Network Security Protection Research Articles

Modeling and Constructing a Network Security System for Colleges and Universities in the Context of Digital Transformation

In recent years, with the rapid development of a new generation of digital technology, especially in the context of digital transformation faced by colleges and universities, cloud computing, big data, the Internet of Things mobile Internet and other technologies effectively promote the development of higher education to the development of intelligent education, and the digital campus of colleges and universities is facing the digital transformation and upgrading. New technologies bring many benefits to the construction of digital campuses in colleges and universities, but also bring new network security risks. Colleges and universities are faced with network openness without borders, zero trust in security authentication, asymmetric attack and defence confrontation, and ever-changing network information security problems. In the context of digital transformation, how colleges and universities can cope with the network security problems brought by new technologies and how to effectively construct network security defences is the work that colleges and universities must pay attention to and move forward. This paper first discusses the background and significance of the digital transformation of colleges and universities, the network security challenges and real needs faced in the transformation process, and finally puts forward the network security system construction ideas for the existing problems, aiming to improve the level of network security protection in the process of constructing smart campuses in colleges and universities.

A performance overview of machine learning-based defense strategies for advanced persistent threats in industrial control systems

Cybersecurity incident response is a very crucial part of the cybersecurity management system. Adversaries emerge and evolve with new cybersecurity tactics, techniques, and procedures (TTPs). It is essential to detect the TTPs in a timely manner to respond effectively and mitigate the vulnerabilities to secure business operations. This research focuses on TTP identification and detection based on a machine learning approach. Early identification and detection are paramount in protecting, responding to, and recovering from such adversarial attacks. Analyzing use cases is a critical tool to ensure proper and in-depth evaluation of sector-specific cybersecurity challenges. In this regard, this study investigates existing known methodologies for cyber-attacks such as Mitre attacks, and developed a method for identifying threat cases. In addition, Windows-based threat cases are implemented, comprehensive datasets are generated, and supervised machine learning models are applied to detect threats effectively and efficiently. Random forest outperforms other models with the highest accuracy of 99%. Future work can be done for generating threat cases based on multiple log sources, including network security and endpoint protection device, and achieve high accuracy by removing false positives using machine learning. Similarly, real-time threat detection is also envisioned for future work.

Multiobjective network security dynamic assessment method based on Bayesian network attack graph

PurposeWith the rapid development of Internet technology, cybersecurity threats such as security loopholes, data leaks, network fraud, and ransomware have become increasingly prominent, and organized and purposeful cyberattacks have increased, posing more challenges to cybersecurity protection. Therefore, reliable network risk assessment methods and effective network security protection schemes are urgently needed.Design/methodology/approachBased on the dynamic behavior patterns of attackers and defenders, a Bayesian network attack graph is constructed, and a multitarget risk dynamic assessment model is proposed based on network availability, network utilization impact and vulnerability attack possibility. Then, the self-organizing multiobjective evolutionary algorithm based on grey wolf optimization is proposed. And the authors use this algorithm to solve the multiobjective risk assessment model, and a variety of different attack strategies are obtained.FindingsThe experimental results demonstrate that the method yields 29 distinct attack strategies, and then attacker's preferences can be obtained according to these attack strategies. Furthermore, the method efficiently addresses the security assessment problem involving multiple decision variables, thereby providing constructive guidance for the construction of security network, security reinforcement and active defense.Originality/valueA method for network risk assessment methods is given. And this study proposed a multiobjective risk dynamic assessment model based on network availability, network utilization impact and the possibility of vulnerability attacks. The example demonstrates the effectiveness of the method in addressing network security risks.

