Network Traffic Data Research Articles

The detailed investigation paper on network invasion awareness

Intrusion detection is critical for network security, with deep learning-based algorithms gaining traction. This project introduces NIDS - CNNLSTM, a model designed for the Industrial Internet of Things wireless sensing environment. It effectively identifies network traffic data, ensuring Industrial Internet of Things equipment and operations remain secure. Trained on the NSL_KDD data set, it exhibits strong convergence and performance across three data set, accurately classifying traffic types. Comparative analysis underscores NIDS - CNNLSTM efficacy enhancements. Experimental results validate increased detection rates, classification accuracy, and reduced false alarms, making it suitable for Industrial Internet of Things varied network data scenarios.

Advanced machine learning approach for DoS attack resilience in internet of vehicles security

Recent years have witnessed security as a great concern in vehicular networks (VANET). Particularly, Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks can jeopardize the network by broadcasting a storm of packets. Correspondingly, the network resources are jammed with malicious traffic. In this connection, the existing research presented various techniques to cope with DoS and DDoS attacks. Different from those traditional approaches, this study proposes an Intelligent Intrusion Detection System (IDS) by leveraging Machine Learning (ML). The proposed IDS utilizes a publicly available dataset on the application layer for mitigating DDoS attacks. The designed ML-based IDS relies on combining both the Random Projection (RP) and Randomized Matrix Factorization (RMF) methods to achieve the best results for enhancing the detection capabilities of the IDS. This amalgamation enhances the system's detection capabilities by extracting and analyzing meaningful features from network traffic data. Experimental validation of our approach involves a comprehensive evaluation of various ML models, including Extra Tree Classifier (ETC), Logistic Regression (LR), and Random Forest (RF). Remarkably, the combined accuracy of these models yields an average system accuracy of 0.98, surpassing existing methods. Unlike conventional approaches, our proposed IDS excels in efficiency and exhibits notable performance in detecting DoS and DDoS attacks in VANET. This proficiency ensures the integrity and safety of vehicle communications. Thus, our research substantially contributes to the vehicular network security field. The presented findings establish a foundation for future advancements in securing connected vehicles.

Using the method of nonlinear recursive analysis for detecting DDOS anoma-lies in time series data

This research endeavors to address this gap by determining a qualitative char-acteristic for server network traffic and use it to construct the corresponding recur-rence plot (RP). The goal of this study is to develop and assess a novel technique based on nonlinear recursive analysis to detect Distributed Denial of Service (DDoS) anomalies in network traffic time series data. With the increasing frequency of DDoS attacks on modern digital infrastructures, there is a pressing need for more efficient and accurate detection methods. There has been some attempts to apply nonlinear analysis to network traffic [2-4], but those studies lack critical steps in determining parameters for embedding space dimension and delay time . More recent studies have explored machine learning and deep learning approaches [7], which offer improved accuracy but can be computationally intensive and require extensive training data. Despite the advance-ments, there remains a need for a method that is both accurate and efficient, espe-cially in real-time detection scenarios. The researchers employed nonlinear recursive analysis by estimating RQA pa-rameters and determining a qualitative characteristic of data points of DDoS attack contained in CIC-IDS2017 dataset. A technique for determining hidden information for this series and its use for constructing the corresponding recurrence diagram (RP) at the points of information retrieval are described. It is shown that the use of RP has significant drawbacks associated with the visualization of information on a computer monitor screen, so another way of research is proposed - the calculation of numerical indicators of RP The given calculated RP indicators made it possible to typify the received data and determine the type, which was named "DDOS-RP", which makes it possible to distinguish some types of DoS/DDoS type attacks. The study concludes by recom-mending further exploration of this method in diverse network environments and against more complex DDoS attack patterns.

Evaluating the Impact of Different Feature as a Counter Data Aggregation approaches on the Performance of NIDSs and Their Selected Features

Abstract There is much effort nowadays to protect communication networks against different cybersecurity attacks (which are more and more sophisticated) that look for systems’ vulnerabilities they could exploit for malicious purposes. Network Intrusion Detection Systems (NIDSs) are popular tools to detect and classify such attacks, most of them based on ML models. However, ML-based NIDSs cannot be trained by feeding them with network traffic data as it is. Thus, a Feature Engineering (FE) process plays a crucial role transforming network traffic raw data onto derived one suitable for ML models. In this work, we study the effects of applying one such FE technique in different ways on the performance of two ML models (linear and non-linear) and their selected features. This the Feature as a Counter approach. The derived observations are computed from either with the same number of raw samples, (batch-based approaches) or by aggregating them by time intervals (timestamp-based approach). Results show that there is no significant differences between the proposed approaches neither in the performance of the models nor in the selected features that validate our proposal making it feasible to be widely used as a standard FE method.

