Network Security Research Articles

Hybrid intrusion detection models based on GWO optimized deep learning

In the rapidly evolving landscape of network communication systems, the need for robust security measures has become paramount due to increased vulnerability to cyber threats. Traditional Intrusion Detection Systems (IDSs) face challenges in efficiently handling redundant features, leading to increased computational complexity. This research addresses these challenges by proposing two optimized IDSs leveraging Grey Wolf Optimization (GWO) combined with deep learning (DL) models. The first system integrates Gated Recurrent Unit (GRU) with GWO (GRU-GWO), while the second utilizes Long Short-Term Memory (LSTM) with GWO (LSTM-GWO). These systems aim to enhance feature selection, reducing dimensionality and improving detection accuracy. The NSL-KDD and UNSW-NB15 datasets, representative of contemporary network environments, were employed to evaluate the proposed systems. Experimental results demonstrate significant improvements in intrusion detection accuracy and computational efficiency, underscoring the efficacy of the DL-GWO approach in enhancing network security. The first approach (GRU-GWO-FS) increased accuracy to 90% and 79% for anomaly and signature-based detection on the UNSW-NB15 dataset, compared to 80% and 77% with all features. The second approach (LSTM-GWO-FS) achieved 93% and 79%, compared to 82% and 77%. On the NSL-KDD dataset, GRU-GWO-FS improved accuracy to 94% and 92%, and LSTM-GWO-FS to 94% and 92% for anomaly and signature-based detection, respectively.

Network anomaly detection using Deep Autoencoder and parallel Artificial Bee Colony algorithm-trained neural network

Cyberattacks are increasingly becoming more complex, which makes intrusion detection extremely difficult. Several intrusion detection approaches have been developed in the literature and utilized to tackle computer security intrusions. Implementing machine learning and deep learning models for network intrusion detection has been a topic of active research in cybersecurity. In this study, artificial neural networks (ANNs), a type of machine learning algorithm, are employed to determine optimal network weight sets during the training phase. Conventional training algorithms, such as back-propagation, may encounter challenges in optimization due to being entrapped within local minima during the iterative optimization process; global search strategies can be slow at locating global minima, and they may suffer from a low detection rate. In the ANN training, the Artificial Bee Colony (ABC) algorithm enables the avoidance of local minimum solutions by conducting a high-performance search in the solution space but it needs some modifications. To address these challenges, this work suggests a Deep Autoencoder (DAE)-based, vectorized, and parallelized ABC algorithm for training feed-forward artificial neural networks, which is tested on the UNSW-NB15 and NF-UNSW-NB15-v2 datasets. Our experimental results demonstrate that the proposed DAE-based parallel ABC-ANN outperforms existing metaheuristics, showing notable improvements in network intrusion detection. The experimental results reveal a notable improvement in network intrusion detection through this proposed approach, exhibiting an increase in detection rate (DR) by 0.76 to 0.81 and a reduction in false alarm rate (FAR) by 0.016 to 0.005 compared to the ANN-BP algorithm on the UNSW-NB15 dataset. Furthermore, there is a reduction in FAR by 0.006 to 0.0003 compared to the ANN-BP algorithm on the NF-UNSW-NB15-v2 dataset. These findings underscore the effectiveness of our proposed approach in enhancing network security against network intrusions.

Construction of Cross-basin Ecological Security Patterns Based on Carbon Sinks and Landscape Connectivity

Artificial water system creation and land use changes have great effects on ecosystems. The construction of cross-basin ecological security patterns based on carbon sinks and landscape connectivity plays a key role in regional ecological environment protection. The linkage area between the Xiang River and the Li River was selected as the research object. Based on the land use data from 2000 to 2020, this study examined the ecological security network of the Xiang-Li connected region using the InVEST model combined with morphological spatial pattern analysis （MSPA） and evaluated the temporal and spatial evolution of carbon storage and ecological security patterns. The results showed that： ① From 2000 to 2020, the land cover types of the Xiang-Li linkage area were mainly forest land and arable land. The changes of land use types were characterized by decreases in arable land, forest land, and grassland and by increases in watersheds and construction land. ② The carbon storage in the Xiang-Li linkage area was characterized by a blocky distribution, and the high and medium areas were dominant. The carbon stock increased slowly from 2000 to 2010 and decreased dramatically from 2010 to 2020, with a cumulative decrease of 18.32×103 t due to the influence of land use changes. ③ The area of ecological sources （five in total） decreased firstly and then increased, whereas the length of ecological corridors （ten in total） increased firstly and then decreased in the Xiang-Li linkage area. Overall, in the process of urbanization, the distribution of the high ecological resistance value in the Xiang-Li linkage area gradually shifted to the northeast with an expansion, whereas the barycenter of the ecological safety pattern shifted to the southwest. Determining the dynamic distribution and stability of ecological sources by coupling carbon storage patches and landscape patterns can provide a new way to construct ecological security patterns in cross-basin ecosystems.

