Network Security Detection Research Articles

SecKG2vec: A Novel Security Knowledge Graph Relational Reasoning Method based on Semantic and Structural Fusion Embedding

Knowledge graph technology is widely used in network security design, analysis, and detection. By collecting, organizing, and mining various security knowledge, it provides scientific support for security decisions. Some public Security Knowledge Repositories (SKRs) are frequently used to construct security knowledge graphs. The quality of SKRs affects the efficiency and effectiveness of security analysis. However, the current situation is that the identification of relational information among security knowledge elements is not sufficient and timely, and a large number of key relational information is missing. In view of this, we propose a security knowledge graph relational reasoning method, based on the fusion embedding of semantic correlation and structure correlation, named SecKG2vec. By SecKG2vec, the embedded vector simultaneously presents both semantic and structural characteristics, and it can exhibit better relational reasoning performance. In qualitative evaluation and quantitative experiments with baseline methods, SecKG2vec has better performance in relationship reasoning task and entity reasoning task, and potential capability of 0-shot scenario prediction.

Securing DNS over HTTPS traffic: a real-time analysis tool

DNS over HTTPS (DoH) is a developing protocol that uses encryption to secure domain name system (DNS) queries within hypertext transfer protocol secure (HTTPS) connections, thereby improving privacy and security while browsing the web. This study involved the development of a live tool that captures and analyzes DoH traffic in order to classify it as either benign or malicious. We employed machine learning (ML) algorithms such as K-Nearest Neighbors (K-NN), random forest (RF), decision tree (DT), deep neural network (DNN), and support vector machine (SVM) to categorize the data. All of the algorithms, namely KNN, RF, and DT, achieved exceptional performance, with F1 scores of 1.0 or above for both precision and recall. The SVM and DNN both achieved exceptionally high scores, with only slight differences in accuracy. This tool employs a voting mechanism to arrive at a definitive classification decision. By integrating with the Mallory tool, it becomes possible to locally resolve DNS, which in turn allows for more accurate simulation of DoH queries. The evaluation results clearly indicate outstanding performance, confirming the tool's effectiveness in analyzing DoH traffic for network security and threat detection purposes.

Harnessing AI for Network Security and DDoS Attack Detection

This paper investigates the utilization of artificial intelligence (AI) techniques for network security and detection of Distributed Denial of Service (DDoS) attacks. It explores the role of AI algorithms, machine learning models, and anomaly detection techniques in enhancing network security, mitigating cyber threats, and improving incident response in the face of DDoS attacks. The paper discusses real-world implementations and case studies showcasing the effectiveness of AI in network security and DDoS attack detection.

A Robust Hybrid Approach for Malware Detection: Leveraging CNN and LSTM for Encrypted Traffic Analysis

The rapid growth in Internet usage and advancements in network technologies have escalated the risk of network attacks. As the adoption of encryption protocols increases, so does the difficulty in identifying malware within encrypted traffic. Malware represents a significant danger in cyberspace, as it compromises personal data and harms computer systems. Network attacks involve unauthorized access to networks, often aiming to disrupt or damage them, with potentially severe consequences. To counter these threats, researchers, developers, and security experts are constantly innovating new malware detection techniques. Recently, deep learning has gained traction in network security and intrusion detection systems (IDSs), with models such as Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) showing promise in detecting malicious traffic. Despite these advancements, extracting relevant features from diverse malware types remains a challenge. Current solutions demand substantial computational resources and are often inefficient for large datasets. Additionally, existing image-based feature extraction methods consume significant resources. This study tackles these issues by employing a 1D CNN alongside LSTM for the detection and classification of encrypted malicious traffic. Using the Malware Analysis benchmark dataset, which consists of 42,797 malware and 1,079 goodware API call sequences, the proposed model achieved an accuracy of 99.2%, surpassing other state-of-the-art models

Deep Learning-Based Network Security Situation Prediction for Sensor-Enabled Networks

