Network Traffic Behavior Research Articles

An LDoS attack detection method based on FSWT time–frequency distribution

The Low-rate Denial-of-Service (LDoS) attack is a stealthy and periodic attack, which belongs to the category of DoS attacks. The LDoS attack maliciously preempts and consumes target resources, causing the targeted network performance to decline and affecting the service quality. The LDoS attack is highly destructive and difficult to detect and defend against due to its abnormal attack behavior. In this paper, we discuss the network traffic behavior in the time domain, frequency domain, and time–frequency domain, and we find that the time–frequency domain contains more detailed information than the time domain and frequency domain alone. Considering the limitations of the existing time–frequency domain transformation methods, an LDoS attack detection method based on Frequency Slice Wavelet Transformation (FSWT) is presented in this paper. The entropy, ratio of energy, contrast, and correlation are extracted from the time–frequency distribution to depict the network traffic, and a decision tree is trained to detect the LDoS attack in this paper. According to the experimental results on NS2, testbed, and the comparative experiment, we conclude that the method presented in this paper performs well.

HARNESSING ARTIFICIAL INTELLIGENCE FOR ADVANCED THREAT DETECTION IN NETWORK INFRASTRUCTURES

As cyber threats grow increasingly sophisticated, traditional security measures are falling behind in the face of these evolving attacks. This article highlights the role of Smart Sentinel, a cutting-edge threat detection system that utilizes Artificial Intelligence (AI) to strengthen network defenses. Unlike conventional security solutions, Smart Sentinel employs machine learning algorithms to continuously learn and adapt, enabling it to detect anomalies and potential threats in real-time. By analyzing a variety of data sources, including network traffic and user behavior, the system establishes a baseline of normal activity and continually enhances its threat detection capabilities. Key features such as anomaly detection, behavioral analysis, real-time response, and adaptive learning contribute to an improved security posture, reduced false positives, enhanced operational efficiency, and cost-effectiveness. Smart Sentinel represents a significant breakthrough in cybersecurity, providing organizations with a proactive and resilient defense against the ever-evolving cyber threat landscape. Key features such as anomaly detection, behavioral analysis, real-time response, and adaptive learning contribute to Smart Sentinel’s effectiveness in protecting organizations against cyber threats. Anomaly detection: Smart Sentinel identifies unusual patterns and activities that deviate from established norms, alerting security teams to potential threats. Behavioral analysis: Smart Sentinel goes beyond simply detecting anomalies by analyzing user and system behavior to identify suspicious patterns that may indicate malicious intent. Real-time response: Smart Sentinel’s real-time response capabilities enable it to take immediate action upon detecting a threat, such as isolating compromised systems, blocking malicious IP addresses, or generating alerts for human intervention. Adaptive learning: Through continuous monitoring and analysis, Smart Sentinel continuously learns and improves its ability to discern between normal and malicious activities, reducing false positives and improving overall security posture. Smart Sentinel’s impact on organizations is multifaceted: Enhanced security posture: Smart Sentinel proactively identifies and mitigates emerging threats, strengthening an organization’s overall security posture. Reduced false positives: Smart Sentinel’s adaptive learning capabilities minimize the number of false positives, preventing alert fatigue and allowing security teams to focus on genuine threats. Operational efficiency: Smart Sentinel automates routine tasks, freeing up security teams to focus on strategic initiatives and improve operational efficiency. Cost-effectiveness: Smart Sentinel optimizes cybersecurity investments by automating threat detection and response, reducing the need for costly manual intervention and minimizing the potential for financial losses from successful cyberattacks.

