Network Security Framework Research Articles

MULTI-LAYER CLASSIFIER FOR MINIMIZING FALSE INTRUSION

Intrusion detection is one of the standard stages to protect computers in network security framework from several attacks. False alarms problem is critical in intrusion detection, which motivates many researchers to discover methods to minify false alarms. This paper proposes a procedure for classifying the type of intrusion according to multi-operations and multi-layer classifier for handling false alarms in intrusion detection. The proposed system is tested using on KDDcup99 benchmark. The performance showed that results obtained from three consequent classifiers are better than a single classifier. The accuracy reached 98% based on 25 features instead of using all features of KDDCup99 dataset.

Designing an efficient security framework for detecting intrusions in virtual network of cloud computing

Cloud computing has grown for various IT capabilities such as IoTs, Mobile Computing, Smart IT, etc. However, due to the dynamic and distributed nature of cloud and vulnerabilities existing in the current implementations of virtualization, several security threats and attacks have been reported. To address these issues, there is a need of extending traditional security solutions like firewall, intrusion detection/prevention systems which can cope up with high-speed network traffic and dynamic network configuration in the cloud. In addition, identifying feasible network traffic features is a major challenge for an accurate detection of the attacks. In this paper, we propose a hypervisor level distributed network security (HLDNS) framework which is deployed on each processing server of cloud computing. At each server, it monitors the underlying virtual machines (VMs) related network traffic to/from the virtual network, internal network and external network for intrusion detection. We have extended a binary bat algorithm (BBA) with two new fitness functions for deriving the feasible features from cloud network traffic. The derived features are applied to the Random Forest classifier for detecting the intrusions in cloud network traffic and intrusion alerts are generated. The intrusion alerts from different servers are correlated to identify the distributed attack and to generate new attack signature. For the performance and feasibility analysis, the proposed security framework is tested on the cloud network testbed at NIT Goa and using recent UNSW-NB15 and CICIDS-2017 intrusion datasets. We have performed a comparative analysis of the proposed security framework in terms of fulfilling the cloud network security needs.

A big data framework for network security of small and medium enterprises for future computing

Recently, there have been some concerns for the network control systems which have been built for the major closed national communication infrastructures in the Republic of Korea. In particular, the control systems used by the small- and medium-sized enterprises (SMEs) often did not consider much on the sophisticated internal or external threats such as hacking or identity theft when they were first developed. For this reason, SMEs have been constantly exposed to internal/external security threats posed by both internal and external attackers, while they are using their own internal business networks constantly stay linked to the external networks operated by their cooperating companies or institutions for the convenience of conducting business. Hence, the security of SMEs’ business networks is still vulnerable, but it is not easy to obtain the information from security officials about what are the actual problems they are facing. In this study, a method of strengthening the SMEs’ security capability is proposed, especially focusing on a framework to be used when applying big data. For the simulations, necessary data was provided by the SMEs who have experienced security threats in the past. An empirical analysis was conducted with such data, and a framework was designed accordingly. The framework was simulated in a test bed for adjustment. The demographic characteristics of the data providers were studied to ensure a more accurate analysis of the data. The frequency and reliability analysis methods were used together with the machine learning technique to measure the reliability of the data, whereas a factor analysis was applied the validity. Partial least squares (PLS) was used for the empirical analysis as well. An application to which these methodologies were applied was implemented with Java Android and will be provided to the security managers of SMEs upon completion. It is expected that the framework proposed in this study will be a useful solution for SMEs for their future computing needs.

Fuzzy min–max neural network and particle swarm optimization based intrusion detection system

To maintain the integrity, availability, reliability of the data and services available on web requires a strong network security framework, in such consequence IDS based on data mining are the best solution. In this paper we proposed an intrusion detection system which is based on the fuzzy min max neural network and the particle swarm optimization. The proposed system is tested with the help of preprocessed KDD CUP data set. Classification accuracy and classification error are taken as a performance evaluation parameter to test the effectiveness of the system. The proposed system is compared with the some of the well-known methods, the results shows that the proposed system performed well as compared to the other systems.

