDoS attack triggers on the target server. Additionally, the proposed script performs statistical analysis and displays warning messages on the console when suspicious activity is detected on the network server. Wireshark is also utilized in this work to detect anomalous network traffic patterns in order to identify distributed denial-ofservice (DDoS) attacks that are targeting a network server. Additionally, it offers the capability to block the IP address of the attacker if the configuration allows for it. This proposed approach efficiently identifies DDoS activity in real-time network traffic, further helping to improve network security.

Federated Learning for Decentralized DDoS Attack Detection in IoT Networks

Federated Learning for Decentralized DDoS Attack Detection in IoT Networks

Deep Ensemble Learning With Pruning for DDoS Attack Detection in IoT Networks

Deep Ensemble Learning With Pruning for DDoS Attack Detection in IoT Networks

Notice to Reader: Overview of DDoS Attack Detection in Software-Defined Networks

Notice to Reader: Overview of DDoS Attack Detection in Software-Defined Networks

Corrections to “Federated Learning for Decentralized DDoS Attack Detection in IoT Networks”

Corrections to “Federated Learning for Decentralized DDoS Attack Detection in IoT Networks”

A Genetic Algorithm- and t-Test-Based System for DDoS Attack Detection in IoT Networks

A Genetic Algorithm- and t-Test-Based System for DDoS Attack Detection in IoT Networks

Multi-Stage Network Attack Detection Algorithm Based on Gaussian Mixture Hidden Markov Model and Transfer Learning

Multi-Stage Network Attack Detection Algorithm Based on Gaussian Mixture Hidden Markov Model and Transfer Learning

Computer detection intelligent mining algorithm for software defined networks

The network security (NS) issues of software defined network (SDN) are becoming increasingly prominent. Traditional computer detection (for convenience, computer detection is abbreviated to CD) methods are usually based on rules and features, and cannot cope with new threats and unknown attacks. The purpose of this article is to analyze a CD intelligent mining algorithm (for convenience, intelligent mining algorithm is abbreviated to IMA) suitable for SDNs, and to optimize and improve the data acquisition difficulty, large data volume, dynamism, timeliness, and security issues of SDNs. On the basis of data preprocessing on the KDD (Data Mining and Knowledge Discovery) Cup 1999 dataset, this article constructed an architecture for CD IMAs. In the data intelligence layer, a combination of k-means algorithm and XGBoost (eXtreme Gradient Boosting) algorithm was used for computer network attack detection based on stream classification. Based on the preprocessed dataset, the k-means algorithm and its combination were trained and simulated. The effectiveness and performance optimization of the CD IMA analyzed in this article were verified by comparing it with traditional computer attack detection algorithms in terms of detection accuracy, CPU (Central Processing Unit) occupancy, detection time, and false detection rate. The experimental results showed that the accuracy of the CD IMAs analyzed in this article was over 80 %, and some even reached over 90 %. However, the accuracy of traditional computer attack detection algorithms has not reached 90 %. The detection time of traditional computer attack detection algorithms was all above 2 s, but some of the detection time of the algorithm in this article was within 2 s. The detection rate of the algorithms analyzed in this article was above 90 %, and the detection results were more accurate than traditional algorithms. This proved that the algorithm analyzed in this article can more effectively select optimized feature subsets, has good flow classification ability, and has high detection accuracy for different types of attacks. The CD IMA for SDNs has great potential and application prospects.

Detection of attacks in Internet of Things networks using machine learning methods

The increase in the volume of digital data generated, in particular, by smart devices of the Internet of Things, has made research related to the application of machine learning methods to detect anomalies in network traffic - the presence of network attacks - relevant. For this purpose, the article proposes a unified approach to detecting attacks at various levels of the Internet of Things network architecture, based on machine learning methods. The article investigates that at the level of a wireless sensor network, the detection of an attack is related to the detection of anomalous behavior of an Internet of Things device, in which the deviation of the behavior of an Internet of Things device from its profile can be considered as a compromise of the device. Building profiles of smart IoT devices is based on statistical characteristics, such as the intensity and duration of packet transmission, the proportion of relayed packets, etc. It has been studied that at the level of a local or global wired network of the Internet of Things, data aggregation takes place, the analysis of which is also performed by machine learning methods. Trained classifiers can become part of a network attack detection system that makes decisions about node compromise "on the fly". Models of network attack classifiers at the level of a wireless sensor network, and at the level of a local or global wired network are experimentally selected. The best results in terms of completeness and accuracy estimates are demonstrated by the random forest method for a wired local and (or) global network and by all considered methods for a wireless sensor network. Practical significance: the proposed classifier models can be used in the design of attack detection systems in Internet of Things networks.

