Network Security System Research Articles

A Robust Hybrid Approach for Malware Detection: Leveraging CNN and LSTM for Encrypted Traffic Analysis

The rapid growth in Internet usage and advancements in network technologies have escalated the risk of network attacks. As the adoption of encryption protocols increases, so does the difficulty in identifying malware within encrypted traffic. Malware represents a significant danger in cyberspace, as it compromises personal data and harms computer systems. Network attacks involve unauthorized access to networks, often aiming to disrupt or damage them, with potentially severe consequences. To counter these threats, researchers, developers, and security experts are constantly innovating new malware detection techniques. Recently, deep learning has gained traction in network security and intrusion detection systems (IDSs), with models such as Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) showing promise in detecting malicious traffic. Despite these advancements, extracting relevant features from diverse malware types remains a challenge. Current solutions demand substantial computational resources and are often inefficient for large datasets. Additionally, existing image-based feature extraction methods consume significant resources. This study tackles these issues by employing a 1D CNN alongside LSTM for the detection and classification of encrypted malicious traffic. Using the Malware Analysis benchmark dataset, which consists of 42,797 malware and 1,079 goodware API call sequences, the proposed model achieved an accuracy of 99.2%, surpassing other state-of-the-art models

SecOnto: Ontological Representation of Security Directives

The current digital landscape demands robust security requirements and, for doing so, the institutions enact complex security directives to protect the citizens and the infrastructures, particularly in the European Union. These directives aim to safeguard data and harmonise security across the European region, and institutions must navigate this evolving legal landscape in order to implement and keep up-to-date the prescribed security measures.However, understanding and implementing these directives towards full compliance can be difficult and expensive. Ontological representation can be employed to represent and operationalise such security directives, ultimately contributing to the effectiveness and efficiency of the compliance process. Ontologies in fact promote a structured approach to represent knowledge, making the applicable directives more simply understandable by humans and more readily processable by machines.This article introduces SecOnto, a novel methodology for representing security directives as ontologies. SecOnto breaks down the process of transforming the juridical language of modern security directives into full-fledged ontologies by means of five semi-automated steps: Preprocessing, Interpretation, Structuring, Representation and Verification. Each step is described and validated by means of operational examples based upon Directive 2022/2555 of the European Parliament and of the Council of the European Union on security of network and information systems, better known as NIS 2.

PenGym: Realistic training environment for reinforcement learning pentesting agents

Penetration testing, or pentesting, refers to assessing network system security by trying to identify and exploit any existing vulnerabilities. Reinforcement Learning (RL) has recently become an effective method for creating autonomous pentesting agents. However, RL agents are typically trained in a simulated network environment. This can be challenging when deploying them in a real network infrastructure due to the lack of realism of the simulation-trained agents.In this paper, we present PenGym, a framework for training pentesting RL agents in realistic network environments. The most significant features of PenGym are its support for real pentesting actions, full automation of the network environment creation, and good execution performance. The results of our experiments demonstrated the advantages and effectiveness of using PenGym as a realistic training environment in comparison with a simulation approach (NASim). For the largest scenario, agents trained in the original NASim environment behaved poorly when tested in a real environment, having a high failure rate. In contrast, agents trained in PenGym successfully reached the pentesting goal in all our trials. Even after fixing logical modeling issues in simulation to create the revised version NASim(rev.), experiment results with the largest scenario indicated that agents trained in PenGym slightly outperformed, and were more stable, than those trained in NASim(rev.). Thus, the average number of steps required to reach the pentesting goal was 1.4 to 8 steps better for PenGym. Consequently, PenGym provides a reliable and realistic training environment for pentesting RL agents, eliminating the need to model agent actions via simulation.

Event Based Control for Network Security Systems Subject to Actuator Saturation

Abstract As a typical nonlinear link, actuator saturation exists in most network security protection systems. It easily disrupts the closed-loop performance of the system, leading to instability. The event triggering control policy generally adopts an aperiodic sampling mechanism and transmits information only when the triggering condition is met, which can save system communication and computing resources. An event-triggered controller is designed for a network security system with actuator saturation, and the system stabilization is realized. The attractor domain of the system is estimated by solving optimization problems in the form of linear matrix inequalities. Simulation results show the validity of the conclusions obtained in this paper.