Aims and background: Network security detection has become increasingly complex due to the proliferation of Internet nodes and the ever-changing nature of network architecture. To address this, a multi-layer feedforward neural-network has been employed to construct a model for security threat detection, which has enhanced network security protection. Objectives and Methods: Improving prediction accuracy and real-time performance, this research suggests an optimal strategy based on Clockwork Recurrent-Neural-Networks(CW-RNNs) to handle nonlinearity and temporal dynamics in network security circumstances. We get the model to pick up on both the short-term and long-term temporal aspects of network-security situations by using the clock-cycle RNN. To further improve the network security scenario prediction model, we tune the network hyperparameters using the Grey-Wolf-Optimization(GWO) technique. By incorporating a clock-cycle for hidden units, the model can improve its pattern recognition capabilities by learning short-term knowledge from high-frequency update modules and preserving long-term memory from low-frequency update modules. Results: The optimized clock-cycle RNN achieves better prediction accuracy than competing network models when it comes to extracting nonlinear and temporal characteristics of network security scenarios, according to the experimental data. Conclusions: In addition, our method is perfect for tracking massive amounts of data transmitted by sensor networks because of its minimal time complexity and outstanding real-time performance.

A comprehensive review of machine learning's role in enhancing network security and threat detection

As network security threats continue to evolve in complexity and sophistication, there is a growing need for advanced solutions to enhance network security and threat detection capabilities. Machine learning (ML) has emerged as a powerful tool in this context, offering the potential to detect and mitigate threats in real-time by analyzing vast amounts of network data. This comprehensive review explores the role of machine learning in enhancing network security and threat detection. The review begins by providing an overview of the current landscape of network security threats and the challenges faced by traditional security approaches. It then delves into the fundamental principles of machine learning and its application to network security. Various machine learning techniques, including supervised learning, unsupervised learning, and deep learning, are discussed in detail, highlighting their strengths and limitations in the context of threat detection. Next, the review examines the application of machine learning in different aspects of network security, including intrusion detection, malware detection, anomaly detection, and behavioral analysis. Case studies and real-world examples are presented to illustrate the effectiveness of machine learning-based approaches in identifying and mitigating security threats. Furthermore, the review discusses the challenges and considerations associated with deploying machine learning in network security environments, such as data privacy, model interpretability, and adversarial attacks. Strategies for addressing these challenges and improving the robustness of machine learning models are explored. Finally, the review outlines future research directions and opportunities for leveraging machine learning to enhance network security. Areas such as federated learning, adversarial machine learning, and explainable AI are identified as promising avenues for further investigation. In summary, this comprehensive review provides insights into the potential of machine learning in enhancing network security and threat detection. By leveraging the capabilities of machine learning algorithms and techniques, organizations can strengthen their defenses against cyber threats and better protect their networks and sensitive data.

RETRACTED ARTICLE: Network security threat detection technology based on EPSO-BP algorithm

With the development of Internet technology, the large number of network nodes and dynamic structure makes network security detection more complex, which requires the use of a multi-layer feedforward neural network to build a security threat detection model to improve network security protection. Therefore, the entropy model is adopted to optimize the particle swarm algorithm to decode particles, and then the single-peak and multi-peak functions are used to test and compare the particle entropy and fitness values to optimize the weights and thresholds in the multi-layer feedforward neural network. Finally, Suspicious Network Event Recognition Dataset discovered by data mining is sampled and applied to the entropy model particle swarm optimization for training. The test results show that there are four functions for the optimal mean and standard deviation in this algorithm, with values of 5.712e − 02, 4.805e − 02, 4.914e − 01, 1.066e − 01, 1.577e − 01, 1.343e − 01, and 2.089e + 01, 5.926, respectively. Overall, the algorithm proposed in the study is the best. Finally, the detection rate of attack types is calculated. The multi-layer feedforward neural network algorithm is 83.80%, the particle swarm optimization neural network algorithm is 91.00%, and the entropy model particle swarm optimization algorithm is 95.00%. The experiment shows that the research model has high accuracy in detecting network security threats, which can provide technical support and theoretical assistance for network security protection.