An efficient intrusion detection method using federated transfer learning and support vector machine with privacy-preserving

In recent decades, network security for organizations and individuals has become more and more important, and intrusion detection systems play a key role in protecting network security. To improve intrusion detection effect, different machine learning techniques have been widely applied and achieved exciting results. However, the premise that these methods achieve reliable results is that there are enough available and well-labeled training data, training and test data being from the same distribution. In real life, the limited label data generated by a single organization is not enough to train a reliable learning model, and the distribution of data collected by different organizations is difficult to be the same. In addition, various organizations protect their privacy and data security through data islands. Therefore, this paper proposes an efficient intrusion detection method using transfer learning and support vector machine with privacy-preserving (FETLSVMP). FETLSVMP performs aggregation of data distributed in various organizations through federated learning, then utilizes transfer learning and support vector machines build personalized models for each organization. Specifically, FETLSVMP first builds a transfer support vector machine model to solve the problem of data distribution differences among various organizations; then, under the mechanism of federated learning, the model is used for learning without sharing training data on each organization to protect data privacy; finally, the intrusion detection model is obtained with protecting the privacy of data. Experiments are carried out on NSL-KDD, KDD CUP99 and ISCX2012, the experimental results verify that the proposed method can achieve better results of detection and robust performance, especially for small samples and emerging intrusion behaviors, and have the ability to protect data privacy.

Robustness of Double-Layer Group-Dependent Combat Network with Cascading Failure

The networked combat system-of-system (CSOS) is the trend of combat development with the innovation of technology. To achieve the combat effectiveness, studying the ability of CSOS to cope with external interference is of great importance. Here we report a modeling method of CSOS from the perspective of complex networks and explore the robustness of the combat network based on this. Firstly, a more realistic double-layer heterogeneous dependent combat network model is established. Then, the conditional group dependency situation is considered to design failure rules for dependent failure, and the coupling relation between the double-layer subnets is analyzed for overload failure. Based on this, the initial load and capacity of the node are defined, respectively, as well as the load redistribution strategy and the status judgment rules for the cascading failure model. Simulation experiments are carried out by changing the attack modes and different parameters, and the results show that the robustness of the combat network can be effectively improved by improving the tolerance limit of one-way dependency of the functional net, the node capacity of the functional subnet, and the tolerance of the overload state. The conclusions of this paper can provide a useful reference for network structure optimization and network security protection in the military field.

Dependable federated learning for IoT intrusion detection against poisoning attacks

Network intrusion detection methods based on federated learning (FL) and edge computing have great potential for protecting the cybersecurity of the Internet of Things. It overcomes the disadvantages of the traditional centralized method, such as high latency, overloaded network, and privacy leakage. At the same time, it can combine private data from multiple participants to train models, and the rich data can train more effective models. However, the inherent security vulnerabilities of the FL framework do not ensure the robustness of the global models trained collaboratively. Towards FL, each participant has access to model parameters and training data, and malicious participants can affect the global model by tampering with data or weights. This paper studies label-flipping attacks in FL-based IoT intrusion detection. We propose a lightweight detection mechanism to mitigate the impact of poisoning attacks on FL-based intrusion detection methods in IoT networks. The detection mechanism on a central server filters anomalous participants and excludes their uploaded models from the global model aggregation. Specifically, we propose a scoring mechanism for evaluating participants based on the loss of the local model and the training dataset size. Afterwards, the Manhattan similarity between each participant will be calculated according to the scores. Finally, the anomalous participants will be found by clustering algorithm for similarity cluster analysis. The experimental results show that our proposed detection method can defend against label-flipping attacks in FL. On the CIC-IDS-2017 dataset, our method can improve the accuracy of the intrusion detection model trained based on FL from 84.3% to 97.1%, while enhancing the protection of IoT network security.

Algorithmic means of ensuring network security and websites: trends, models, future cases

