Network Attack Detection Research Articles

Image-Based Approach to Intrusion Detection in Cyber-Physical Objects

Recently, approaches based on the transformation of tabular data into images have gained a lot of scientific attention. This is explained by the fact that convolutional neural networks (CNNs) have shown good results in computer vision and other image-based classification tasks. Transformation of features without spatial relations to images allows the application of deep neural networks to a wide range of analysis tasks. This paper analyzes existing approaches to feature transformation based on the conversion of the features of network traffic into images and discusses their advantages and disadvantages. The authors also propose an approach to the transformation of raw network packets into images and analyze its efficiency in the task of network attack detection in a cyber-physical object, including its robustness to novel and unseen attacks.

Secure Intelligent Fuzzy Blockchain Framework: Effective Threat Detection in IoT Networks

Integrating blockchain into the Internet of Things (IoT) for security is a new development in computational communication systems. While security threats are changing their strategies and constructing new threats on blockchain-based IoT systems. Also, in combining blockchain with IoT networks, malicious transactions and active attacks deliver more vulnerabilities, privacy issues, and security threats. The concept of blockchain-based IoT attacks is a hot topic in both IoT and blockchain disciplines. Network attacks are a type of security and privacy threat and cover the exact scope of threats related to the combination of IoT and blockchain. Even though blockchain has potential security benefits, new cyberattacks have emerged that make blockchain alone insufficient to deal with threats and attacks in IoT networks since vagueness and ambiguity issues are unavoidable in IoT data. The heterogeneous nature of IoT sources has made uncertainty a critical issue in IoT networks. Deep Learning (DL) models have difficulty dealing with uncertainty issues and cannot manage them efficiently as an essential tool in security techniques. Thus, we need better security, privacy, and practical approaches, such as efficient threat detection against network attacks in blockchain-based IoT environments. Also helpful to consider fuzzy logic to tackle deterministic issues when DL models face uncertainty. This paper designs and implements a secure, intelligent fuzzy blockchain framework. This framework utilizes a novel fuzzy DL model, optimized adaptive neuro-fuzzy inference system (ANFIS)-based attack detection, fuzzy matching (FM), and fuzzy control system (FCS) for detection of network attacks. The proposed fuzzy DL applies the fuzzy Choquet integral to have a powerful nonlinear aggregation function in the detection. We use metaheuristic algorithms to optimize the attack detection error function in ANFIS. We also validate transactions via FM to tackle fraud detection and efficiency in the blockchain layer. This framework is the first secure, intelligent fuzzy blockchain framework that identifies and detects security threats while considering uncertainty issues in IoT networks and having more flexibility in decision-making and accepting transactions in the blockchain layer. Evaluation results verify the efficiency of the blockchain layer in throughput and latency metrics and the intelligent fuzzy layer in performance metrics (Accuracy, Precision, Recall, and F1-Score) in threat detection on both blockchain and IoT network sides. Additionally, FCS demonstrates that we obtain an effective system (stable model) for threat detection in blockchain-based IoT networks.

DETECTION OF ATTACKS OF THE U2R CATEGORY BY MEANS OF THE SOM ON DATABASE NSL-KDD

Creating an effective system for detecting network attacks requires the use of qualitatively new approaches to information processing, which should be based on adaptive algorithms capable of self-learning. The mathematical apparatus of the Kohonen self-organizing map (SOM) was used as a research method. Python language with a wide range of modern standard tools was used as a software implementation of the Kohonen SOM addition, this section compiles the Python software model «SOM_U2R» using a Kohonen SOM. Created «SOM_U2R» software model on database NSL-KDD an error research was performed for different number of epochs with different map sizes. On the «SOM_U2R» model the re-search of parameters of quality of detection of attacks is carried out. It is determined that on the «SOM_U2R» created software model the error of the second kind of detection of network classes of attacks Buffer_overflow and Rootkit is 6 %, and for the class Loadmodule reached 16 %. In addition, a survey of the F-measure was conducted for a different number of epochs of learning the Kohonen SOM. It is determined that for all network attack classes (except Buffer_overflow) the F-measure increases, reaching its maximum value at 50 epochs.