An FPA-Optimized XGBoost Stacking for Multi-Class Imbalanced Network Attack Detection

An FPA-Optimized XGBoost Stacking for Multi-Class Imbalanced Network Attack Detection

Research on Substation Network Security Situational Awareness Strategy and Equipment Remote Operation and Maintenance

Abstract Substation network security is the key to maintaining the stable operation of power systems. In the face of growing threats of network attacks, traditional security protection measures have been brutal to meet the needs of modern power systems. Research on substation network security, situational awareness strategies, and remote operation and maintenance of equipment is essential to improve network defense capability and ensure the continuity and reliability of power supply. This study explores effective security situational awareness methods and remote operation and maintenance techniques to provide new solutions for substation network security. This paper builds an efficient network attack detection model by introducing linear discriminant analysis (LDA) and radial basis function (RBF) neural networks. The experiment uses the KDD Cup99 dataset, which is preprocessed to provide the model training and testing data. The LDA-RBF model in this paper outperforms the traditional RNF neural and BP neural networks regarding recognition rate. Specifically, the recognition rate reaches 90.2% for the Smurf attack and 100% for the Ipsweep attack. The proposed model of the study also performs well in terms of leakage and false alarm rates, with an overall recognition rate of 97.00%. This study proposes a network security situational awareness strategy and equipment remote operation and maintenance method that can effectively enhance substation networks’ security and operation and maintenance efficiency.

Fuzzy decision-making framework for explainable golden multi-machine learning models for real-time adversarial attack detection in Vehicular Ad-hoc Networks

This paper addresses various issues in the literature concerning adversarial attack detection in Vehicular Ad-hoc Networks (VANETs). These issues include the failure to consider both normal and adversarial attack perspectives simultaneously in Machine Learning (ML) model development, the lack of diversity preprocessing techniques for VANETs communication datasets, the inadequate selection guidelines for real-time adversarial attack detection models, and the limited emphasis on explainability in adversarial attack detection. In this study, we propose an original fuzzy decision-making framework that incorporates multiple fusion standpoints. Our framework aims to evaluate multi-ML models for real-time adversarial attack detection in VANETs, focusing on three stages. The first stage involves identifying and preprocessing Dedicated Short-Range Communication (DSRC) data using standard and fusion preprocessing approaches. Two communication scenarios, normal and jammed, are considered, resulting in two DSRC datasets. In the second stage, we develop multi-ML models based on the DSRC datasets using standard preprocessing and feature fusion preprocessing for dataset-1 and dataset-2, respectively. The third stage evaluates the multi-ML models using a fuzzy decision-making approach based on the Fuzzy Decision by Opinion Score Method (FDOSM) and an adversarial attack decision fusion matrix. The External Fusion Decision (EFD) settings of the FDOSM address individual ranking variance, provide a unique rank and select the best model. Experimental results demonstrate that the K-Nearest Neighbors Algorithm (kNN) model achieves the highest explain score of 0.2048 in dataset-1 using standard preprocessing, while the Random Forest (RF) model applied to dataset-2 using fusion preprocessing emerges as the most robust and golden model against adversarial attacks, with a score of 0.1819. This finding suggests that the fusion preprocessing approach using Principal Component Analysis (PCA) is more suitable for addressing normal and adversarial attack perspectives. Furthermore, our fuzzy framework undergoes evaluation in terms of systematic rank, sensitivity analysis, explainability analysis, and comparison analysis. Overall, this framework provides valuable insights for researchers and practitioners in VANETs, informing the execution, selection, and interpretation of multi-ML models to tackle adversarial attack detection problems effectively. The new fuzzy framework demonstrates that multi-ML models based on feature fusion preprocessing are more effective.