The purpose of the study is to establish probable trends in the development of algorithmic means of network security and the protection of web resources in the future. The research methods used in this publication are a bibliometric analysis of 500 relevant publications, which allowed us to establish probable trends in the future development of the subject field. The study found that currently the most likely algorithmic means of network security and website protection that will be intensively developed in the future are blockchain technologies (to protect inter-resource contact), deep and machine learning (to analyze and detect attacks and digital anomalies), artificial intelligence and neural networks (to develop complex security algorithms), and predictive analysis (to prevent possible attacks and malicious data injections). At the same time, technological development makes it possible to identify alternative security tools, including quantum and post-quantum cryptography (which is possible due to the development of quantum computing), augmented reality (which is the next iteration of the development of the interface between machine-human interaction), biometric identification (which is the next iteration of authentication and recognition systems) and DevSecOps (which is a promising technology for the production of digital tools and systems that have a relatively lower level of vulnerability to known digital threats). The correlative impact of Industry 4.0 technologies and solutions on the studied aspects of the security sector of the World Wide Web has been established. The growth of the network of devices requires the improvement of security algorithms in the paradigm of Industry 4.0 technologies, which will allow more effective detection and prevention of cyberattacks and protection of user data.

Research on Computer Network Security Protection Technology Incorporating Full Convolutional Networks

Abstract To strengthen networks’ security performance, here pose suggests a fused full convolutional approach to monitoring computer networks. This paper first analyzes the various performances of the full convolutional model for error problems rate, error reporting, and monitoring effects on various attack categories then proposes a network monitoring scheme for the full convolutional model and introduces the workflow of the full convolutional model in computer network security protection. In terms of accuracy, the full convolutional error rate of the blueprint meets the requirements rate of 96.8%, which is better than the classical network models of Lenet-5 and AlexNet, with 86.2% and 91.6%. The false alarm rate is only 2.37%, which is lower than the 5.74% MLP algorithm and 4.23% SVM algorithm. By comparison, the full convolutional calculation method is more efficient than other calculation methods in the detection rate of attack types such as Dos, Probe, U2R, and R2L. Therefore, the calculation method here is well adapted to computer network security protection requirements.

Intelligent cluster construction of internet financial security protection system in banking industry

Abstract As the rapid advancement of information security company is developing quickly and the technology including big information, big computer, large cloud, and artificial intelligence are being widely used, network security has entered a new era. While ushering in huge development opportunities, it also faces severe tests. Network security is a major issue related to the comprehensive realization of a well-off society and national security, and has risen to the national strategic level. The current financial industry network security construction mainly focuses on team, process construction, and the research and development of individual tools and equipment. It lacks system research and implementation guidelines for defense technology construction based on industry IT characteristics. At the same time, there is also a lack of objective and unified measurement and evaluation standards for enterprise security defense capabilities, which restricts the improvement of cybersecurity capabilities in the financial industry to a certain extent. In terms of actual combat exercises, in various actual combat exercises over the years, the technical architecture of the bank’s network security defense has withstood the test of high-intensity confrontation. The defense process achieved zero deductions, and stood out among the participating defending teams through traceability and countermeasures, which effectively improved the network security large-scale group operations and security protection capabilities. The effectiveness of the technical architecture design is verified in actual combat, which shows that the control of the bank’s internet financial security protection system is effective. With digital computing, all banking transactions are fully automatically implemented and the bank’s clientele is systematically self-managed. It predicts that using this system, the speed can be increased by 98% and the accuracy can be increased by 12%.

Network Traffic Classification Based on SD Sampling and Hierarchical Ensemble Learning

With the increase in cyber threats in recent years, there have been more forms of demand for network security protection measures. Network traffic classification technology is used to adapt to the dynamic threat environment. However, network traffic has a natural unbalanced class distribution problem, and the single model leads to the low accuracy and high false-positive rate of the traditional detection model. Given the above two problems, this paper proposes a new dataset balancing method named SD sampling based on the SMOTE algorithm. Different from the SMOTE algorithm, this method divides the sample into two types that are easy and difficult to classify and only balances the difficult-to-classify sample, which not only overcomes the SMOTE’s overgeneralization but also combines the idea of oversampling and undersampling. In addition, a two-layer structure combined with XGBoost and the random forest is proposed for multiclassification of anomalous traffic, since using a hierarchical structure can better classify minority abnormal traffic. This paper conducts experiments on the CICIDS2017 dataset. The results show that the classification accuracy of the proposed model is more than 99.70% and that the false-positive rate is less than 0.34%, indicating that the proposed model is better than traditional models.