AI Cyber Defense and eBPF

This paper will delve into the integration of Artificial Intelligence (AI) and extended Berkeley Packet Filter (eBPF) technology to enhance cyber defense capability. The most important aspect of AI is detection of threats where it employs sophisticated algorithms in the analysis of large data sets to identify any form of pattern which signals a threat in cyberspace. It enhances behavioral analysis in the monitoring of user and system behavior to identify suspicious activities. AI also helps to instantly react against the threats by automatically taking actions like isolating an infected machine or blocking the suspicious network traffic in order to minimize the response time and consequent damage. AI can predict the attacks based on historical data and current trends and design proactive defense strategies. On the other hand. eBPF technology complements AI by providing programmable kernel tracing, real-time monitoring, low overhead, and security enhancements. Attaching eBPF programs to kernel hooks provides insights into network traffic, system events, and application behavior, intrusion detection, performance monitoring, and troubleshooting. Its implementation is still optimal with less performance impact on the system. The system retains its robust security stance due to the deployment of eBPF, enforcement of kernel-level security policies, and detection of malicious activities. This synergy between AI and eBPF would mean smarter cybersecurity solutions that can change adeptly with each emerging threat and help raise defenses for the organization.

Intrusion Detection System

Our project introduces an Integrated Intrusion Detection System (IDS) designed to bolster network and system security through a multi-faceted approach. This comprehensive IDS seamlessly combined Machine Learning, Anomaly Detection, File Scanning, and DDoS Prevention mechanisms to offer robust defense against diverse cyber threats. At the heart of the system lies the Machine Learning component, which continuously adapts to the evolving threat landscape. By analyzing network traffic and system behavior, it identifies both known and emerging threats in real-time, reducing reliance on traditional signature-based detection methods and allowing organizations to proactively stay ahead of cybercriminals. Anomaly Detection constantly monitors network and system activity, comparing it against established baselines. Any deviations from these baselines trigger alerts, facilitating swift responses to unusual activities that may indicate security breaches. File Scanning is another vital component ensuring data integrity and preventing malware infiltration or data exfiltration. It conducts thorough file analysis, checking for suspicious code, behavior, or unauthorized access, and offers continuous monitoring to detect anomalies in real-time. Additionally, our IDS includes Distributed Denial of Service (DDoS) Prevention mechanisms. By detecting and mitigating DDoS attacks, the system ensures the continuous availability of network resources and services even under intense traffic loads. This integrated approach to intrusion detection and prevention leverages Machine Learning, Honeypots, Anomaly Detection, File Scanning, and DDoS Prevention, empowering organizations to safeguard critical assets, maintain data integrity, and ensure network security in today's dynamic and perilous digital landscape. Our IDS solution serves as a valuable addition to the cybersecurity toolkit for organizations seeking comprehensive security against a wide range of threats.

Evaluation of firewall performance metrics with ranging the rules for Poisson incoming packet flow and exponential filtering time

The given article is a continuation of a number of works devoted to the development of models and methods for ranging the filtration rules to prevent a decrease in the firewall performance caused by the use of a sequential scheme for checking packet compliance with the rules, as well as by the heterogeneity and variability of network traffic. The article includes a description of a firewall mathematical model given in the form of a complex system and a queuing system with a phase-type discipline for request servicing, which formalizes the network traffic filtering process with the functionality of ranging the rules. The purpose of modeling is to obtain estimates for major firewall performance metrics for various network traffic behavior scenarios, as well as to evaluate an increase in the firewall performance due to ranging a filtration rule set. Calculation of estimates for the firewall (FW) performance metrics was made using the analytical method for a Poisson request flow. Based on the analysis of the modeling results, conclusions were drawn on the effectiveness of ranging the filtration rules in order to improve the firewall performance for traffic scenarios that are close to real ones.

Ensemble-Based Deep Learning Models for Enhancing IoT Intrusion Detection

Cybersecurity finds widespread applications across diverse domains, encompassing intelligent industrial systems, residential environments, personal gadgets, and automobiles. This has spurred groundbreaking advancements while concurrently posing persistent challenges in addressing security concerns tied to IoT devices. IoT intrusion detection involves using sophisticated techniques, including deep learning models such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and anomaly detection algorithms, to identify unauthorized or malicious activities within IoT ecosystems. These systems continuously monitor and analyze network traffic and device behavior, seeking patterns that deviate from established norms. When anomalies are detected, security measures are triggered to thwart potential threats. IoT intrusion detection is vital for safeguarding data integrity, ensuring users’ privacy, and maintaining critical systems’ reliability and safety. As the IoT landscape evolves, effective intrusion detection mechanisms become increasingly essential to mitigate the ever-growing spectrum of cyber threats. Practical security approaches, notably deep learning-based intrusion detection, have been introduced to tackle these issues. This study utilizes deep learning models, including convolutional neural networks (CNNs), long short-term memory (LSTM), and gated recurrent units (GRUs), while introducing an ensemble deep learning architectural framework that integrates a voting policy within the model’s structure, thereby facilitating the computation and learning of hierarchical patterns. In our analysis, we compared the performance of ensemble deep learning classifiers with traditional deep learning techniques. The standout models were CNN-LSTM and CNN-GRU, achieving impressive accuracies of 99.7% and 99.6%, along with exceptional F1-scores of 0.998 and 0.997, respectively.