DeepGuard: Backdoor Attack Detection and Identification Schemes in Privacy-Preserving Deep Neural Networks

Deep neural networks (DNNs) have profoundly changed our lifeways in recent years. The cost of training a complicated DNN model is always overwhelming for most users with limited computation and storage resources. Consequently, an increasing number of people are considering to resort to a cloud for an outsourced DNN model training. However, the DNN models training process outsourced to the cloud faces privacy and security issues due to the semi-honest and malicious cloud environments. To preserve the privacy of the data and the parameters in DNN models during the outsourced training and to detect whether the models are injected with backdoors, this paper presents DeepGuard, a framework of privacy-preserving backdoor detection and identification in an outsourced cloud environment for multi-participant computation. In particular, we design a privacy-preserving reverse engineering algorithm for recovering the triggers and detecting the backdoor attacks among three cooperative but non-collusion servers. Moreover, we propose a backdoor identification algorithm adapting to single-label and multi-label attack detection. Finally, extensive experiments on the prevailing datasets such as MNIST, SVHN, and GTSRB confirm the effectiveness and efficiency of backdoor detection and identification in a privacy-preserving DNN model.

Cyber Threat Intelligence Sharing Scheme Based on Federated Learning for Network Intrusion Detection

The uses of machine learning (ML) technologies in the detection of network attacks have been proven to be effective when designed and evaluated using data samples originating from the same organisational network. However, it has been very challenging to design an ML-based detection system using heterogeneous network data samples originating from different sources and organisations. This is mainly due to privacy concerns and the lack of a universal format of datasets. In this paper, we propose a collaborative cyber threat intelligence sharing scheme to allow multiple organisations to join forces in the design, training, and evaluation of a robust ML-based network intrusion detection system. The threat intelligence sharing scheme utilises two critical aspects for its application; the availability of network data traffic in a common format to allow for the extraction of meaningful patterns across data sources and the adoption of a federated learning mechanism to avoid the necessity of sharing sensitive users’ information between organisations. As a result, each organisation benefits from the intelligence of other organisations while maintaining the privacy of its data internally. In this paper, the framework has been designed and evaluated using two key datasets in a NetFlow format known as NF-UNSW-NB15-v2 and NF-BoT-IoT-v2. In addition, two other common scenarios are considered in the evaluation process; a centralised training method where local data samples are directly shared with other organisations and a localised training method where no threat intelligence is shared. The results demonstrate the efficiency and effectiveness of the proposed framework by designing a universal ML model effectively classifying various benign and intrusive traffic types originating from multiple organisations without the need for inter-organisational data exchange.

Cyber-Attack Detection in Autonomous Vehicle Networks by Energy Aware Optimal Data Transmission with Game Fuzzy Q-Learning based Heuristic Routing Protocol

The automotive sector has seen a dramatic transition due to rapid technological advancement. Network connection has improved, enabling the transfer of the cars' technologies from being fully machine- to software-controlled. Controller area network (CAN) bus protocol manages network for autonomous vehicles. However, due to the intricacy of data and traffic patterns that facilitate unauthorised access to a can bus and many sorts of assaults, the autonomous vehicle network still has security flaws as well as vulnerabilities. This research proposes novel technique in cyber attack detection in autonomous vehicle networks enhanced data transmission based optimization and routing technique. Here the autonomous vehicle network optimal data transmission has been carried out using energy aware lagrangian multipliers based optimal data transmission. The cyber attack detection has been carried out using fuzzy q-learning based heuristic routing protocol. The experimental results has been carried out based on optimal data transmission and attack detection in terms of throughput of 95%, PDR of 94%, End-end delay of 46%, energy efficiency of 96%, network lifetime of 95%, attack detection rate of 88%.

Attack Detection and Mitigation in MEC-Enabled 5G Networks for AIoT

In recent years, AIoT (Artificial Intelligence of Things) applications have received lots of attention since it exploits widely deployed IoT devices to collect data and perform an action while leveraging AI to obtain knowledge and insights. When deploying AIoT in 5G networks, Multi-access Edge Computing (MEC) is appropriate for enabling local management of IoT devices and computation of machine learning (ML) algorithms. Facing the multitude of threats in the ML data layer, IoT service layer, and 5G communications layer, MEC should enable corresponding detection and mitigation schemes to protect AIoT applications. In this article, we examine the existing security solutions located in each layer and discuss the interrelated challenges. For example, a network-traffic-based IDS solution in MEC might capture IoT malware but fail to identify a growing file-less attack. We suggest that firmware emulation in IoT endpoint should be included to provide system-level behaviors to network-based detectors in MEC so that file-less attacks can be distinguished. The potential of a backdoor attack aiming to poison data or corrupt ML models cannot be ignored in AIoT applications, and a corresponding detector should be implemented in MEC. Due to the rise of low-cost Software-Defined Radio (SDR), malicious attacks using rogue base stations (BSs) have become more popular. It implies that security protection at MEC in the communications layer is necessary. This article, therefore, proposes a novel platform, M3Inspector, where inspectors located in mobiles and AIoT machines collect information from surrounding BSs and provide them to MEC. MEC determines the rogue BS and makes a notification to users subscribing to the local service. A realistic 5G experimental platform with rogue BSs is developed. The results demonstrate that attack detection and mitigation can be implemented in the MEC paradigm to significantly improve the security protection of AIoT from the perspectives of rogue BS attacks and file-less attacks.