Soft computing in computer network security protection system with machine learning based on level protection in the cloud environment

Artificial neural networks (ANN), fuzzy inference systems, approximate reasoning, and derivative-free optimization approaches like evolutionary computation, among others, are all components of Soft Computing (SC), an innovative method for building computationally intelligent methods. Due to its widespread use and benefits, cloud computing is currently a major focus for researchers. The distributed nature of cloud computing and its complete reliance on the internet for service provision present security challenges, the most serious of which is insider Distributed Denial of Service (DDoS) which results in complete deactivation of services. Based on machine learning and the cloud, this study proposes a novel method for improving computing network security. Using a trust-based secure cloud environment and the Kernel principal component encoder architecture, the network monitoring is carried out. The soft computing environment-based detection of a cyberattack on the network is the purpose for the security enhancement. Throughput, QoS, latency, and packet delivery ratio for various monitored cyber security datasets are the focus of the experimental analysis. The proposed technique attained network security analysis of 89%, throughput of 98%, QoS of 66%, latency of 59%, packet delivery ratio of 83%.

Study of data center communication network topologies using complex network propagation model

Data center, as the core infrastructure of data storage and processing, calls for network security protection. Information security has been addressed in a number of specific ways. However, there are few studies that employ network topology features to prevent the transmission of viruses. When a virus spreads, different topologies display various properties. In this paper, we study three types of data center network topologies, i.e., Fat-tree, Leaf-spine, and Bcube, and quantify the propagation characteristics in every topology through the IC propagation model. The probability of the device being infected, the count of propagation sources, the access of propagation sources, and the topological parameters are all considered. Given that network security defenders can only change the topology and topological parameters, we propose a computational framework that combines factor analysis, which provides us with the selection of network topological parameters with a low virus propagation rate in the candidate parameter set. Through experiments, we find that Leaf-spine has a good inhibitory effect on viruses with high propagation probability. Meanwhile, each offers unique advantages. We hope that more data center network topologies will be studied to improve the security of all data centers using these network topologies.

GANAD: A GAN-based method for network anomaly detection

Cyber-intrusion always leads to severe threats to the network, i,e., system paralysis, information leaky, and economic losses. To protect network security, anomaly detection methods based on generative adversarial networks (GAN) for hindering cyber-intrusion have been proposed. However, existing GAN-based anomaly score methods built upon the generator network are designed for data synthesis, which would get unappealing performance on the anomaly detection task. Therefore, their low-efficient and unstable performance make detection tasks still quite challenging. To cope with these issues, we propose a novel GAN-based approach GANAD to address the above problems which is specifically designed for anomaly identification rather than data synthesis. Specifically, it first proposes a similar auto-encoder architecture, which makes up for the time-consuming problem of the traditional generator loss computation. In order to stabilize the training, the proposed discriminator training replaces JS divergence with Wasserstein distance adding gradient penalty. Then, it utilizes a new training strategy to better learn minority abnormal distribution from normal data, which contributes to the detection precision. Therefore, our approach can ensure the detection performance and overcomes the problem of unstable in the process of GAN training. Experimental results demonstrate that our approach achieves superior performance to state-of-the-art methods and reduces time consumption at the same time.

Research on computer network security protection technology based on a superiority algorithm

Abstract The rapid development of computer network technology has brought great convenience to all walks of life and made the transmission of various information faster. A secure and reliable computer network environment has a critical impact on the functioning of the computer network. In this paper, we derive and analyze the detection probability, false alarm probability and judgment threshold of the new algorithm based on the results of random matrix theory based on the feature-fitting superiority algorithm, which can exhibit better detection performance. In the framework of matrix theory, the superiority algorithm reduces the problem of network security to some extent and improves the performance relative to other fitted superiority detection algorithms. For common threats to network security, give the corresponding ideas to deal with network security issues from a technical perspective. The detection rate and false alarm rate are calculated by testing the total number, the number of intrusion bars, the number of detected intrusion bars, and the number of false alarm bars detected by the system, respectively. The test results show that the average detection rate is still greater than 94%, the average false alarm rate has improved, and the average false alarm rate is controlled at about 3.1%, which can fully meet the system requirements. Give reference to further enhance the reliability and stability of network security systems.