Collaborative Intrusion Detection System with Snort Machine Learning Plugin

The increasing prevalence of cybercrime and cyber-attacks underscores the imperative need for organizations to implement robust network security measures. Nevertheless, current Intrusion Detection Systems (IDS) often rely on single-sensor or multi-sensor in the same type of IDS, including Host-Based IDS (HIDS) or Network-Based IDS (NIDS), which inherently possess limited detection capabilities. To address this limitation, this research combines NIDS and HIDS components into a collaborative-IDS system, thus expanding the scope of intrusion detection and enhancing the efficacy of the established attack mitigation system. However, the integration of NIDS and HIDS introduces formidable challenges, notably the elevated rates of False Positive and False Negative alerts. To surmount these challenges, the researcher employs machine learning techniques in the form of Snort plugins and comparison methods to heighten the precision of attack detection. The obtained results unequivocally illustrate the effectiveness of this approach. Using a Support Vector Machine for static analysis of the NSL-KDD dataset attains an outstanding 99% detection rate for Denial of Service (DoS) attacks and an impressive 98% detection rate for Probe attacks. Furthermore, in dynamic real-time attack simulations, the machine learning plugins exhibit remarkable proficiency in detecting various types of DoS attacks, concurrently offering more comprehensive identification of SYN Flooding DoS attacks compared to the Snort community rules set. These findings signify a significant advancement in intrusion detection, paving the way for more robust and accurate network security systems in an era of escalating cyber threats.

Enhanced intrusion detection model based on principal component analysis and variable ensemble machine learning algorithm

The intrusion detection system (IDS) model, which can identify the presence of intruders in the network and take some predefined action for safe data transit across the network, is advantageous in achieving security in both simple and advanced network systems. Several IDS models have various security problems, such as low detection accuracy and high false alarms, which can be caused by the network traffic dataset's excessive dimensionality and class imbalance in the creation of IDS models. Principal Component Analysis (PCA) has proven to be a helpful feature selection technique for dimensionality reduction. As a result, because it is a linear transformation, it has challenges capturing non-linear relationships between feature properties in the network traffic datasets. This paper proposes a variable ensemble machine learning method to solve the problem and achieve a low variance model with high accuracy and low false alarm. First, PCA is combined with the AdaBoost ensemble machine learning algorithm, which acts as stagewise additive modelling to compensate for PCA's deficiency in feature selection in network traffic by minimizing the exponential loss function. Secondly, PCA is used for feature selection, and a LogitBoost classifier algorithm can be used for multiclass classification and acts as an additive tree regression to compensate for the PCA's weakness by minimizing the Logistic Loss to provide an optimal classifier output. Finally, the low variance ability of RandomForest, which employs the bagging approach, is applied to eliminate overfittings. The experiments of the IDS model developed from the proposed methods were evaluated on the WSN-DS, NSL-KDD, and UNSW-N15 datasets. The performance of the methods, PCA with AdaBoost, on the WSN-DS dataset has an accuracy score of 92.3 %, an 89.0 % accuracy score on the NSL-KDD dataset, and a 67.9 % accuracy score on UNSW-N15, which is the least accurate score. PCA and RandomForest surpassed them by scoring 100 % accuracy on all three datasets. PCA and Bagging have an accuracy score of 99.8 % on the WSN-DS dataset, 100 % on the NSL-KDD dataset, and 93.4 % on the UNSW-N15 dataset. In comparison, PCA and LogitBoost have an accuracy score of 98.9 % on the WSN-DS dataset, 100 % on the NSL-KDD dataset, and 88.7 % on the UNSW-N15 dataset.

A designated private set based trapdoor authentication scheme for privacy preserving trust management in decentralized systems

Authentication is crucial for network system security, relying on methods such as passwords, ID cards, biometrics, and behavioral characteristics. The conventional centralized authentication may lead to potential performance bottlenecks and privacy risks such as key exposure, single point of failure. Decentralized authentication systems using cryptographic techniques aim to address these issues but often tradeoff between flexibility and communication efficiency. In this paper we propose a new cryptographic concept called designated private set-based trapdoor authentication (DPSBTA) for flexible and efficient trust management in decentralized systems. DPSBTA eliminates the need for a trusted authority, with users’ access privileges defined by their private sets. During the authentication process, each server can designate an element set and only if a user holds adequate elements which are contained in the designated set can he obtains a credential from the server. The key features of DPSBTA include: decentralized trapdoor authentication management, without a trusted authority, conducted in a double threshold manner; privacy preservation, as servers do not know users’ element holdings or credential generation; round-optimal communication, with only two rounds of interaction between users and servers. We present the generic construction, security models, and concrete algorithms with correctness proof. The theoretical proof and the performance evaluations demonstrate the tangible security and high efficacy of the proposed DPSBTA.