Detecting network attacks Model based on a long short-term memory LSTM

Nowadays, network-connected devices such as mobile phones and IoT devices are increasing, the types and numbers of these devices are increasing, the impact of successful attacks is increasing and the fear is growing due to the security effects when using them. In addition, a broader attack surface is available to identify and respond to these network attacks, different systems are used to prevent and stop Some of these systems consist of two layers, the first layer which provides Security and Intrusion Prevention is the firewall, while the second layer is the network intrusion detection system or attack detection system, if only the first layer represented by the firewall is used we cannot prevent attack, that's why attack detection or malware detection systems are used along with a firewall.

Deep learning for detecting logic-flaw-exploiting network attacks: An end-to-end approach

Network attacks have become a major security concern for organizations worldwide. A category of network attacks that exploit the logic (security) flaws of a few widely-deployed authentication protocols has been commonly observed in recent years. Such logic-flaw-exploiting network attacks often do not have distinguishing signatures, and can thus easily evade the typical signature-based network intrusion detection systems. Recently, researchers have applied neural networks to detect network attacks with network logs. However, public network data sets have major drawbacks such as limited data sample variations and unbalanced data with respect to malicious and benign samples. In this paper, we present a new end-to-end approach based on protocol fuzzing to automatically generate high-quality network data, on which deep learning models can be trained for network attack detection. Our findings show that protocol fuzzing can generate data samples that cover real-world data, and deep learning models trained with fuzzed data can successfully detect the logic-flaw-exploiting network attacks.

Analysis and Detection against Network Attacks in the Overlapping Phenomenon of Behavior Attribute

The proliferation of network attacks poses a significant threat. Researchers propose datasets for network attacks to support research in related fields. Then, many attack detection methods based on these datasets are proposed. These detection methods, whether two-classification or multi-classification, belong to single-label learning, i.e., only one label is given to each sample. However, we discover that there is a noteworthy phenomenon of behavior attribute overlap between attacks, The presentation of this phenomenon in a dataset is that there are multiple samples with the same features but different labels. In this paper, we verify the phenomenon in well-known datasets(UNSW-NB15, CCCS-CIC-AndMal-2020) and re-label these data. In addition, detecting network attacks in a multi-label manner can obtain more information, providing support for tracing the attack source and building IDS. Therefore, we propose a multi-label detection model based on deep learning, MLD-Model, in which Wasserstein-Generative-Adversarial-Network-with-Gradient-Penalty (WGAN-GP) with improved loss performs data enhancement to alleviate the class imbalance problem, and Auto-Encoder (AE) performs classifier parameter pre-training. Experimental results demonstrate that MLD-Model can achieve excellent classification performance. It can achieve F1=80.06% in UNSW-NB15 and F1=83.63% in CCCS-CIC-AndMal-2020. Especially, MLD-Model is 5.99%∼7.97% higher in F1 compared with the related single-label methods.

Detection of cyber attacks in network using machine learning techniques


 
 
 The development of effective techniques has been an urgent demand in the field of the cyber security community. Machine learning for cyber security has become an issue of great importance recently due to the effectiveness of machine learning in cyber security issues. This is typically accomplished by automatically collecting information from a variety of systems and network sources, and then analysing the information for possible security problems. Our main goal is that the task of finding attacks is fundamentally different from these other applications, making it significantly harder for the intrusion detection community to employ machine learning effectively.
 
 

Network intrusion detection system for Internet of Things based on enhanced flower pollination algorithm and ensemble classifier

SummaryIn the Internet of Things environment, the intrusion detection involves identification of distributed denial of service attacks in the network traffic which is aimed at improving network security. Recently, several methods have been developed for network anomaly detection which is generally based on the conventional machine learning techniques. The existing methods completely rely on manual traffic features which increases the system complexity and results in a lower detection rate on large traffic datasets. To overcome these issues, a new intrusion detection system is proposed based on the enhanced flower pollination algorithm (EFPA) and ensemble classification technique. First, the optimal set of features is selected from the UNSW‐NB15 and NSL‐KDD datasets by using EFPA. In the EFPA, a scaling factor is used in the conventional FPA for optimal feature selection and better convergence, and the selected features are fed to the ensemble classifier for network attack detection. The ensemble classifier aims to learn a set of classifiers such as random forest, decision tree (ID3), and support vector machine classifiers and then votes the best results. In the resulting section, the proposed ensemble‐based EFPA model attained 99.32% and 99.67% of accuracy on UNSW‐NB15 and NSL‐KDD datasets, respectively, and these obtained results are more superior compared to the traditional network intrusion detection models. The proposed and the existing models are validated on the anaconda‐navigator and Python 3.6 software environment.