Design and implementation of computer network security protection system based on artificial intelligence technology

Abstract With the rapid development of the Internet, security issues are becoming more and more prominent, and since most information is transmitted through the Internet today, Internet security is particularly important. When the Internet was designed, only mutual compatibility and interoperability between networks were considered, and security issues were not fully considered. As a result, as the Internet continues to grow, security issues are becoming more and more serious. One of the more difficult attacks is the Distributed Denial of Service (DDoS) attack, which has many forms of attacks, is harmful, and is difficult to identify and defend. Therefore, building a global Internet security protection system to achieve effective protection against DDoS attacks is the main work of this research paper. In this paper, we propose an artificial intelligence DDoS attack protection system, which implements a controller and switch auto-detection model by extending the protocol and establishing an optimization model to realize a low-load and low-latency traffic monitoring scheme; for DDoS attacks. We propose the attack inspection algorithm SCVAE based on Variational Encoder (VAE) and Spectral Clustering. in order to mitigate DDoS attack traffic, the protection system uses the QoS traffic control method, builds the application flow hierarchy model, and filters the attack traffic endured by the system by setting the application flow bandwidth limit as well as the traffic priority dual policy. Finally, a Mininet-based simulation test environment is built to evaluate the model, and different test indexes are set for different system modules to evaluate their actual performance. The results of this paper show that in the network traffic monitoring test, the artificial intelligence DDoS attack protection algorithm can respond to the attack more quickly by reducing the average 73ms per sampling compared with other algorithms; in the attack traffic identification test, the comparison accuracy (P) is improved by 15.14%, the accuracy (AC) is improved by 13.26%, the recall (R) is reduced by 9.23%, and the F1 measurement criteria improved by 23%. The test verifies that the artificial intelligence DDoS attack protection system can achieve real-time monitoring of each performance parameter and also illustrates the feasibility and practicality of the research content of this paper, which strengthens the construction of the technical means of Internet security protection and further enhances the Internet security defense capability.

Real-Time Risk Detection Method and Protection Strategy for Intelligent Ship Network Security Based on Cloud Computing

When studying an unfamiliar system, we first look for the symmetry that the system has, so that we can make many predictions about the possible properties of the system. The symmetry in ship network security needs to maintain a stable state and maintain a constant state of ship network security. With the rapid development of network information technology, smart ships have become a new hot spot in the international shipping industry. The smart ships cybersecurity discussion is also at the top of the list in the maritime field. More and more shipping companies feel that their smart ship systems need to be upgraded and the main reason behind this is that the systems are maliciously attacked by cyber hackers. Therefore, it is extremely important to detect and protect the security of intelligent ship network systems in real time. The issue of network security has always accompanied the whole process of the development of the Internet. At the same time, with the development of Internet technology, network hacking attacks against the Internet have never stopped developing, and traditional ship network security risk detection and protection cannot achieve good results. After understanding the operation mode of intelligent ship networks, this paper deeply studied the characteristics of cloud computing technology and proposed a real-time risk detection method and protection strategy for intelligent ship network security based on cloud computing. This paper mainly used multi-sensor nodes to analyze data containing malicious attack information and implemented self-execution protection strategy generation nodes to intercept and protect from the attack, so as to achieve the purpose of maintaining the network security of intelligent ships. Through experiments, the virus intrusion detection and defense rate of the algorithm proposed in this paper was able to reach 85% to 95%, while the virus intrusion detection defense rate of the traditional intelligent ship network security protection algorithm was 55% to 65%. The detection rate of the algorithm proposed in this paper was able to reach 96.95% and the false positive rate was 2.56%. The detection rate of the traditional algorithm was only 70.76%, while the false positive rate reached 4.69%. All of the proposed algorithm’s data were significantly better than that of traditional algorithms, which proved that the performance of cloud computing-based real-time risk detection and protection algorithms for intelligent ship network security was significantly better than that of traditional algorithms.

