Network Traffic Attack Research Articles

A Novel Hybrid Convolutional Neural Network- and Gated Recurrent Unit-Based Paradigm for IoT Network Traffic Attack Detection in Smart Cities

Internet of Things (IoT) devices within smart cities, require innovative detection methods. This paper addresses this critical challenge by introducing a deep learning-based approach for the detection of network traffic attacks in IoT ecosystems. Leveraging the Kaggle dataset, our model integrates Convolutional Neural Networks (CNNs) and Gated Recurrent Units (GRUs) to capture both spatial and sequential features in network traffic data. We trained and evaluated our model over ten epochs, achieving an impressive overall accuracy rate of 99%. The classification report reveals the model’s proficiency in distinguishing various attack categories, including ‘Normal’, ‘DoS’ (Denial of Service), ‘Probe’, ‘U2R’ (User to Root), and ‘Sybil’. Additionally, the confusion matrix offers valuable insights into the model’s performance across these attack types. In terms of overall accuracy, our model achieves an impressive accuracy rate of 99% across all attack categories. The weighted- average F1-score is also 99%, showcasing the model’s robust performance in classifying network traffic attacks in IoT devices for smart cities. This advanced architecture exhibits the potential to fortify IoT device security in the complex landscape of smart cities, effectively contributing to the safeguarding of critical infrastructure

Defending against adversarial machine learning attacks using hierarchical learning: A case study on network traffic attack classification

Machine learning is key for automated detection of malicious network activity to ensure that computer networks and organizations are protected against cyber security attacks. Recently, there has been growing interest in the domain of adversarial machine learning, which explores how a machine learning model can be compromised by an adversary, resulting in misclassified output. Whilst to date, most focus has been given to visual domains, the challenge is present in all applications of machine learning where a malicious attacker would want to cause unintended functionality, including cyber security and network traffic analysis. We first present a study on conducting adversarial attacks against a well-trained network traffic classification model. We show how well-crafted adversarial examples can be constructed so that known attack types are misclassified by the model as benign activity. To combat this, we present a novel defensive strategy based on hierarchical learning to help reduce the attack surface that an adversarial example can exploit within the constraints of the parameter space of the intended attack. Our results show that our defensive learning model can withstand crafted adversarial attacks and can achieve classification accuracy in line with our original model when not under attack.

FEW-NNN: A fuzzy entropy weighted natural nearest neighbor method for flow-based network traffic attack detection

Attacks such as APT usually hide communication data in massive legitimate network traffic, and mining structurally complex and latent relationships among flow-based network traffic to detect attacks has become the focus of many initiatives. Effectively analyzing massive network security data with high dimensions for suspicious flow diagnosis is a huge challenge. In addition, the uneven distribution of network traffic does not fully reflect the differences of class sample features, resulting in the low accuracy of attack detection. To solve these problems, a novel approach called the fuzzy entropy weighted natural nearest neighbor (FEW-NNN) method is proposed to enhance the accuracy and efficiency of flowbased network traffic attack detection. First, the FEW-NNN method uses the Fisher score and deep graph feature learning algorithm to remove unimportant features and reduce the data dimension. Then, according to the proposed natural nearest neighbor searching algorithm (NNN_Searching), the density of data points, each class center and the smallest enclosing sphere radius are determined correspondingly. Finally, a fuzzy entropy weighted KNN classification method based on affinity is proposed, which mainly includes the following three steps: 1) the feature weights of samples are calculated based on fuzzy entropy values, 2) the fuzzy memberships of samples are determined based on affinity among samples, and 3) K-neighbors are selected according to the class-conditional weighted Euclidean distance, the fuzzy membership value of the testing sample is calculated based on the membership of k-neighbors, and then all testing samples are classified according to the fuzzy membership value of the samples belonging to each class; that is, the attack type is determined. The method has been applied to the problem of attack detection and validated based on the famous KDD99 and CICIDS-2017 datasets. From the experimental results shown in this paper, it is observed that the FEW-NNN method improves the accuracy and efficiency of flow-based network traffic attack detection.

Visualization of network traffic attack using time series radial axis and cylindrical coordinate system

Visualization of network traffic attack using time series radial axis and cylindrical coordinate system

Wireless Network Intrusion Detection Based on Improved Convolutional Neural Network

The diversification of wireless network traffic attack characteristics has led to the problems what traditional intrusion detection technology with high false positive rate, low detection efficiency, and poor generalization ability. In order to enhance the security and improve the detection ability of malicious intrusion behavior in a wireless network, this paper proposes a wireless network intrusion detection method based on improved convolutional neural network (ICNN). First, the network traffic data is characterized and preprocessed, then modeled the network intrusion traffic data by ICNN. The low-level intrusion traffic data is abstractly represented as advanced features by CNN, which extracted autonomously the sample features, and optimizing network parameters by stochastic gradient descent algorithm to converge the model. Finally, we conducted a sample test to detect the intrusion behavior of the network. The simulation results show that the method proposed in our paper has higher detection accuracy and true positive rate together with a lower false positive rate. The test results on the test set KDDTest + in our paper show that compared with the traditional models, the detection accuracy is 8.82% and 0.51% higher than that of LeNet-5 and DBN, respectively, and the recall rate is 4.24% and 1.16% higher than that of LeNet-5 and RNN, respectively, while the false positive rate is lower than the other three types of models. It also has a big advantage compared to the IDABCNN and NIDMBCNN methods.