A modified CNN-IDS model for enhancing the efficacy of intrusion detection system

As the security of computer networks in enterprises worldwide is dependent on the proper functioning of intrusion detection systems (IDSs) and intrusion prevention systems (IPSs), this effectiveness of both of them is of utmost priority. Leveraging diverse techniques, these network security systems are created to keep the reliability, the availability, and the integrity of the organizational networks safe. One plus point of using ML in intrusion detection system (IDS) is that it has successfully weeded out all the IDS attacks with a high degree of accuracy. In contrast, such systems may be believed to operate to their least competent levels when supersized data spaces have to be dealt with. In the process to solve this, application of feature selection techniques will play the crucial role to ignore non-relevant features which do not impact the issue of classification much. One more thing to keep in mind is that the ML-based IDSs often have problems with high false alarms and percentage accuracy because of the imbalanced training sets. The undertaking of this paper involves a through the analysis of the UNSW-NB15 intrusion detection data set as upon which our models will be tested and trained. We utilize two feature selection approaches: the PCA method, which is denoted as PCA, and the SVD method, called SVD. Furthermore, we categorize the datasets using these methods— Ridge Regression (RR), Stochastic Gradient Descent, and Convolutional Neural Network (CNN)-- on the transformed feature space. What is the most widely used for, is that it deals with both, binary and multiclass classification. The result measure that PCA and SVD are succeeded in getting better performance of IDS than others with enhancing the accuracy of classification models. More specifically, the RR classifier's precise was outstanding for the binary classification problem experiencing a rise in the accuracy from 98.13 % to 99.85 %. This shows the critical role of feature selection approaches and is also demonstrates the modeling capabilities of RR, SGD, and CNN classifiers and stands out as a solution to intrusion detection.

A robust multi-stage intrusion detection system for in-vehicle network security using hierarchical federated learning

As connected and autonomous vehicles proliferate, the Controller Area Network (CAN) bus has become the predominant communication standard for in-vehicle networks due to its speed and efficiency. However, the CAN bus lacks basic security measures such as authentication and encryption, making it highly vulnerable to cyberattacks. To ensure in-vehicle security, intrusion detection systems (IDSs) must detect seen attacks and provide a robust defense against new, unseen attacks while remaining lightweight for practical deployment. Previous work has relied solely on the CAN ID feature or has used traditional machine learning (ML) approaches with manual feature extraction. These approaches overlook other exploitable features, making it challenging to adapt to new unseen attack variants and compromising security. This paper introduces a cutting-edge, novel, lightweight, in-vehicle, IDS-leveraging, deep learning (DL) algorithm to address these limitations. The proposed IDS employs a multi-stage approach: an artificial neural network (ANN) in the first stage to detect seen attacks, and a Long Short-Term Memory (LSTM) autoencoder in the second stage to detect new, unseen attacks. To understand and analyze diverse driving behaviors, update the model with the latest attack patterns, and preserve data privacy, we propose a theoretical framework to deploy our IDS in a hierarchical federated learning (H-FL) environment. Experimental results demonstrate that our IDS achieves an F1-score exceeding 0.99 for seen attacks and exceeding 0.95 for novel attacks, with a detection rate of 99.99%. Additionally, the false alarm rate (FAR) is exceptionally low at 0.016%, minimizing false alarms. Despite using DL algorithms known for their effectiveness in identifying sophisticated and zero-day attacks, the IDS remains lightweight, ensuring its feasibility for real-world deployment. This makes our model robust against seen and unseen attacks.