IoT-Based Intrusion Detection System Using New Hybrid Deep Learning Algorithm

The most significant threat that networks established in IoT may encounter is cyber attacks. The most commonly encountered attacks among these threats are DDoS attacks. After attacks, the communication traffic of the network can be disrupted, and the energy of sensor nodes can quickly deplete. Therefore, the detection of occurring attacks is of great importance. Considering numerous sensor nodes in the established network, analyzing the network traffic data through traditional methods can become impossible. Analyzing this network traffic in a big data environment is necessary. This study aims to analyze the obtained network traffic dataset in a big data environment and detect attacks in the network using a deep learning algorithm. This study is conducted using PySpark with Apache Spark in the Google Colaboratory (Colab) environment. Keras and Scikit-Learn libraries are utilized in the study. ‘CICIoT2023’ and ‘TON_IoT’ datasets are used for training and testing the model. The features in the datasets are reduced using the correlation method, ensuring the inclusion of significant features in the tests. A hybrid deep learning algorithm is designed using one-dimensional CNN and LSTM. The developed method was compared with ten machine learning and deep learning algorithms. The model’s performance was evaluated using accuracy, precision, recall, and F1 parameters. Following the study, an accuracy rate of 99.995% for binary classification and 99.96% for multiclassification is achieved in the ‘CICIoT2023’ dataset. In the ‘TON_IoT’ dataset, a binary classification success rate of 98.75% is reached.

A Comparative Review on DDoS Attack Detection Using Machine Learning Techniques

The rapid growth of the internet and the increasing reliance on digital infrastructures have posed significant challenges to cybersecurity. Among the other variants of attacks, Distributed Denial of Service (DDoS) attacks have emerged as one of the most destructive and common threats. These attacks disrupt or slow down network services by overwhelming the network infrastructure with a massive volume of malicious traffic. To effectively identify and mitigate DDoS attacks, machine learning techniques have been extensively employed in intrusion detection systems. Machine learning approaches offer the advantage of automating the detection process by learning patterns and characteristics of DDoS attacks from historical data. Researchers have explored various machine learning algorithms such as K-Nearest Neighbours (KNN), Support Vector Machine (SVM), Random Forest (RF), and Naïve Bayes to classify and detect DDoS attacks. These algorithms leverage features extracted from network traffic data, including packet size, packet delay patterns, and traffic behaviour, to differentiate between normal and malicious traffic.

Research on the Simulation Method of HTTP Traffic Based on GAN

Due to the increasing severity of network security issues, training corresponding detection models requires large datasets. In this work, we propose a novel method based on generative adversarial networks to synthesize network data traffic. We introduced a network traffic data normalization method based on Gaussian mixture models (GMM), and for the first time, incorporated a generator based on the Swin Transformer structure into the field of network traffic generation. To further enhance the robustness of the model, we mapped real data through an AE (autoencoder) module and optimized the training results in the form of evolutionary algorithms. We validated the training results on four different datasets and introduced four additional models for comparative experiments in the experimental evaluation section. Our proposed SEGAN outperformed other state-of-the-art network traffic emulation methods.

A ROBUST DETECTION OF CYBER INCIDENTS UTILIZING MACHINE LEARNING TECHNIQUES

A reliable Cyber Attack Detection Model (CADM) is a system that works as safeguard for the users of modern technological devices and assistant for the operators of networks. The research paper aims to develop a CADM for analyzing the network data patterns to classify cyber-attacks. CADM finds out attack wise detection accuracy using ensemble classification method. LASSO has been used to extract important features. It can work with large datasets, and it has more visualization capability. Gradient Boosting and Random Forest algorithms have been used for classification of network traffic data to build an ensemble method. Gradient Boosting algorithm trains weak learning models and select the best decision trees to deliver more improved prediction accuracy and Random Forest algorithm trains each tree in parallel manner. In this research work, Jive datasets such as NSL-KDD, KDD Cup 99, UNSWNB15, URL 2016 and CICIDS 2017 are also applied to check the efficiency of the proposed model.