Survey on Cloud Based IP Traceback Authentication Framework

IP traceback is used to find network traffic attack. Origin of IP packet is not authenticated. So source of IP address is not trusted. A time limited token based authentication framework for authenticating traceback service queries is implemented. The design objective of the framework is preventing the illegal users for accessing traceback information.Thus to prevent network traffic attack

A Novel DNA Sequence Approach for Network Intrusion Detection System Based on Cryptography Encoding Method

Abstract — A novel method for Network Intrusion Detection System (NIDS) has been proposed, based on the concept of how DNA sequence detects disease as both domains have similar conceptual method of detection. Three important steps have been proposed to apply DNA sequence for NIDS: convert the network traffic data into a form of DNA sequence using Cryptography encoding method; discover patterns of Short Tandem Repeats (STR) sequence for each network traffic attack using Teiresias algorithm; and conduct classification process depends upon STR sequence based on Horspool algorithm. 10% KDD Cup 1999 data set is used for training phase. Correct KDD Cup 1999 data set is used for testing phase to evaluate the proposed method. The current experiment results show that the proposed system has obtained good results and these results are equal to 86.36%, 49.69%, and 77.65% for detection rate, false alarm rate and accuracy respectively. These results are considered as a better result when it is compared with the other previous basic algorithms. It is possible to conclude that DNA sequence has potential for NIDS solution and it has potential improvement using a better encoding method.

Spektral Analysis of Honeypot Network Traffic

Traffic anomalies such as failures and attacks are commonplace in today’s computer networks. Identifying, diagnosing and treating anomalies in a timely fashion are a fundamental part of day to day network operations. In this paper we propose the design of using spectral analysis to study network traffic attack captured by honeypot. As sample attack we used yahoo messenger bots. We use the amount of packet traffic arrival in certain time frame and represent it into time series and spectral form.

선형패턴과 명암 특징을 이용한 네트워크 트래픽의 이상현상 감지

최근 들어, 네트워크 트래픽 공격에 대한 탐지 기술의 필요성이 꾸준히 증가되고 있는 실정이다. 본 논문에서는 네트워크 트래픽 데이터의 헤더파일에서 송신자의 IP와 포트, 그리고 수신자의 IP와 포트 정보를 2차원의 영상으로 시각화하고 분석하여 이상패턴을 효과적으로 분석하는 새로운 방법을 제안한다. 제안된 방법에서는 먼저 송신자와 수신자의 IP 정보를 받아들여 4개의 2차원 영상을 생성하고, 포트 정보를 받아들여 1개의 2차원 영상을 생성한다. 그런 다음, 각 영상 내의 트래픽 데이터를 분석하여 패턴의 주요 특징을 추출하는데, 트래픽의 공격을 나타내는 선형 패턴과 높은 명암값을 가지는 패턴을 추출하여 트래픽의 유형이 정상 트래픽, DDoS, 그리고 DoS인지를 자동으로 검출한다. 성능을 비교 분석하기 위한 실험에서는 제안된 네트워크 트래픽의 이상현상 검출 방법이 기존의 방법에 비해서 보다 우수하다는 것을 보여준다. Recently, the necessity for good techniques of detecting network traffic attack has increased. In this paper, we suggest a new method of detecting abnormal patterns of network traffic data by visualizing their IP and port information into two dimensional images. The proposed approach first generates four 2D images from IP data of transmitters and receivers, and makes one 2D image from port data. Analyzing those images, it then extracts their major features such as linear patterns or high intensity values, and determines if traffic data contain DDoS or DoS Attacks. To comparatively evaluate the performance of the proposed algorithm, we show that our abnormal pattern detection method outperforms the existing algorithm in terms of accuracy and speed.

Applied parallel coordinates for logs and network traffic attack analysis

By looking on how computer security issues are handled today, dealing with numerous and unknown events is not easy. Events need to be normalized, abnormal behaviors must be described and known attacks are usually signatures. Parallel coordinates plot offers a new way to deal with such a vast amount of events and event types: instead of working with an alert system, an image is generated so that issues can be visualized. By simply looking at this image, one can see line patterns with particular color, thickness, frequency, or convergence behavior that gives evidence of subtle data correlation. This paper first starts with the mathematical theory needed to understand the power of such a system and later introduces the Picviz software which implements part of it. Picviz dissects acquired data into a graph description language to make a parallel coordinate picture of it. Its architecture and features are covered with examples of how it can be used to discover security related issues.