A Survey Of Packet Analysis For Network Forensics

Network forensics is a branch of the network security paradigm (a collection of rules and configurations for protecting the integrity, confidentiality, and accessibility of computer networks and data using both software and hardware technologies) that focuses on network attack prevention and detection. It solves the present model's lack of specific investigation tools for probing harmful activities in networks. It also monitors the network for attacks and analyzes the attackers' characteristics. Packet analysis is the most common technique in network forensics, and it may replay the whole network traffic for a given period if the packet characteristics gathered are sufficiently detailed. The data collected can be utilized to track down traces of illegal internet activity, data breaches, unauthorized website access, malware infection, and so on across the network. This article provides a thorough packet analysis approach with extensive network traffic categorization and pattern detection capabilities, as well as a broad examination of the use of packet analysis in network forensics. Because not all network data can be used in court, the categories of digital evidence that may be acceptable are described in depth. The features of both hardware appliances and packet analyzer software are examined in light of their potential applications in network forensics. Keywords: Network Forensics, Computer & Network Security, Digital Forensics, Local and Wide Area Network, Internet BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free Citation: Tsatsu, K. Sabblah (2022): Analysis of Attack Intention Recognition Book Chapter Series on Research Nexus in IT, Law, Cyber Security & Forensics. Pp 263-266 www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P42

Research on Network Attack Traffic Detection HybridAlgorithm Based on UMAP-RF

Network attack traffic detection plays a crucial role in protecting network operations and services. To accurately detect malicious traffic on the internet, this paper designs a hybrid algorithm UMAP-RF for both binary and multiclassification network attack detection tasks. First, the network traffic data are dimensioned down with UMAP algorithm. The random forest algorithm is improved based on parameter optimization, and the improved random forest algorithm is used to classify the network traffic data, distinguishing normal data from abnormal data and classifying nine different types of network attacks from the abnormal data. Experimental results on the UNSW-NB15 dataset, which are significant improvements compared to traditional machine-learning methods, show that the UMAP-RF hybrid model can perform network attack traffic detection effectively, with accuracy and recall rates of 92.6% and 91%, respectively.

RSS based multistage statistical method for attack detection and localization in IoT networks

Accurate and reliable positioning of nodes is a must for location-based services (LBS) in the Internet of things (IoT) networks. The LBS are ubiquitous and an easy target for non-cryptographic attacks that traditional security methods cannot address. In this work, we detect the Received Signal Strength (RSS) based attacks that affect the localization of smart devices in the IoT networks and report the attack tolerance of popular IoT protocols. A two-tier ratio metric method and Residue Under Curve (RUC) metric method is utilized to detect the malicious node in the IoT protocols. We propose to use a novel Geometric, and Arithmetic Mean (GM–AM) ratio as a feature to detect the RSS attacks where GM follows strictly Schur-Concavity property and AM follows non-strict concavity property. We evaluate the performance of the proposed method on real-world IoT testbeds with Wireless Fidelity (Wi-Fi), Zigbee, Bluetooth Low Energy (BLE), and Long-Range Wide-Area Network (LoRaWAN) protocols using the RSS values of these opportunistic signals. Also, the effect of RSS attacks on the localization for different protocols is investigated, and we report the method that provides the least localization error under these attacks.

Signal Processing-based Model for Primary User Emulation Attacks Detection in Cognitive Radio Networks

Cognitive Radio Networks (CRNs) have been conceived to improve the efficiency of accessing the spectrum. However, these networks are prone to various kinds of attacks and failures that can compromise the security and performance of their users. One of the notable malicious attacks in cognitive radio networks is the Primary User Emulation (PUE) attack, which results in underutilization and unavailability of the spectrum and low operational efficiency of the network. This study developed an improved technique for detecting PUE attacks in cognitive radio networks and further addressed the characteristics of sparsely populated cognitive radio networks and the mobility of the primary users. A hybrid signal processing-based model was developed using the free space path loss and additive Gaussian noise models. The free space path loss model was used to detect the position of the transmitter, while the additive Gaussian noise model was used to analyze the signal transmitted, i.e., energy detection in the spectrum at the detected location. The proposed model was benchmarked with an existing model using the number of secondary users and the velocity of the transmitter as performance parameters. The simulation results show that the proposed model has improved accuracy in detecting primary user emulation attacks. It was concluded that the proposed hybrid model with respect to the number of secondary users and the velocity of the transmitter can be used for primary user emulation attack detection in cognitive radio networks.