A ROBUST DETECTION OF CYBER INCIDENTS UTILIZING MACHINE LEARNING TECHNIQUES

A reliable Cyber Attack Detection Model (CADM) is a system that works as safeguard for the users of modern technological devices and assistant for the operators of networks. The research paper aims to develop a CADM for analyzing the network data patterns to classify cyber-attacks. CADM finds out attack wise detection accuracy using ensemble classification method. LASSO has been used to extract important features. It can work with large datasets, and it has more visualization capability. Gradient Boosting and Random Forest algorithms have been used for classification of network traffic data to build an ensemble method. Gradient Boosting algorithm trains weak learning models and select the best decision trees to deliver more improved prediction accuracy and Random Forest algorithm trains each tree in parallel manner. In this research work, Jive datasets such as NSL-KDD, KDD Cup 99, UNSWNB15, URL 2016 and CICIDS 2017 are also applied to check the efficiency of the proposed model.

TV-ADS: A Smarter Attack Detection Scheme Based on Traffic Visualization of Wireless Network Event Cell

<p>To protect the increasing cyberspace assets, attack detection systems (ADSs) as well as intrusion detection systems (IDSs) have been equipped in various network environments. Recently, with the development of big data, machine learning, deep learning, neural networks and other artificial intelligence (AI) technologies, more and more ADSs/IDSs based on Artificial Intelligence are presented in academia and industry. Particularly, depending on the outstanding performance and efficiency in recognizing and classifying images, computer vision algorithms have been employed to detect malicious software and malicious traffic. However, we found that in wireless networks, the results vary significantly depending on the mapping methods used to transform the original network traffic data into visual images. Therefore, in this paper, we propose an AI-based attack detection scheme (TV-ADS) by introducing a novel traffic-image mapping method, which segments the sequential network traffic into individual event cells and transforms variant images to a uniform standard size, and design a CNN model to recognize normal and malicious traffics with these visible network event images. Finally, the results of our experiments on the AWID3 dataset demonstrate that our TV-ADS outperforms the existing schemes in terms of accuracy, precision, recall, F1-score and efficiency.</p> <p> </p>

Network traffic prediction with Attention-based Spatial–Temporal Graph Network

Network traffic prediction plays a significant role in network management. Previous network traffic prediction methods mainly focus on the temporal relationship between network traffic, and used time series models to predict network traffic, ignoring the spatial information contained in traffic data. Therefore, the prediction accuracy is limited, especially in long-term prediction. To improve the prediction accuracy of the dynamic network traffic in the long term, we propose an Attention-based Spatial–Temporal Graph Network (ASTGN) model for network traffic prediction to better capture both the temporal and spatial relations between the network traffic. Specifically, in ASTGN, we exploit an encoder–decoder architecture, where the encoder encodes the input network traffic and the decoder outputs the predicted network traffic sequences, integrating the temporal and spatial information of the network traffic data through the Spatio-Temporal Embedding module. The experimental results demonstrate the superiority of our proposed method ASTGN in long-term prediction.

Comparing Metaheuristic Search Techniques in Addressing the Effectiveness of Clustering-Based DDoS Attack Detection Methods

Distributed Denial of Service (DDoS) attacks have increased in frequency and sophistication over the last ten years. Part of the challenge of defending against such attacks requires the analysis of very large volumes of data. Metaheuristic algorithms can assist in selecting relevant features from the network traffic data for use in DDoS detection models. By efficiently exploring different combinations of features, these methods can identify subsets that are informative for distinguishing between normal and attack traffic. However, identifying an optimized solution in this area is an open research question. Tuning the parameters of metaheuristic search techniques in the optimization process is critical. In this study, a switching approximation is used in a variety of metaheuristic search techniques. This approximation is used to find the best solution for the analysis of the network traffic features in either lower or upper values between 0 and 1. We compare the fine-tuning of this parameter against standard approaches and find that it is not substantially better than the BestFirst algorithm (a standard default approach for feature selection). This study contributes to the literature by testing and eliminating various fine-tuning strategies for the metaheuristic approach.