Design and implementation of computer network security detection and control system

With the widespread application of computer network technology, computer network security defense capability has become a focus of attention in various industries. The extensive use of computer information systems in various sectors has significantly improved work efficiency but has also introduced security risks and management issues. The deployment of network security detection and control systems allows for effective security monitoring and management of computer operations and real-time network information. This paper presents a computer network security detection and control system based on human-computer interaction, which enables users to handle daily key business processes. The work principles and overall architecture of the network security detection and control system are analyzed and demonstrated. It offers functions such as filtering options, address rules, network security detection, network unreachability, overall traffic analysis, subnet definition, fault diagnosis, and security analysis. Testing and analysis indicate that the systems design achieves the intended goals. In the application of network security features, it can effectively combine various forces to enhance the quality and efficiency of network security, making it widely applicable in various industry units.

Supervision and early warning of abnormal data in Internet of Things based on unsupervised attention learning

With the continuous development of artificial intelligence and big data, more and more communication protocols have appeared in the network connection. Because the network protocol content specification should not need to obtain the content of the common protocol by any means, it faces different attacks, which increases the complexity of network security detection to an unlimited extent. The absolute security analysis of the content of the relevant data protocol is not too limited. Based on the content of the unknown binary number protocol in the Internet of Things, this paper does the reverse research. To address the inefficiency, learning is focused on the inverse aspect of the content processing logic of the protocol for unsupervised execution attention. This paper proposes a method based on the name of the Dirichlet process mixture model normal field and the unknown protocol of the Internet of Things. It also establishes the behavioral criteria that process the logical inference least squares method to infer the content of the target protocol. Based on the original external characteristics of abnormal data in the Internet of Things, the neural network model of attention mechanism and the model checking of variational self-encoder are chosen. An innovative multi-dimensional spatial neural network model with a centralized control mechanism is taken to extract the spatial relevant information from the original external features, which are regarded as the intermediate external features. The intermediate extrinsic features are input to a variational self-encoder for computation and reconstruction. The experimental results verify that the time required by the proposed model is 45% less than that of the traditional structure. The flow processing improves by 36.7% compared with the optimization of the parameter control function. The specific method only relies on the original external characteristics of the Internet of Things traffic and can achieve better data anomaly detection and classification under the condition of not significantly improving the detection time. The abnormal data detection scheme of the Internet of Things designed in this paper not only fills the detection gap of the current mainstream Internet of Things system which lacks an autonomous supervision mechanism, but also effectively blocks external network intrusion and further improves the management authority verification system. It plays an indispensable role in the long-term stable operation of the Internet of Things platform.

The Role of Mining and Detection of Big Data Processing Techniques in Cybersecurity

Abstract The need for advanced detection methods has become more critical in light of the increasing prevalence of network security incidents. This study proposes a novel approach to network security detection using a fuzzy data mining algorithm, addressing the rising challenges in big data processing and network security. The paper outlines the evolution of big data analytics by exploring the integration of network security detection, data mining, and structural feature analysis. Data for this research was collected using a sniffer device and underwent extensive preprocessing to ensure diversity and applicability. To overcome the limitations of traditional data mining, such as the issue of sharp boundaries, this method combines fuzzy logic with data mining techniques, enhancing conventional network security protocols. Simulation experiments demonstrate the efficacy of this fuzzy mining-based approach, with results showing 987,238 predicted positive cases, 93,951 of which were accurate. The method achieves an impressive 93.65% accuracy and 92.55% recall rate, proving its capability to promptly identify and mitigate suspicious network activities.