Cyberpsychology: A Longitudinal Analysis of Cyber Adversarial Tactics and Techniques

The rapid proliferation of cyberthreats necessitates a robust understanding of their evolution and associated tactics, as found in this study. A longitudinal analysis of these threats was conducted, utilizing a six-year data set obtained from a deception network, which emphasized its significance in the study’s primary aim: the exhaustive exploration of the tactics and strategies utilized by cybercriminals and how these tactics and techniques evolved in sophistication and target specificity over time. Different cyberattack instances were dissected and interpreted, with the patterns behind target selection shown. The focus was on unveiling patterns behind target selection and highlighting recurring techniques and emerging trends. The study’s methodological design incorporated data preprocessing, exploratory data analysis, clustering and anomaly detection, temporal analysis, and cross-referencing. The validation process underscored the reliability and robustness of the findings, providing evidence of increasingly sophisticated, targeted cyberattacks. The work identified three distinct network traffic behavior clusters and temporal attack patterns. A validated scoring mechanism provided a benchmark for network anomalies, applicable for predictive analysis and facilitating comparative study of network behaviors. This benchmarking aids organizations in proactively identifying and responding to potential threats. The study significantly contributed to the cybersecurity discourse, offering insights that could guide the development of more effective defense strategies. The need for further investigation into the nature of detected anomalies was acknowledged, advocating for continuous research and proactive defense strategies in the face of the constantly evolving landscape of cyberthreats.

Federated learning for reliable model updates in network-based intrusion detection

Machine Learning techniques for network-based intrusion detection are widely adopted in the scientific literature. Besides being highly variable, network traffic behavior changes over time, demanding proposed schemes to be periodically updated to ensure their reliability. Unfortunately, their efficiency is significantly limited in production environments. This paper proposes a new Federated Learning model for reliable network-based intrusion detection with highly confident model updates over time. Our proposed scheme assesses the classification reliability in an unsupervised fashion and rejects potential misclassifications even when outdated. In addition, it significantly eases the model update cost by conducting it in a Federated Learning rationale. To evaluate the effectiveness of our solution, we conduct an experimental campaign with a new dataset, MAWIFlow, with over 7 TB of real network traffic spanning a year. The achieved results of our proposed model are striking. It respectively improves the average false-positive and false-negative rates by up to 12% and 9.6% when no model updates are conducted. If done so, it can further improve the false-positive rate by up to 13% while rejecting only 3.6% of events and demanding only 0.3% of events for model updates. Further, the comparison against the traditional Federated Learning approach confirms our model's remarkable performance in several scenarios. Finally, the quality and viability of our solution do prove that our approach can be successfully adopted for improving the accuracy and efficiency of classification systems in real-world scenarios where outdated models are prevalent and pave the way for future research in the area.

An efficient trust-based decision-making approach for WSNs: Machine learning oriented approach