Boosting robustness of network intrusion detection systems: A novel two phase defense strategy against untargeted white-box optimization adversarial attack

Machine Learning and Deep Learning based Network Intrusion Detection Systems (NIDS) serve as the backbone to protect computer networks against various cyber security threats. However, their susceptibility to adversarial attacks is the biggest challenge in front of the security administrator. In adversarial machine learning, the attacker crafts adversarial examples by adding small perturbations (tiny noise) in benign and legitimate network traffic data. These adversarial examples can easily deceive machine learning-based NIDS into producing incorrect classification and evading intrusion detection. This necessitates a robust NIDS that can detect and mitigate adversarial attacks immediately. In this research, we have proposed the two-phase defence method against the most powerful optimization-based adversarial attack, Carlini & Wagner (C&W). The two defence phases are the training and testing phase. In the training phase, we have used modified adversarial training using Gaussian Data Augmentation (GDA). In the testing phase, we have applied the Feature Squeezing (FS) method over the generated adversarial list before passing it to the robust NIDS model for final classification. The latest CIC-DDoS-2019 dataset is used to evaluate the proposed two-phase defence method effectively in terms of classification reports and confusion metrics. This research provides a comprehensive perspective of adversarial machine learning, its broad classification, and its defence approaches. The potential of the proposed research is not just limited to computer security. In fact, it can be adopted in other research domains, such as video analytics and surveillance systems.

Implementing AI-Driven Intrusion Detection System with Python and Light Connect Object

The escalating number of cybersecurity threats poses significant challenges for ensuring the security of networked systems. Intrusion Detection Systems (IDS) play a vital role in detecting and preventing malicious activities. This paper focuses on the implementation of an AI-driven IDS using Python and Light Connect Object (LCO) to enhance the detection capabilities and improve the overall security of networked systems. By integrating AI techniques into the IDS framework, we aim to effectively identify both known and unknown attacks. The proposed system is evaluated using real- world network traffic data, and its performance is measured using metrics such as detection accuracy and false positive rate. The results demonstrate the effectiveness and practicality of the AI-driven IDS in enhancing network security

Discriminative spatial-temporal feature learning for modeling network intrusion detection systems

Increasing interest and advancement of internet and communication technologies have made network security rise as a vibrant research domain. Network intrusion detection systems (NIDSs) have developed as indispensable defense mechanisms in cybersecurity that are employed in discovery and prevention of malicious network activities. In the recent years, researchers have proposed deep learning approaches in the development of NIDSs owing to their ability to extract better representations from large corpus of data. In the literature, convolutional neural network architecture is extensively used for spatial feature learning, while the long short term memory networks are employed to learn temporal features. In this paper, a novel hybrid method that learn the discriminative spatial and temporal features from the network flow is proposed for detecting network intrusions. A two dimensional convolution neural network is proposed to intelligently extract the spatial characteristics whereas a bi-directional long short term memory is used to extract temporal features of network traffic data samples consequently, forming a deep hybrid neural network architecture for identification and classification of network intrusion samples. Extensive experimental evaluations were performed on two well-known benchmarks datasets: CIC-IDS 2017 and the NSL-KDD datasets. The proposed network model demonstrated state-of-the-art performance with experimental results showing that the accuracy and precision scores of the intrusion detection model are significantly better than those of other existing models. These results depicts the applicability of the proposed model in the spatial-temporal feature learning in network intrusion detection systems.

Enhanced Intrusion Detection Systems Performance with UNSW-NB15 Data Analysis

The rapid proliferation of new technologies such as Internet of Things (IoT), cloud computing, virtualization, and smart devices has led to a massive annual production of over 400 zettabytes of network traffic data. As a result, it is crucial for companies to implement robust cybersecurity measures to safeguard sensitive data from intrusion, which can lead to significant financial losses. Existing intrusion detection systems (IDS) require further enhancements to reduce false positives as well as enhance overall accuracy. To minimize security risks, data analytics and machine learning can be utilized to create data-driven recommendations and decisions based on the input data. This study focuses on developing machine learning models that can identify cyber-attacks and enhance IDS system performance. This paper employed logistic regression, support vector machine, decision tree, and random forest algorithms on the UNSW-NB15 network traffic dataset, utilizing in-depth exploratory data analysis, and feature selection using correlation analysis and random sampling to compare model accuracy and effectiveness. The performance and confusion matrix results indicate that the Random Forest model is the best option for identifying cyber-attacks, with a remarkable F1 score of 97.80%, accuracy of 98.63%, and low false alarm rate of 1.36%, and thus should be considered to improve IDS system security.