Framework for Wireless Network Security Using Quantum Cryptography

Data that is transient over an unsecured wireless network is always susceptible to being intercepted by anyone within the range of the wireless signal. Hence providing secure communication to keep the user information and devices safe when connected wirelessly has become one of the major concerns. Quantum cryptography provides a solution towards absolute communication security over the network by encoding information as polarized photons, which can be sent through the air. This paper explores on the aspect of application of quantum cryptography in wireless networks. In this paper we present a methodology for integrating quantum cryptography and security of IEEE 802.11 wireless networks in terms of distribution of the encryption keys.

Security and Discoverability of Spread Dynamics in Cyber-Physical Networks

Motivated by the increasing need for developing automated decision-support tools for cyber-physical networks subject to uncertainties, we have been pursuing development of a new control-theoretic framework for network security and vulnerability. In this paper, we build on the proposed framework to put forth concrete definitions for security and (dually) discoverability, for a class of models that can represent dynamics of numerous cyber-physical networks of interest: namely, dynamical network spread models. These security and discoverability definitions capture whether or not, and to what extent, a stakeholder can infer the temporal dynamics of the spread from localized and noisy measurements. We then equivalence these security and security-level definitions to the control-theoretic notions of observability and optimal estimation, and so obtain explicit algebraic and spectral conditions for security and analyses of the security level. Further drawing on graph-theory constructs, a series of graphical conditions for security, as well as characterizations of security levels, are derived. A case study on zoonotic disease spread is also included, to illustrate concrete application of the analyses in management of cyber-physical infrastructure networks.

Anomaly Detection Framework Based on Matching Pursuit for Network Security Enhancement

In this paper, a framework for recognizing network traffic in order to detect anomalies is proposed. We propose to combine and correlate parameters from different layers in order to detect 0-day attacks and reduce false positives. Moreover, we propose to combine statistical and signal-based features. The major contribution of this paper are: novel framework for network security based on the correlation approach as well as new signal based algorithm for intrusion detection using matching pursuit.

Statistical and signal‐based network traffic recognition for anomaly detection

AbstractIn this paper, a framework for recognizing network traffic in order to detect anomalies is proposed. We propose to combine and correlate parameters from different layers in order to detect 0‐day attacks and reduce false positives. Moreover, we propose to combine statistical and signal‐based features. The major contribution of this paper is novel framework for network security based on the correlation approach as well as new signal‐based algorithm for intrusion detection on the basis of the Matching Pursuit (MP) algorithm. As to our best knowledge, we are the first to use MP for intrusion and anomaly detection in computer networks. In the presented experiments, we proved that our solution gives better results than intrusion detection based on discrete wavelet transform.

Intrusion Detection Based on Self-Organizing Map and Artificial Immunisation Algorithm

The rate of false positives which caused by the variability of environment and user behavior limits the applications of intrusion detecting system in real world. Intrusion detection is an important technique in the defense-in-depth network security framework and a hot topic in computer security in recent years. To solve the intrusion detection question, we introduce the self-organizing map and artificial immunisation algorithm into intrusion detection. In this paper, we give an method of rule extraction based on self-organizing map and artificial immunisation algorithm and used in intrusion detection. After illustrating our model with a representative dataset and applying it to the real-world datasets MIT lpr system calls. The experimental result shown that We propose an idea of learning different representations for system call arguments. Results indicate that this information can be effectively used for detecting more attacks with reasonable space and time overhead. So our experiment is feasible and effective that using in intrusion detection.

Processing of massive audit data streams for real-time anomaly intrusion detection

Intrusion detection is an important technique in the defense-in-depth network security framework. Most current intrusion detection models lack the ability to process massive audit data streams for ...

Processing of massive audit data streams for real-time anomaly intrusion detection