Wireless Sensor Networks (WSNs) are often used for critical applications where trust and security are of paramount importance. Trust evaluation is one of the key mechanisms to ensure the security and reliability of WSNs. Traditional trust evaluation schemes rely on fixed, predetermined thresholds, or rules and static attack models, which may not be suitable for all situations such as dynamic and heterogeneous network environments with new and unknown attack scenarios as well as have several problems such as limited security and scalability, limited accuracy, incomplete coverage, lack of adaptability that can limit their effectiveness. Machine Learning (ML) has been shown to be an effective tool for trust evaluation in WSNs, offering several benefits over existing schemes such as greater adaptability, scalability, and accuracy since ML algorithms can analyze and learn from the data collected in real-time from multiple sources (sensor readings, network traffic, and user behavior) enabling them to dynamically adjust their decision-making criteria based on the current network conditions. Trust-aware ML-based security mechanisms achieve safety and efficient decision-making by reducing uncertainty and risk to accomplish real-world tasks. This paper presents a Machine Learning (ML)-based trust evaluation model in the unattended autonomous WSN environment to achieve reliability, adaptability, scalability, and accuracy by generating quick and reliable trust values dynamically. The proposed machine learning algorithm extracts various trust features such as Co-Location Relationship (CLR), Co-Work Relationship (CWR), Cooperativeness-Frequency-Duration (CFD), and Reward (R) to obtain a robust trust rating of sensor devices and predict future misbehavior. These trust features are combined to generate a final trust rating before making any decision about the reliability of any sensor device. Moreover, the projected trust model (ETDMA) integrate direct communication trust and indirect trust with the help of a logical time window that periodically records the trustworthy and suspicious interactions. Simulation experiments exhibit the effectiveness of the proposed trust evaluation method in terms of change in trust values, malicious nodes detection (94%), FNR (0.9%), F1-Score (0.6), and accuracy (92%) in the presence of 50 malicious nodes.

Reinforcement Learning for Intrusion Detection: More Model Longness and Fewer Updates

Several works have used machine learning techniques for network-based intrusion detection over the past few years. While proposed schemes have been able to provide high detection accuracies, they do not adequately handle the changes in network traffic behavior as time passes. Researchers often assume that model updates can be performed periodically as needed, although this is not easily feasible in real-world scenarios. This paper proposes a new intrusion detection model based on a reinforcement learning approach that aims to support extended periods without model updates. The proposal is divided into two strategies. First, it applies machine learning scheme as a reinforcement learning task to long-term learning -maintaining high reliability and high classification accuracies over time. Second, model updates are performed using a transfer learning technique coped with a sliding window mechanism that significantly decreases the need for computational resources and human intervention. Experiments performed using a new dataset spanning 8TB of data and four years of real network traffic indicate that current approaches in the literature cannot handle the evolving behavior of network traffic. Nevertheless, the proposed technique without periodic model updates achieves similar accuracy rates to traditional detection schemes implemented with semestral updates. In the case of performing periodic updates on our proposed model, it decreases the false positives up to 8%, false negatives up to 34%, with an accuracy variation up to only 6%, while demanding only seven days of training data and almost five times fewer computational resources when compared to traditional approaches.

An Efficient Spam Detection Technique for IOT Devices using Machine Learning

Internet of Things (IoT) devices is becoming increasingly popular, and as their usage grows, so does the risk of spam and malicious attacks on these devices. Spam detection is one of the primary concerns for securing IoT devices, and machine learning has shown great potential in addressing this issue. In this abstract, we will discuss the use of machine learning algorithms for spam detection in IoT devices. The proposed solution involves collecting data from IoT devices, such as sensor readings, network traffic, and user behavior, and then training a machine learning model on this data. The model can be trained on both known and unknown spam patterns, allowing it to identify and classify potential spam messages with a high level of accuracy. Several machine learning algorithms can be used for spam detection, including decision trees, support vector machines (SVMs), and neural networks. These algorithms can be trained on different features of the data, such as the frequency of certain keywords or the source of the message, to identify patterns that are indicative of spam. To ensure the effectiveness of the spam detection system, it is essential to continuously update the machine learning model as new types of spam are discovered. This can be achieved by deploying the model in the cloud, allowing it to learn from new data and improve its accuracy over time. Using machine learning algorithms for spam detection in IoT devices can greatly enhance the security of these devices. By training a model on data collected from IoT devices, we can accurately detect and classify potential spam, allowing us to take appropriate action to protect these devices from malicious attacks.