ResADM: A Transfer-Learning-Based Attack Detection Method for Cyber–Physical Systems

Deep learning has proven to be effective for enhancing the accuracy and efficiency of attack detection through training with large sample sizes. However, when applied to cyber–physical systems (CPSs), it still encounters challenges such as scarcity of attack samples, the difficulty of selecting features for high-dimensional data, and weak model-generalization ability. In response, this paper proposes ResADM, a transfer-learning-based attack detection method for CPSs. Firstly, an intentional sampling method was employed to construct different sets of samples for each class, effectively balancing the distribution of CPS-attack samples. Secondly, a feature-selection method based on importance was designed to extract the meaningful features from attack behaviors. Finally, a transfer-learning network structure based on ResNet was constructed, and the training parameters of the source model were optimized to form the network-attack detection method. The experimental results demonstrated that ResADM effectively balanced the data classes and extracted 32-dimensional attack-behavior features. After pre-training on the UNSW-NB15 dataset, ResADM achieved a detection accuracy of up to 99.95% for attack behavior on the CICIDS2017 dataset, showcasing its strong practicality and feasibility.

SPinDP: A High-Speed Distributed Processing Platform for Sampling and Filtering Data Streams

Recently, there has been an explosive generation of streaming data in various fields such as IoT and network attack detection, medical data monitoring, and financial trend analysis. These domains require precise and rapid analysis capabilities by minimizing noise from continuously generated raw data. In this paper, we propose SPinDP (Stream Purifier in Distributed Platform), an open source-based high-speed stream purification platform, to support real-time stream purification. SPinDP consists of four major components, Data Stream Processing Engine, Purification Library, Plan Manager, and Shared Storage, and operates based on open-source systems including Apache Storm and Apache Kafka. In these components, stream processing throughput and latency are critical performance metrics, and SPinDP significantly enhances distributed processing performance by utilizing the ultra-high-speed network RDMA (Remote Direct Memory Access). For the performance evaluation, we use a distributed cluster environment consisting of nine nodes, and we show that SPinDP’s stream processing throughput is more than 28 times higher than that of the existing Ethernet environment. SPinDP also significantly reduces the processing latency by more than 2473 times on average. These results indicate that the proposed SPinDP is an excellent integrated platform that can efficiently purify high-speed and large-scale streams through RDMA-based distributed processing.

Early Detection of Network Attacks Based on Weight-Insensitive Neural Networks

Early Detection of Network Attacks Based on Weight-Insensitive Neural Networks

A Priori Algorithm Based Network Security Situational Awareness Multi-Source Data Correlation Analysis Method

In the context of the information age, the Internet has developed rapidly, but the accompanying network security threats have also become an issue that cannot be ignored. In order to effectively respond to these threats and improve the data processing capabilities of network security situational awareness, the study focuses on the challenges of multi-source data processing and proposes a multi-source data association analysis method based on the A priori algorithm. This method aims to deeply explore the implicit relationships between data and provide stronger support for network attack detection. In addition, the study also designed a multi-level evaluation method based on coefficient of variation indicators, aiming to provide a more objective and comprehensive evaluation of the detection results. After a series of experimental verification, the proposed correlation analysis method has achieved significant results in detecting phishing attacks and DOS attacks, with detection rates of 90.3% and 93.8%, respectively. At the same time, the multi-level evaluation method has also been experimentally proven to provide more reasonable and accurate results for data evaluation. The methods and technologies proposed in the study can not only improve the multi-source data processing ability of network security situational awareness, but also provide valuable references for future network security research and practice.

Detection of Cyber Attacks and Network Attacks using Machine Learning Algorithms

Cyber-crime is spreading throughout the world, exploiting any type of vulnerability in the cloud computing platform. Ethical hackers are primarily concerned in identifying flaws and recommending mitigation measures. In the cyber security world, there is a pressing need for the development of effective techniques. The majority of IDS techniques used today are incapable of dealing with the dynamic and complex nature of cyber-attacks on computer networks. Because of the effectiveness of machine learning in cyber security issues, machine learning for cyber security has recently become a hot topic. In cyber security, machine learning approaches have been utilised to handle important concerns such as intrusion detection, malware classification and detection, spam detection, and phishing detection. Although ML cannot fully automate a cyber-security system, it can identify cyber security threats more efficiently than other software-oriented approaches, relieving security analysts of their burden. As a result, effective adaptive methods, such as machine learning techniques, can yield higher detection rates, lower false alarm rates, and cheaper computing and transmission costs. Our key goal is that the challenge of detecting attacks is fundamentally different from those of these other applications, making it substantially more difficult for the intrusion detection community to apply machine learning effectively. In this study, the CPS is modelled as a network of agents that move in unison with one another, with one agent acting as a leader and commanding the other agents. The proposed strategy in this study is to employ the structure of deep neural networks for the detection phase, which should tell the system of the attack's existence in the early stages of the attack. The use of robust control algorithms in the network to isolate the misbehaving agent in the leader-follower mechanism has been researched. Following the attack detection phase with a deep neural network, the control system uses the reputation algorithm to isolate the misbehaving agent in the presented control method. Experiment results show that deep learning algorithms can detect attacks more effectively than traditional methods, making cyber security simpler, more proactive, and less expensive and more expensive.