Intrusion detection is an important technique in the defense-in-depth network security framework. Most current intrusion detection models lack the ability to process massive audit data streams for real-time anomaly detection. In this paper, we present an effective anomaly intrusion detection model based on Principal Component Analysis (PCA). The model is more suitable for high speed processing of massive data streams in real-time from various data sources by considering the frequency property of audit events than by use of the transition property or the correlation property. It can serve as a general framework that a practical Intrusion Detection Systems (IDS) can be implemented in various computing environments. In this method, a multi-pronged anomaly detection model is used to monitor various computer system and network behaviors. Three sources of data, system call data from the University of New Mexico ( lpr) and from KLINNS Lab of Xi’an Jiaotong University ( ftp), shell command data from AT&T Research laboratory, and network data from MIT Lincoln Lab, are used to validate the model and the method. The frequencies of individual system calls generated by one process and of individual commands embedded in one command block as well as features extracted in one network connection are transformed into an input data vector. Our method is employed to reduce the high dimensional data vectors and thus the detection is handled in a lower dimension with high efficiency and low use of system resources. The distance between a vector and its reconstruction in the reduced subspace is used for anomaly detection. Empirical results show that our model is promising in terms of detection accuracy and computational efficiency, and thus amenable for real-time intrusion detection.

Authentication based on wavelet transformations

The wavelet transformation is a tool that divides data, functions or operations into different frequency components and then studies each component with a resolution matched to its scale [1,8]. Authentication of messages as well as keys has become a major concern for transactions in many areas [12]. Authenticity or the integrity of the messages can be verified by using digital signature techniques [4]. However traditional digital signature consider all multimedia data as integral to the message, such that no modification is practical in todays applications. Generating digital signatures from compressed multimedia data files is valid only if they are always used with a fixed rate [11]. However in many situations transcoding or rate adjustment is needed to sending compressed images, video and keys over hetereneous channels with different band widths. Traditional digital signature methods will fail to distinguish the desirable/acceptable transcending processes and malicious manipulations [10]. This paper presents a network security framework for an authentication scheme based on Wavelet Transformations.

Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data

Intrusion detection is an important technique in the defense-in-depth network security framework. In recent years, it has been a widely studied topic in computer network security. In this paper, we present two methods, namely, the Hidden Markov Models (HMM) method and the Self Organizing Maps (SOM) method, to profile normal program behavior for anomaly intrusion detection based on computer audit data. The HMM method utilizes the transition property of events while SOM method relies on the frequency property of events. Two data sets, CERT synthetic Sendmail system call data collected in the University of New Mexico (UNM) and Live FTP system call data collected in the CNSIS lab of Xi'an Jiaotong University, were used to assess the two methods. Testing results show that the HMM method using the transition property of events produces good detection performance while high computational expense is required both for training and detection. The HMM method is better than other two methods reported previously in terms of detection accuracy for the same data set. The SOM method considering the frequency property of events, on the other hand, is suitable for real-time intrusion detection because of its capability of processing a large amount of data with low computational overhead.

A framework for ensuring network security

The current focus of network security is concerned with securing individual components as well as preventing unauthorized access to network services. While these are necessary concerns, they do not represent a complete view of network security. In this paper, we present the Lucent Network Security Framework, which provides a comprehensive, top-down, end-to-end perspective on network security. We show how this framework can be applied to network elements, services, and applications including detecting, correcting, and preventing security vulnerabilities. In addition, we demonstrate how the Network Security Framework can be applied to all types of networks and across all layers of the protocol stack. This framework has been submitted to several government and standards bodies (e.g., ITU-T and ISO), and it has been very well received. Service provider networks developed with attention to the Lucent Network Security Framework will have a comprehensive security architecture enabling new value-added revenue-generating security services such as security service-level agreements (SLAs).

A Novel, User-Level, Security-On-Demand Paradigm for ATM Networks: Modeling, Simulation, and Performance Analysis