Anomaly-based intrusion detection system for IoT application

Internet-of-Things (IoT) connects various physical objects through the Internet and it has a wide application, such as in transportation, military, healthcare, agriculture, and many more. Those applications are increasingly popular because they address real-time problems. In contrast, the use of transmission and communication protocols has raised serious security concerns for IoT devices, and traditional methods such as signature and rule-based methods are inefficient for securing these devices. Hence, identifying network traffic behavior and mitigating cyber attacks are important in IoT to provide guaranteed network security. Therefore, we develop an Intrusion Detection System (IDS) based on a deep learning model called Pearson-Correlation Coefficient - Convolutional Neural Networks (PCC-CNN) to detect network anomalies. The PCC-CNN model combines the important features obtained from the linear-based extractions followed by the Convolutional Neural Network. It performs a binary classification for anomaly detection and also a multiclass classification for various types of attacks. The model is evaluated on three publicly available datasets: NSL-KDD, CICIDS-2017, and IOTID20. We first train and test five different (Logistic Regression, Linear Discriminant Analysis, K Nearest Neighbour, Classification and Regression Tree,& Support Vector Machine) PCC-based Machine Learning models to evaluate the model performance. We achieve the best similar accuracy from the KNN and CART model of 98%, 99%, and 98%, respectively, on the three datasets. On the other hand, we achieve a promising performance with a better detection accuracy of 99.89% and with a low misclassification rate of 0.001 with our proposed PCC-CNN model. The integrated model is promising, with a misclassification rate (or False alarm rate) of 0.02, 0.02, and 0.00 with Binary and Multiclass intrusion detection classifiers. Finally, we compare and discuss our PCC-CNN model in comparison to five traditional PCC-ML models. Our proposed Deep Learning (DL)-based IDS outperforms traditional methods.

EIDM: deep learning model for IoT intrusion detection systems

Internet of Things (IoT) is a disruptive technology for the future decades. Due to its pervasive growth, it is susceptible to cyber-attacks, and hence the significance of Intrusion Detection Systems (IDSs) for IoT is pertinent. The viability of machine learning has encouraged analysts to apply learning techniques to intelligently discover and recognize cyber attacks and unusual behavior among the IoTs. This paper proposes an enhanced anomaly-based Intrusion Detection Deep learning Multi-class classification model (EIDM) that can classify 15 traffic behaviors including 14 attack types with the accuracy of 95% contained in the CICIDS2017 dataset. Four state-of-the-art deep learning models are also customized to classify six classes of network traffic behavior. An extensive comparative study in terms of classification accuracy and efficiency metrics is conducted between EIDM and several state-of-the-art deep learning-based IDSs showing that EIDM has achieved accurate detection results.

Flow Topology-Based Graph Convolutional Network for Intrusion Detection in Label-Limited IoT Networks

Given the distributed nature of the massively connected “Things” in IoT, IoT networks have been a primary target for cyberattacks. Although machine learning based network intrusion detection systems (NIDS) can effectively detect abnormal network traffic behaviors, most existing approaches are based on a large amount of labeled traffic flow data, which hinders their implementation in the highly dynamic IoT networks with limited labeling. In this paper, we develop a novel Flow Topology based Graph Convolutional Network (FT-GCN) approach for label-limited IoT network intrusion detection. Our main idea is to leverage the underlying traffic flow patterns, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$i.e.$ </tex-math></inline-formula> , the flow topological structure, to unlock the full potential of the traffic flow data with limited labeling, where the FT-GCN will be deployed at the edge servers in IoT networks to detect intrusions via software defined network technologies. Specifically, FT-GCN first takes the time correlation of traffic flows into account to construct an interval-constrained traffic graph (ICTG). Besides, a Node-Level Spatial (NLS) attention mechanism is designed to further enhance the key statistical features of traffic flows in ICTG. Finally, the combined representation of statistical flow features and flow topological structure are learned by the cost-effective Topology Adaptive Graph Convolutional Networks (TAGCN) for intrusion identification in IoT networks. Extensive experiments are conducted on three real-world datasets, which demonstrate the effectiveness of the proposed FT-GCN compared to state-of-the-art approaches.