Deep Learning-Enabled Heterogeneous Transfer Learning for Improved Network Attack Detection in Internal Networks

Cybersecurity faces constant challenges from increasingly sophisticated network attacks. Recent research shows machine learning can improve attack detection by training models on large labeled datasets. However, obtaining sufficient labeled data is difficult for internal networks. We propose a deep transfer learning model to learn common knowledge from domains with different features and distributions. The model has two feature projection networks to transform heterogeneous features into a common space, and a classification network then predicts transformed features into labels. To align probability distributions for two domains, maximum mean discrepancy (MMD) is used to compute distribution distance alongside classification loss. Though the target domain only has a few labeled samples, unlabeled samples are adequate for computing MMD to align unconditional distributions. In addition, we apply a soft classification scheme on unlabeled data to compute MMD over classes to further align conditional distributions. Experiments between NSL-KDD, UNSW-NB15, and CICIDS2017 validate that the method substantially improves cross-domain network attack detection accuracy.

Flow and unified information-based DDoS attack detection system for multi-topology IoT networks

Internet of Things (IoT) networks are vulnerable to Distributed Denial of Service (DDoS) attacks, which can degrade their Quality of Service (QoS). In general, DDoS attacks are classified into high- and low-volume attacks. Existing statistical-based methods for DDoS attack detection in IoT networks are effective only for high-volume or low-volume attacks, but not for both. The majority of research in this domain relies on single-dimensional analysis and static thresholds. In response to these limitations, this paper introduces a Flow and Unified Information-based DDoS (FLUID) attack detection system, a lightweight statistical approach, for DDoS attack detection in IoT networks. The FLUID system incorporates multi-dimensional analysis by integrating unified information and flow behavior to effectively identify both high- and low-volume DDoS attacks. FLUID utilizes entropy and distance metrics, such as Kullback–Leibler (KL) divergence and greedy bin-packing, as unified information measures to distinguish legitimate traffic from malicious activity. Additionally, it examines flow behavior to gain insights into network traffic patterns. Notably, the FLUID system maintains its lightweight nature through a streamlined set of network features and optimized computational efficiency. Evaluations on real-world IoT client/server and Event-Driven Architecture (EDA) testbeds with the ToN-IoT, CICIDS 2017, CICIDS 2019, and DoS/DDoS-MQTT-IoT datasets show that the FLUID system can achieve over 90% detection accuracy for both high- and low-volume DDoS attacks.

A lightweight IoT intrusion detection model based on improved BERT-of-Theseus

The proliferation of Internet of Things (IoT) technology has resulted in an increase in security vulnerabilities associated with the interconnectivity of IoT devices. As a result, there is a need for intrusion detection mechanisms that can effectively detect attacks on IoT security vulnerabilities. However, due to the resource constraints of IoT deployment devices, intrusion detection schemes must be customized to meet the specific demands of the IoT environment. In this study, we propose a knowledge-distillation-based IoT intrusion detection model named BT-TPF, which is capable of detecting network attacks encountered by IoT devices in an IoT environment with limited computing resources. The proposed BT-TPF model leverages a Siamese network for feature dimensionality reduction of complex high-dimensional network traffic data. Additionally, it employs a large-scale Vision Transformer as a teacher model to guide a small-scale Poolformer model during training, before deploying the trained Poolformer model as a classifier to detect network intrusion traffic. Through knowledge distillation, the final small model obtained in this paper only requires a minimum of 788 parameters, reducing the number of parameters by approximately 90% compared to the large model before knowledge distillation, while maintaining high detection accuracy. Experimental results show that the BT-TPF model achieves over 99% accuracy on both the CIC-IDS2017 and TON_IoT datasets. Furthermore, it exhibits significant advantages compared to traditional Deep Learning methods and recent state-of-the-art models, as evidenced by various evaluation metrics.