Enhancing Firewall Packet Classification through Artificial Neural Networks and Synthetic Minority Over-Sampling Technique: An Innovative Approach with Evaluative Comparison

Firewall packet classification is a critical component of network security, demanding precise and reliable methods to ensure optimal functionality. This study introduces an advanced approach that combines Artificial Neural Networks (ANNs) with various data balancing techniques, including the Synthetic Minority Over-sampling Technique (SMOTE), ADASYN, and BorderlineSMOTE, to enhance the classification of firewall packets into four distinct classes: ‘allow’, ‘deny’, ‘drop’, and ‘reset-both’. Initial experiments without data balancing revealed that while the ANN model achieved perfect precision, recall, and F1-Scores for the ‘allow’, ‘deny’, and ‘drop’ classes, it struggled to accurately classify the ‘reset-both’ class. To address this, we applied SMOTE, ADASYN, and BorderlineSMOTE to mitigate class imbalance, which led to significant improvements in overall classification performance. Among the techniques, the ANN combined with BorderlineSMOTE demonstrated superior efficacy, achieving a 97% overall accuracy and consistently high performance across all classes, particularly in the accurate classification of minority classes. In contrast, while SMOTE and ADASYN also improved the model’s performance, the results with BorderlineSMOTE were notably more balanced and reliable. This study provides a comparative analysis with existing machine learning models, highlighting the effectiveness of the proposed approach in firewall packet classification. The synthesized results validate the potential of integrating ANNs with advanced data balancing techniques to enhance the robustness and reliability of network security systems. The findings underscore the importance of addressing class imbalance in machine learning models, particularly in security-critical applications, and offer valuable insights for the design and improvement of future network security infrastructures.

Penerapan Sistem Keamanan Jaringan dengan DNS Adguard ada Linux Debian dan Kontrol Akses Internet Berdasarkan Waktu Implementasi Pada Mikrotik Routerboard

This research aims to develop a network security system with AdGuard DNS on Debian Linux and control time-based internet access using the Microtik Routerboard. The main challenges are rising network security threats and the need for efficient internet access management in a variety of environments, including families,, education, and offices. The aim of this study is to improve network security and efficiency by blocking harmful content and advertisements, ining user privacy, and regulating internet access at a specific time. Technologies used include DNS AdGuard on Debian Linux to strengthen protection against network security threats and RouterOS Microtik devices to manage internet access based on time. These technologies include content filtering features, network traffic distribution (load balancing), and the ability to block unwanted sites to enhance network performance. Research results show that the combination of AdGuard DNS and Microtik Routerboard is an effective solution to enhance network security and efficiency. The system is capable of blocking harmful content and advertising, improving user privacy, and adjusting internet access as needed, thus creating a more secure, controlled, and optimal network.

CNN- based intrusion detection software for network operating system environment

Cybersecurity represents an important challenge specific to digital technology in the modern world, and is of vital importance for reducing or even preventing the impact of cybercrime. The Linux operating system is designed as open-source software that includes some features of software tools intended for network security and cybersecurity systems, such as intruder detection and penetration testing. With these tools in Linux, we need a special system to constantly detect intrusions into connected network devices. This research presents a method for detecting intrusion attacks based on analyzing the natural behavior of the system by building a special convolutional network to achieve this goal. The classification and detection results of the proposed convolutional neural network were compared with the regular machine learning method (SVM), with feature selection by correlation for both methods. Same datasets were used to train and test each of CNN and SVM. Some metrics were determined to evaluate the performance of classification and prediction models for a specific type of regular attacks, DoS and BOT attacks, where both SVM and CNN obtained an accuracy of 85.58% and 95.59%, respectively.

Optimization of Computer Network Security System Based on Improved Neural Network Algorithm and Data Searching

Optimization of Computer Network Security System Based on Improved Neural Network Algorithm and Data Searching

Big data algorithm for computer network information security in the 5G era

Computers play a very important role in today’s life. A large amount of personal information exists in computers, so it is very important to protect the information security on computer networks. The development of information technology has brought a huge impact on human society, and the information security of its computer network has attracted more and more attention. Aiming at the needs of computer network information management in the age of big data, this paper has developed a special computer network information protection system to deal with various threats and constantly improve the protection system. Based on this, the concept and advantages of the 5G network are first expounded, and the management technology of the 5G network is briefly analyzed. Then the information security problems of computer networks in the 5G era are considered, and effective solutions to the information security problems are proposed. Through research and calculation, the new computer network security system can improve network information security by 13.4%.