A machine learning based approach for 5G network security monitoring

Abstract This paper constructs a 5G network security detection system based on the functional requirements of network security detection and the P2DR process model. The structure can be broken down into three layers from the bottom to the top: acquisition layer, analysis layer, and display layer. The design focuses on writing the SVM algorithm into the software of the communication network security vulnerability monitoring system, and in order to solve the defect of the long training time of the model of this machine learning algorithm, the incremental learning vector machine model is used, which is combined into the CSV-KKT-ISVM model. Test datasets that cover system performance, effectiveness, and leakage are used to test the system after it is completed. The test data was analyzed to prove that the system’s memory usage was maintained at 46M, CPU usage was 5% to 10%, and the response time was no later than 1 s. The monitoring accuracy was 98.5% at the highest but decreased with the increase of the percentage of vulnerability data, and the accuracy dropped to 93.9% at 50%, the minimum was not lower than 90%, and the error rate was no less than 0.8%. To achieve the best outcome, the system threshold should be set to 5, and there should be no false alarms or misreporting.

Implementation of Snort as a Wireless Network Security Detection Tool Using Linux Ubuntu

Implementation of snort as a wireless network security detection tool using linux ubuntu by adding a server that is used to observe activities on a wireless network, if there is an activity that is considered dangerous by the client, the information will be stored in the snort log and database. The web-based front-end uses BASE (Basic Analysis and Security Engine) which can be accessed through a browser with the url : IPaddressServer/base/. The information provided is related to attacks detected by snort that have been stored in the database. The information is in the form of source and destination IP addresses, the type of attack that occurred. Based on the tests carried out, it was found that the implementation of snort as a wireless network security detection tool using linux ubuntu can help detect attacks that occur on the network and provide information related to these attacks.

Federated deep learning algorithm for RPA network security detection

ABSTRACT The development of Internet technology has produced a huge impact on people’s lives. More data information is generated in life or work. Research proposes a combined detection model, and combines Fed Prox, convolutional neural network, and support vector machine to obtain Fed Prox Convolutional Neural Networks Support Vector Machine (Fed PCNN). The network intrusion detection model trains the local model with the divided local data, uses the model with the near-end item as the judgment basis, analyzes the difference between the model and the global model, and then trains the local model through local iteration. Finally, the local model is aggregated to obtain the best classification prediction effect of the model effect. The research proves that the Fed PCNN model has an excellent performance in recall and accuracy through experiments. In different data sets, the recall rate is more than 90%, the accuracy rate is more than 95%, and the false alarm rate is less than 2%. Therefore, the Fed PCNN model has a good detection effect in network intrusion detection.

The Construction of Network Domain Name Security Access Identification System Based on Artificial Intelligence

With the popularization of the internet, cybercrime continues to increase, and traditional blacklist methods have difficulty in coping with new threats. To address this challenge, the authors propose a web domain name security access recognition algorithm based on bidirectional recurrent neural networks, aiming to more effectively combat domain name generation technology. This algorithm extracts richer semantic features at each layer through bidirectional recurrent neural networks to more accurately describe domain name features, thus effectively handling SGD problems in abnormal network traffic detection. The results show that compared with the other three algorithms, the model trained by HCA-BAGD has better performance and higher accuracy, successfully solving the problem of network security detection. This study emphasizes the importance of cybersecurity and emphasizes continuous innovation and the adoption of new technological tools to ensure the safe operation of the internet ecosystem, bringing new perspectives and solutions to research and applications in the field of cybersecurity.

Vulnerability Detection in Computer Networks using Virtual Reality Technology

This paper challenges the time-related challenges inherent in conventional network security detection methodologies. It is achieved by incorporating virtual reality technology into the domain of computer network security detection. The research methodology employs optimization calculations to extract attributes that characterize network security vulnerabilities. Concurrently, the weighting of diverse vulnerability attributes is adjusted using a web crawler, a comprehensive list of injection points, and meticulous analyses of the attacks’ genetic characteristics. This collective approach facilitates the exploration of automated network security vulnerability detection within a virtual reality framework. The study’s empirical results demonstrate that the detection method proposed within this investigation exhibits a notably reduced delay of 75.33 milliseconds. The respective delays observed in the two conventional methods stand at 290.11 milliseconds and 337.30 milliseconds. The substantial decrease in detection delay validates the effectiveness and efficiency of the devised automated network vulnerability detection approach grounded in virtual reality technology.