DDOS Attacks Detection via Deep Learning Approaches

Abstract: The proliferation of Distributed Denial of Service (DDoS) attacks presents a pressing challenge to network security. Conventional rule-based detection methods are increasingly inadequate against the evolving tactics employed by cyber adversaries. This journal proposes a novel approach integrating Support Vector Machines (SVM) into advanced machine learning architectures for fortified DDoS detection. The research methodology initiates with comprehensive data collection, gathering diverse network traffic scenarios and DDoS attack instances. This dataset becomes the foundation for subsequent phases, employing sophisticated feature engineering to extract vital patterns for model development. The feature selection process involves using feature engineering techniques including Data Collection, Model Development and SVM Integration, to extract the most discriminative and relevant features from the network traffic data. The primary innovation lies in the creation of a hybrid CNN-LSTM model, capable of discerning spatial and temporal dependencies within network data, thereby augmenting DDoS threat identification. The integration of SVM into machine learning and deep learning paradigms forms the crux of this study. By leveraging SVM's classification proficiency alongside the CNN-LSTM model's capabilities, a sophisticated DDoS detection system aims to surpass conventional rule-based limitations.

AE‐Integrated: Real‐time network intrusion detection with Apache Kafka and autoencoder

SummaryUnknown cyber‐attack detection in network traffic streams is challenging but crucial to ensure network security. It is observed that new security threats occur on a daily basis and make cyberspace vulnerable. In the literature, machine learning and deep learning‐based network intrusion detection systems have gained a lot of success but still face many challenges in detecting new security threats and unknown cyber‐attacks in real‐time. Additionally, high false alarm rates and real‐time detection in constantly evolving high‐dimensional network data streams are open issues for the research community. To address this issue, a DL‐based solution is developed to detect real‐time network anomalies in streaming data with high detection accuracy, precision, recall and low false negative and positive scenarios. The proposed novel algorithm, AE‐Integrated, is developed and evaluated on the latest CICIDS‐2017 dataset. The AE‐Integrated is updated with the newest network traffic data stream by the human administrator after a certain period to maintain its prediction accuracy for future inference. The simulation study is conducted with the Apache Kafka and Slack API to get real‐time anomaly alerts. Finally, we compared the result with recent state‐of‐the‐art research to evaluate the significance of the proposed algorithm. It is concluded that combining multiple lightweight autoencoders into a single large architecture provides optimal results. The accuracy, recall, and AUC of AE‐Integrated obtained are 99.54%, 99.53%, and 0.998, respectively.

Evaluating the Isolation Forest Method for Anomaly Detection in Software-Defined Networking Security

The research addresses the critical anomaly detection problem in Software-Defined Networking (SDN), a domain where network integrity and security are paramount. Employing the Isolation Forest algorithm, a machine learning model renowned for its efficacy in identifying outliers, the study systematically generates synthetic network traffic data to train and test the model's detection capabilities. The methodology encompasses simulating a range of contamination rates to reflect varying degrees of anomalous activities within the network. Key findings indicate that while the model exhibits potential in anomaly detection, as reflected by the progressive increase in triggered alerts and policy changes, its performance metrics, such as precision, recall, F1-score, and AUC, reveal limitations in its current application. The research contributes to the field by providing a detailed analysis of the Isolation Forest algorithm's performance in an SDN context and laying the groundwork for future enhancements in machine learning-based security measures within these networks.

Securing Mobile Edge Computing Using Hybrid Deep Learning Method

In recent years, Mobile Edge Computing (MEC) has revolutionized the landscape of the telecommunication industry by offering low-latency, high-bandwidth, and real-time processing. With this advancement comes a broad range of security challenges, the most prominent of which is Distributed Denial of Service (DDoS) attacks, which threaten the availability and performance of MEC’s services. In most cases, Intrusion Detection Systems (IDSs), a security tool that monitors networks and systems for suspicious activity and notify administrators in real time of potential cyber threats, have relied on shallow Machine Learning (ML) models that are limited in their abilities to identify and mitigate DDoS attacks. This article highlights the drawbacks of current IDS solutions, primarily their reliance on shallow ML techniques, and proposes a novel hybrid Autoencoder–Multi-Layer Perceptron (AE–MLP) model for intrusion detection as a solution against DDoS attacks in the MEC environment. The proposed hybrid AE–MLP model leverages autoencoders’ feature extraction capabilities to capture intricate patterns and anomalies within network traffic data. This extracted knowledge is then fed into a Multi-Layer Perceptron (MLP) network, enabling deep learning techniques to further analyze and classify potential threats. By integrating both AE and MLP, the hybrid model achieves higher accuracy and robustness in identifying DDoS attacks while minimizing false positives. As a result of extensive experiments using the recently released NF-UQ-NIDS-V2 dataset, which contains a wide range of DDoS attacks, our results demonstrate that the proposed hybrid AE–MLP model achieves a high accuracy of 99.98%. Based on the results, the hybrid approach performs better than several similar techniques.