Enhancing intrusion detection: a hybrid machine and deep learning approach

The volume of data transferred across communication infrastructures has recently increased due to technological advancements in cloud computing, the Internet of Things (IoT), and automobile networks. The network systems transmit diverse and heterogeneous data in dispersed environments as communication technology develops. The communications using these networks and daily interactions depend on network security systems to provide secure and reliable information. On the other hand, attackers have increased their efforts to render systems on networks susceptible. An efficient intrusion detection system is essential since technological advancements embark on new kinds of attacks and security limitations. This paper implements a hybrid model for Intrusion Detection (ID) with Machine Learning (ML) and Deep Learning (DL) techniques to tackle these limitations. The proposed model makes use of Extreme Gradient Boosting (XGBoost) and convolutional neural networks (CNN) for feature extraction and then combines each of these with long short-term memory networks (LSTM) for classification. Four benchmark datasets CIC IDS 2017, UNSW NB15, NSL KDD, and WSN DS were used to train the model for binary and multi-class classification. With the increase in feature dimensions, current intrusion detection systems have trouble identifying new threats due to low test accuracy scores. To narrow down each dataset’s feature space, XGBoost, and CNN feature selection algorithms are used in this work for each separate model. The experimental findings demonstrate a high detection rate and good accuracy with a relatively low False Acceptance Rate (FAR) to prove the usefulness of the proposed hybrid model.

МОДЕЛИРОВАНИЕ НАРУШИТЕЛЯ, ИНФРАСТРУКТУРЫ И АТАК В СИСТЕМАХ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

Formal models of subjects, infrastructure and attacks for information security systems are proposed. The models include descriptions of information security operators, administrators, users and violators, taking into account their knowledge, qualifications and initial conditions. A comprehensive intruder model is presented, including initial knowledge and access rights, initial location, qualifications and goals. Infrastructure models, vulnerabilities, and information collection methods are also considered, which makes it possible to more accurately predict the behavior of violators and develop effective protection strategies. The results of the study show that the proposed models significantly improve the accuracy of risk assessment and security planning, which is especially important for mission-critical information systems. The practical significance lies in the possibility of using models to develop and improve information network security systems. The results of the practical implementation of the model on real data are also presented.

Detection and analysis of network system security based on machine learning

Detection and analysis of network system security based on machine learning

MONITORING ADMINSTRASI JARINGAN DENGAN MIKROTIK DAN TELEGRAM BOT PADA INTERNET SERVICE PROVIDER

Network management using MikroTik devices at Lajur Net still has shortcomings. Although internet access is available around the clock, the limited number of employees makes it difficult for managers to access computers to manage MikroTik. Administrators hope to manage the MikroTik network remotely through end devices. Currently, accessing MikroTik online incurs high operational costs for renting public IPs and web-based management application services. This study aims to utilize Telegram Bot for network management and monitoring that can be accessed remotely via the internet. The use of Telegram Bot for network management at Lajur Net can be successfully implemented. The implementation of Telegram Bot includes managing interfaces, hotspots, ICMP, and monitoring the resources of MikroTik RouterBoard devices in the Lajur Net network. Telegram Bot can be accessed remotely through the internet and works well on the Lajur Net network. The implementation of Telegram Bot includes interface administration, hotspots, ping, and monitoring the resources of MikroTik RouterBoard devices. The additional firewall feature allows network administrators to add and delete filter rules within the Lajur Net network security system. Moreover, Telegram Bot utilizes button features on Telegram messages to facilitate usage without having to type all commands. Thus, Telegram Bot offers an efficient and effective solution in MikroTik network management at Lajur Net, reducing the need for expensive public IPs and web-based management applications. This demonstrates that the use of chatbot technology can provide significant benefits in network administration, especially for internet service providers with limited resources. Through this research, it is hoped that the implementation of Telegram Bot can serve as a reference for developing more innovative and efficient network management in the future.

Pemanfaatan Mikrotik RB942-2ND Menggunakan Metode Firewall Filtering Untuk Keamanan Jaringan Dengan Model Forensikk

Nowadays as demand for fast and effective services increases, global technological and telecommunications developments also increase. Every village office, one of which is Belo Laut, must have an internet network to serve the community in accessing community data, therefore the development of technology and telecommunications is also very important for the government. To create a safe and effective internet network, this network security system uses Mikrotik with the Firewall Filtering method. The research problem is how to design and build network security in the Belo Laut village office area using Mikrotik to prevent the negative impacts of the internet, such as sites with adult content. Layer 7 protocol configuration and Filter Rules are included in blocking. Based on the keywords that have been determined, the test results show that Mikrotik has succeeded in blocking sites or websites that contain adult content.

Anomaly detection in network security systems using machine learning

Anomaly detection in network security systems using machine learning