Unknown network attack detection method based on reinforcement zero-shot learning

With the increasing growth of zero-day attacks, traditional machine learning-based network intrusion detection systems (NIDS) are difficult to cope with a large amount of unknown network attacks without labeled data. To this end, this paper proposes a new unknown network attack detection method, which combines zero-shot learning algorithm with reinforcement learning algorithm. First, the feature vector in traffic data and the semantic vector in threat intelligence are encoded in the hidden space by variational autoencoder, so that the two modalities are matched in the hidden space, and then the hidden features of known class and unknown class are used to input into the training classifier to get the predicted of the labeling results, and then use asynchronous advantage actor-critic based algorithm to learn and correct the attack results that are misclassified by the variational autoencoder to improve the accuracy of detection. Experiments prove that the proposed method in this paper achieves more than 95% accuracy on four unknown network attack classes that are difficult to identify, namely MAILBOMB, U2R, POD, and SNAPATTACK, which illustrates the effectiveness and feasibility of the method.

Организация мониторинга сетевых вторжений на основе свободно распространяемого программного обеспечения

This paper presents the results of preparing a virtual bench for modeling and detecting network attacks using a freely distributed intrusion detection system (IDS). The relevance of the work is related to the growing demand for IDS as sources of information security events for security information and event management (SIEM) systems. A comparative analysis of the most popular freely distributed open-source network IDSs was carried out and the choice of the Zeek system for its use in the project was substantiated. The work uses Zeek network logs, which contain important and structured information about the analyzed network traffic. The laboratory bench was built on the basis of a Linux virtual machine and a Mininet network simulator. A graphical representation of the developed virtual stand is proposed. An experimental study of the effectiveness of an intrusion detection system is demonstrated by simulating a network denial of service attack and further analyzing the received network traffic using IDS tools.

An Efficient Method for Detecting Supernodes Using Reversible Summary Data Structures in the Distributed Monitoring Systems

Supernode detection has many applications in detecting network attacks, assisting resource allocation, etc. As 5G/IoT networks constantly grow, big network traffic brings a great challenge to collect massive traffic data in compact and real-time way. Previous works focus on detecting supernodes in a measurement point, while only a few works consider it in the distributed monitoring system. Moreover, they are not able to measure two types of node cardinalities simultaneously and reconstruct labels of supernodes efficiently due to large calculation and memory cost. To address these problems, we propose a novel reversible and distributed traffic summarization called RDS to simultaneously measure source and destination cardinalities for detecting supernodes in the distributed monitoring system. The basic idea of our approach is that each monitor generates a summary data structure using the coming packets and sends the summary data structure to the controller; then, the controller aggregates the received summary data structures, estimates node cardinalities, and reconstructs labels of supernodes according to the aggregated summary data structure. The experimental results based on real network traffic demonstrate that the proposed approach can detect up to 96% supernodes with a low memory requirement in comparison with state-of-the-art approaches.

Network Attack Detection Method of the Cyber-Physical Power System Based on Ensemble Learning

With the rapid development of power grid informatization, the power system has evolved into a multi-dimensional heterogeneous complex system with high cyber-physical integration, denoting the Cyber-Physical Power System (CPPS). Network attack, in addition to faults, becomes an important factor restricting the stable operation of the power system. Under the influence of network attacks, to improve the operational stability of CPPSs, this paper proposes a CPPS network attack detection method based on ensemble learning. First, to solve the shortcomings of a low detection precision caused by insufficient network attack samples, a power data balancing processing method was proposed. Then, the LightGBM ensemble was constructed to detect network attack events and lock the fault points caused by the attack. At the same time, in the process of gradient boost, the focal loss was introduced to optimize the attention weight of the classifier to the misclassified samples, thus improving the network attack detection precision. Finally, we propose an effective evaluation method of the network attack detection model based on cyber-physical comprehensive consideration. In addition, the cyber-physical power system stability under the action of the network attack detection model is quantitatively analyzed. The experimental results show that the F1 score of network attack detection increases by 16.73%, and the precision increases by 15.67%.