Research on Network Behavior Risk Measurement Method Based on Traffic Analysis

At present, the network security problem is facing a serious threat, and network security events continue to occur. It has become an important link to prevent network attacks and ensure network security. According to the network security protection measures and security technical requirements, it has become an urgent need to establish appropriate security measurement methods and strengthen the monitoring and analysis of network security status. This study proposes a network behavior risk measurement method based on traffic analysis to accurately and objectively evaluate the security state of the network. Traffic is the most basic behavior of the network and the basis of security risk measurement. Firstly, we regard the traffic data as network behavior to build scenarios. Through differential manifold modeling, the traffic data and topology of the network system are semantically described to form a matrix. Then, after manifold dimensionality reduction, the objective risk assessment value can be obtained by manifold mapping and Riemann metric. In this study, the differential manifold theory is applied to network behavior risk measurement, and the innovation of differential manifold in the field of network behavior risk measurement is given. After giving the network behavior risk measurement theory, we first verify the effectiveness of the proposed method through the simulation experiments. Secondly, the public CIC-IDS-2017 data set is used for analysis and calculation to prove the accuracy of the proposed method.

Analysis on Network Information Security Protection Technology of Intelligent Terminal Power Monitoring System of Substation under the Support of Multimodal Multimedia Information

According to the perspective of multimode multimedia data, the protection technology of network information security is mainly discussed. The theoretical basic research is outlined, its meaning, level, reasons, and consequences are expounded, and the future research content and development trend are discussed. With the rapid development of online services and mobile technology, the world has entered the era of multimedia big data. There have been a large number of scientific studies in the multimedia industry, which explain the various fields of big data, including the capture, storage, reference, excavation, and search of multimedia big data. The article expounds the specific concept of power monitoring system network information security, establishes the safety regulations of electric power monitoring system, formulates the corresponding ideas for the safety guarantee level of electric power monitoring system, and promotes the long-term development of China’s electric power enterprises. The safe operation of the power monitoring system is directly related to the stable operation of all power supply systems and even the social economy. At this stage, the situation of network security management in China’s power monitoring system is still not optimistic. We take the multimode multimedia data, organize the research dynamics of the network security protection technology, and discuss the future research trend.

Three-Way Selection Random Forest Optimization Model for Anomaly Traffic Detection

With the application and development of Internet technology, network traffic is growing rapidly, and the situation of network security is becoming more and more serious. As an important way to protect network security, abnormal traffic detection has been paid more and more attention. In this paper, the uncertainty of the samples in the abnormal traffic detection dataset is studied. Combining the three-way decision idea with the random forest algorithm, a three-way selection random forest optimization model for abnormal traffic detection is proposed. Firstly, the three-way decision idea is integrated into the random selection process of feature attributes, and the attribute importance based on decision boundary entropy is calculated. The feature attributes are divided into the normal domain, abnormal domain, and uncertain domain, and the three-way attribute random selection rules are designed to randomly select the feature attributes that conform to the rules from different domains. Secondly, the classifier evaluation function is constructed by combining pure accuracy and diversity, and the anomaly traffic detection base classifier with a high evaluation value is selected for integration to eliminate the unstable factors caused by randomness in the process of base classifier generation. Thirdly, the optimal node weight combination of the base classifier is obtained by iterative calculation of the gray wolf optimization algorithm to further improve the prediction effect and robustness of the model. Finally, the model is applied to the abnormal traffic detection dataset. The experimental results show that the prediction accuracy of the three-way selection random forest optimization model on CIC-IDS2017, KDDCUP99, and NSLKDD datasets is 96.1%, 95.2%, and 95.3%, respectively, which has a better detection effect than other machine learning algorithms.

RETRACTED ARTICLE: Research on campus network security protection system framework based on cloud data and intrusion detection algorithm

RETRACTED ARTICLE: Research on campus network security protection system framework based on cloud data and intrusion detection algorithm