With networks increasingly moving into virtually every aspect of our daily life, security is gaining importance, not only from the traditional perspective of communication but the network's growing role in modern automation and control. The traditional, certification based approach attempts to guarantee the security of a network through certification. Certified networks are generally confined to a limited domain and, as a result, they are isolated, costly, and under-utilized. In contrast, this paper presents a new principle – user-level, security-on-demand system, wherein the network allocates, where possible, the security resources commensurate with the user's request for transporting message(s) through the network securely. This principle is successfully demonstrated for the current Asynchronous Transfer Mode (ATM) networks, and is the result of an integration of the fundamental framework for network security, recently proposed by the authors in the literature, with the unique characteristics of ATM networks. The framework encapsulates the fundamental knowledge and set of relationships in network security and permits scientific and systematic reasoning about network security. It also enables all user groups – military, government, industry, and academia, to define their security requirements in a uniform manner. The security-on-demand approach promises the development of a "mixed use" class of networks in the future that may be simultaneously shared by different groups of users, with the system sustaining the diverse security requirements of each user. A unique characteristic in ATM network design is the dynamic call setup process. Under it, a network first establishes a virtual path or route for a user's call, guided by the user's requirements, and then transports the messages when a route has been successfully determined. This unique ATM characteristic is integrated with the framework to yield a successful demonstration of the proposed, user-level, security-on-demand approach. Utilizing the security framework as the foundation, every element of the network – node and link, is characterized by a security matrix that reflects its security resources. Every user is permitted to specify the security requirement for the call through a matrix, which expresses the limits of the security resources that the traffic cells must encounter during their transport through the network. Thus, during the dynamic establishment of the virtual path, every node and link is examined to ensure that the user-specified security is met, in addition to bandwidth and other Quality of Service (QoS) requirements. Traffic is launched when the call setup succeeds, otherwise, the call fails. Like all networks, the ATM network inherently consists of geographically dispersed entities and, as a result, the resource allocation strategy is necessarily distributed. Furthermore, as the network operation progresses, the resource availability scene changes dynamically. This paper proposes a unique function that reduces the key network resource parameters at a node to a single value, termed Node Status Indicator (NSI). The NSI value is computed dynamically at every node and disseminated across the network to be utilized by a node to refine its determination of a virtual path for a user call. The aim of the NSI is to improve the resource utilization in the network. The proposed approach is modeled for a large-scale, representative, 40-node ATM network. Utilizing stochastic input traffic that is synthesized to reflect realistic operating conditions, the model is simulated extensively on a testbed of 35+ Pentium workstations, under Linux, configured as a loosely-coupled parallel processor, utilizing an accurate, asynchronous, distributed simulator. The simulator implements the key characteristics of the ATM Forum proposed P-NNI 1.0 and UNI 3.0 standards. While the simulation results reflect a successful realization of the proposed approach, analysis reveals minimal impact of incorporating security on ATM network performance, as measured through call success rates and call setup times. In contrast, the tradition has been to incorporate security into large-scale systems and networks as an afterthought, i.e. adding hardware and software devices after the design has been completed, resulting in performance degradation. Also, while the use of NSI is observed to yield slightly lower average call setup rates and slightly higher average call setup times, a careful analysis of the trace of the calls as they progress through the system, reveals that, in general, calls are dispersed throughout the network, seeking to utilize all available resources of the network more evenly.

An end-to-end home network security framework

Home networks that consist of heterogeneous systems needs the design of a secure and efficient security framework due to the diverse resource limitations of each system and network resources. The existing security frameworks of home networks adapt uniform security techniques without considering diverse system resources and network resources. In this paper, we propose an end-to-end home network security framework to support secure interactions. Our security framework dynamically adjusts security classes based on the sensitivity of interactions among systems. The security class incorporates security levels of cryptographic techniques with a degree of information sensitivity.

A rough set theory based method for anomaly intrusion detection in computer network systems

Abstract: Intrusion detection is important in the defense‐in‐depth network security framework. This paper presents an effective method for anomaly intrusion detection with low overhead and high efficiency. The method is based on rough set theory to extract a set of detection rules with a minimal size as the normal behavior model from the system call sequences generated during the normal execution of a process. It is capable of detecting the abnormal operating status of a process and thus reporting a possible intrusion. Compared with other methods, the method requires a smaller size of training data set and less effort to collect training data and is more suitable for real‐time detection. Empirical results show that the method is promising in terms of detection accuracy, required training data set and efficiency.