Securing Information Management in Collaborative Environments Using Machine Learning

Recently, there has been a significant increase in the use of collaborative environments for managing and sharing information. However, these environments often present significant security risks due to the potential for unauthorized access, data leakage, and other security breaches. To address these risks, machine learning (ML) techniques have been increasingly used to secure information management in collaborative environments. We propose a novel ML approach to be applied to detect and prevent security threats in collaborative environments. Our approach integrates temporal convolution to detect and prevent security threats by analyzing spatial-temporal patterns in data from various sources, such as network traffic, system logs, and user behavior. Furthermore, we present a case study demonstrating the effectiveness of our model in securing collaborative information management. The case study involves the development of our system for detecting insider threats in a collaborative environment. Extensive experimentation on this case study demonstrates the efficiency and effectiveness of the proposed system for securing information management and promoting further developments.

Cyberattacks Detection Through Behavior Analysis of Internet Traffic

Network intrusion detection systems (NIDS) are actually used to detect suspicious activities such as viruses, shellcode, XSS, CSRF, worms, etc. There are two types of the NIDS: signature-based and anomaly-based. Recently, Deep Learning have emerged as promising techniques for classifying network attacks. In this paper, we propose a method to analyze the network traffic behavior through Deep Learning classification techniques using traffic features. The results indicate that Multi-Layer Perceptron (MLP) and Convolutional Neural Network (CNN) techniques achieved similar performance with 94% accuracy when using all features in the used dataset. However, with the use of feature selection techniques such as XGBoost, Pearson correlation, and mutual information, the models achieved a slightly lower accuracy of 91%, but these results demonstrate the effectiveness of feature selection methods in enhancing the performance of Deep Learning models by reducing complexity and removing irrelevant features.

Human Behavior-Based Mobility Models in Mobile Wireless Networks: a Literature Survey

Recent advancement in processing power, mobile wireless networks enabled technology are leading to more researches and studies, investigating mobility prediction in wireless network environments. User mobility behavior knowledge is a key element to understand the network traffic behavior in today mobile applications, including context-aware advertising and city wide sensing applications. We extend our previous work that was dedicated to mobility prediction schemes, in order to cover a correlated research topic: study of the user mobility behavior.

Comparative Analysis of Several Anomaly Detection Algorithm with its Impact Towards the Security and its Performance

Anomaly detection in network traffic is a promising and effective technique to enhance network security. In addition to traditional statistical analysis and rule-based detection techniques, machine learning models are introduced for intelligent detection of abnormal traffic data. A Denial of Service (DoS) attack is a malicious effort to keep endorsed users of a website or web service from accessing it, or limiting their ability to do so. A Distributed Denial of Service (DDoS) attack is a type of DoS attack in which many computers are used to cripple a web page, website or web based service. Fault either in users’ implementation of a network or in the standard specification of protocols has resulted in gaps that allow various kinds of network attack to be launched of the type of network attacks, denial-of-service flood attacks have reason the most severe impact. This analysis study on flood attacks and Flash Crowd their improvement, classifying such attacks as either high-rate flood or low-rate flood. Finally, the attacks are appraised against principle related to their characteristics, technique and collision. This paper discusses a statistical approach to analysis the distribution of network traffic to recognize the normal network traffic behavior. This paper also discusses a various method to recognize anomalies in network traffic.

FlowSpectrum: a concrete characterization scheme of network traffic behavior for anomaly detection

FlowSpectrum: a concrete characterization scheme of network traffic behavior for anomaly detection

Syrius: Synthesis of Rules for Intrusion Detectors

Network intrusion detection systems (NIDS) are popular tools to defend local networks against attacks. These systems monitor the network traffic and flag suspicious behavior. Rule-based NIDS do that by checking the network traffic against a set of rules, which become obsolete as attackers learn new strategies to circumvent existing defenses. This article proposes <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">sy</b> nthesis of su <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">ri</b> cata r <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">u</b> le <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">s</b> ( <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Syrius</small> ), a novel approach to synthesize rules for rule-based NIDS. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Syrius</small> leverages malicious (positive) and benign (negative) traffic to create rules for new attacks. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Syrius</small> is organized as a pipeline of three components to 1) create an overspecified seed rule, 2) derive plausible rules from the seed, and 3) rank plausible rules. We evaluated <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Syrius</small> against a set of 21 network attacks with various characteristics. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Syrius</small> was capable of generating the correct rule among the top-3 and top-1 rules of the ranking, respectively, in 80.1% and 47.6% of the cases.