A review of deep learning based intrusion detection systems

Network security is a key issue in the era of rapid Internet development and new technologies are needed to enhance the security protection of network systems. As the first line of defence for the security of network systems, IDS is considered to be one of the important network tools for managing network security. Traditional network intrusion detection methods usually use machine learning techniques. However, deep learning, a more powerful machine learning method, has the advantages of mature technology, wide applicability and high accuracy, and has shown its advantages in various fields such as image recognition, natural language processing and computer vision. It can also be applied to network security detection, as it can effectively handle large-scale, complex datas and detect unknown, sophisticated network attacks. This paper will provide a summary of machine learning techniques and deep learning techniques in intrusion detection systems, as well as examples of IDSs using deep learning, and conclude with a summary and outlook.

Leveraging Graph-Based Representations to Enhance Machine Learning Performance in IIoT Network Security and Attack Detection

In the dynamic and ever-evolving realm of network security, the ability to accurately identify and classify portscan attacks both inside and outside networks is of paramount importance. This study delves into the underexplored potential of fusing graph theory with machine learning models to elevate their anomaly detection capabilities in the context of industrial Internet of things (IIoT) network data analysis. We employed a comprehensive experimental approach, encompassing data preprocessing, visualization, feature analysis, and machine learning model comparison, to assess the efficacy of graph theory representation in improving classification accuracy. More specifically, we converted network traffic data into a graph-based representation, where nodes represent devices and edges represent communication instances. We then incorporated these graph features into our machine learning models. Our findings reveal that incorporating graph theory into the analysis of network data results in a modest-yet-meaningful improvement in the performance of the tested machine learning models, including logistic regression, support vector machines, and K-means clustering. These results underscore the significance of graph theory representation in bolstering the discriminative capabilities of machine learning algorithms when applied to network data.

Fortifying the Cloud: Unveiling the Next-Generation Security Model of AWS

Amazon Web Services (AWS) is a renowned provider of cloud computing services and infrastructure for businesses of all kinds. As organizations shift crucial data and apps to the cloud, security becomes paramount. This abstract describes AWS's security model and efforts to secure client data and prevent unauthorized access. The AWS security model protects client assets with many layers. AWS data centers include tight access controls, surveillance systems, and numerous levels of protection. AWS also meets worldwide security requirements and best practices. The shared responsibility approach governs AWS and customer security. AWS secures the infrastructure, while clients secure applications, data, and user access. AWS offers identity and access management, network security, encryption, and threat detection to help businesses meet security requirements. AWS security relies on identity and access management (IAM) to govern user access to AWS resources. IAM lets organizations set fine-grained access controls, implement multi-factor authentication, and link with identity systems, improving security. AWS protects data in transit and at rest with strong network security. Network access control lists (ACLs) and security groups provide clients granular control over inbound and outgoing traffic in Virtual Private Cloud (VPC) environments. AWS data is protected by several encryption solutions, including key management services for secure key storage and access. AWS monitors and logs to detect and mitigate security risks. AWS CloudTrail, Config, and Guard Duty let clients monitor and audit their AWS environments, detect configuration changes, and detect security breaches and criminal behavior. In conclusion, AWS security protects client data and applications. AWS secures cloud installations through physical, network, data, and identity and access management. Organizations must understand their shared obligations and use security services and features to secure their AWS resources.

Deep learning technology of computer network security detection based on artificial intelligence

With the continuous progress of the information age and science and technology, how to combine complex and changeable data with self-protection ability has become an urgent problem that needs to be solved. In the computer system, the traditional technology for protection is somewhat passive. To this end, this paper analyzes computer network security monitoring under artificial intelligence (AI) deep learning technology and discusses its development trend, which monitors network security to find and address problems in time. The results show that the deep learning technology of computer network security detection can improve its security performance with high safety performance, high detection rate, and low false alarm rate. It can monitor the vulnerabilities in the computer network in time and realize effective security attack detection of the computer network.

Network Security Detection Method Based on Abnormal Traffic Detection

Network Security Detection Method Based on Abnormal Traffic Detection