A Fundamental Framework for Network Security Towards Enabling Security on Demand in an ATM Network

The traditional, certification based approach attempts to guarantee the security of a network through risk analysis that involves the static analysis of the risks, threats, resource availability, cost, and other parameters. Certified networks are generally confined to a limited domain and, as a result, they are isolated, costly, and under-utilized. This paper integrates the recently introduced fundamental framework for network security with the fundamental and unique characteristics of ATM networks towards a new paradigm-user level security on demand. The framework approach has been adopted by the US National Security Agency as the basis for its Network Rating Model. The framework consists of eight perspectives and nine attributes. The perspectives, termed pillars in this paper, individually provide orthogonal views of network security and collectively constitute a comprehensive stable structure that supports the total network security. The attributes refer to the inherent characteristics of a secure network. The framework provides a basis to address, fundamentally, every weakness in a given network. It also enables the understanding of the security posture of an individual network, in a comprehensive manner, the comparative evaluation of the security of two or more networks, and the determination of the resulting security of a composite network that is formed from connecting two or more networks with known security. In the proposed security on demand approach, the security posture of every node and link is computed, utilizing the framework. Under call setup, the ATM network allows the system to configure, i.e. first project and then verify through propagating a setup message containing a DTL (designated transit list), a route from the source to the destination, including every intermediate ATM node and link, that meets the requirements of every user. Every user specifies the appropriate elements of a security matrix that represents the desired security requirements, in addition to the usual bandwidth and other quality of service (QoS) requirements. Traffic is launched when the call setup succeeds, otherwise, the call fails. Thus, the approach is consistent with the basic characteristics of, is fundamentally the most logical approach to security in, and offers comprehensive security in ATM networks. It also views security as a distributed network resource and allocates it to each user efficiently, based on demand and dictated by the need. The approach has been integrated into the call admission control (CAC) algorithm of the ATM Forum proposed Private Network-Network Interface (PNNI), modeled for a representative, 50-node ATM network, and an asynchronous distributed simulation is executed on a testbed of 25+ Pentium workstations under Linux, configured as a loosely-coupled parallel processor. While the success of the implementation validates the approach, the asynchronous distributed simulation closely resembles an operational ATM network. Performance results, obtained utilizing stochastic and representative input traffic, reveal that the overhead of integrating security into CAC is negligible.

An Integrated Approach to Security on Demand in ATM Networks

This article Introduces a conceptual framework for network security that provides a basis to address, fundamentally, every weakness In a given network. The principal objective of the frame work Is to provide a basis to determine the resulting security of a composite network that Is formed from connecting two or more networks with known security. Using asynchronous transfer mode (ATM), this framework can facilitate electronic commerce by devising fixed routing across networks of known security.

A fundamental framework for network security

The general concept of security in message communications may be traced to the advent of human civilization. In contrast, however, security in automation and control is a recent phenomenon, originating with the computer age and is rapidly gaining importance with the proliferation of networks. With computer networks integrating the dual functions of (i) communications and (ii) automation and control, computer network security must address the security issues inherent in both communications and automation. Until recently, research and development in computer security was strongly linked with cryptography including encryption and decryption of electronic messages. However, as computer networks have started to proliferate into large, complex, real-world systems, such as electronic banking, the power grid, and the proposed intelligent vehicle highway system, the authors believe that computer network security has transcended the traditional definition and has migrated to a higher, logical level. In current and future networks, the information riding on the network may control parts of the network while the control, in turn, may ensure the correct propagation of information from the source to the intended destination. Thus, networks constitute complex, multi-dimensional entities that require security at different levels of both network hardware and network software. This paper first reviews the current literature in network security, in detail. Second, it presents the definition of the network rating model, arrived at by consensus, at the National Security Agency's Network Rating Model (NRM) conference in March 1996 and a subsequent NRM author's group workshop in July 1996. Third, it proposes a fundamental framework for network security that consists of eight perspectives of network security and nine attributes of a secure network. The framework approach was adopted at the NRM author's group workshop. The perspectives, termed «pillars» in this paper, individually provide orthogonal views of network security and collectively constitute a comprehensive stable structure that supports the total network security. The attributes refer to the inherent characteristics of a secure network. The paper then presents a list of the research efforts in high-level security and intrusion resistance and logically argues for their need towards comprehensive network security. A few of the key research areas stressed in this position paper include, (i) the stability of networks under perturbation, (ii) formal proofs of correctness of the algorithms designed to ensure network security, (iii) the use of fuzzy logic and fuzzy thresholds for modeling networks and security criteria, (iv) dynamicity of the parameters constituting the security criteria, over time, to foil intrusion attempts, and (v) the design of innovative schemes aimed at reducing performance impact of security overhead by exploiting key environment or protocol characteristics of the network under consideration.