A real-time network traffic classification system using cost-sensitive deep neural networks

Due to the continuous growth of Internet and online applications, network traffic classification is not only becoming one of the most crucial disciplines in network management but is also becoming quintessential for providing advanced tasks such as Quality of Service and network security. Moreover, even though many studies have been undertaken in recent years, real-time encrypted traffic classification continues to be an important challenge in the field of network traffic classification. Therefore, in this paper a real-time network traffic classification system is proposed together with five new models. The real-time classification system classified each incoming real-time packets into appropriate classes of interest and the five new models make use of a cost-sensitive learning strategy to deal with the unbalanced data problem during the training phase. The proposed models, which are called Cost-Sensitive Long-Short Term Memory (CSLSTM), Cost-Sensitive Gated Recurrent Unit (CSGRU), Cost-Sensitive Convolution Neural Network (CSCNN), CSNN with LSTM and CSCNN with GRU, can handle both traffic categorization and application identification. These proposed models were compared with prominent methods in this field and the proposed CSCNN was observed to outperform the researched deep learning models by at least 4% to 16% in correctly classifying packets from the ISCX VPN-nonVPN dataset.

Large Language Models Meet Next-Generation Networking Technologies: A Review

The evolution of network technologies has significantly transformed global communication, information sharing, and connectivity. Traditional networks, relying on static configurations and manual interventions, face substantial challenges such as complex management, inefficiency, and susceptibility to human error. The rise of artificial intelligence (AI) has begun to address these issues by automating tasks like network configuration, traffic optimization, and security enhancements. Despite their potential, integrating AI models in network engineering encounters practical obstacles including complex configurations, heterogeneous infrastructure, unstructured data, and dynamic environments. Generative AI, particularly large language models (LLMs), represents a promising advancement in AI, with capabilities extending to natural language processing tasks like translation, summarization, and sentiment analysis. This paper aims to provide a comprehensive review exploring the transformative role of LLMs in modern network engineering. In particular, it addresses gaps in the existing literature by focusing on LLM applications in network design and planning, implementation, analytics, and management. It also discusses current research efforts, challenges, and future opportunities, aiming to provide a comprehensive guide for networking professionals and researchers. The main goal is to facilitate the adoption and advancement of AI and LLMs in networking, promoting more efficient, resilient, and intelligent network systems.

Vulnerability Evolution of a Container Shipping Network in an Uncertain Environment: The Case of China–United States Connections

Container transportation has the advantages of standardization, high efficiency, and high safety, which are essential for promoting the development of the world economy and trade. Emergencies such as severe weather, public health incidents, and social security incidents can negatively affect the operational reliability of the container shipping network. To ensure the network security and high-quality operation of container shipping, a double-layer coupled container transportation network is first described to analyze the evolution of the container shipping network and the risk propagation dynamics of operation participants. On this basis, a cascade failure model of the container shipping network considering risk level is constructed. To evaluate the vulnerability of the container shipping network, the transmission mechanism of cascade failure effects of the container shipping network under different emergency development trends and the evolution law and influence path of the container shipping network structure are both analyzed. Finally, we empirically studied the container shipping network in China and the United States, and characteristic parameters of the China–U.S. container shipping network are calculated and analyzed. The model’s validity is verified through practical cases and model simulation results, and the cascading failure process of the container shipping network in China and the United States under three types of attacks is simulated. Suggestions are provided for effective improvement in the vulnerability of the container shipping network under every kind of contingency.

DELM: Deep Ensemble Learning Model for Anomaly Detection in Malicious Network Traffic-based Adaptive Feature Aggregation and Network Optimization

With the rapid advancements in internet technology, the complexity and sophistication of network traffic attacks are increasing, making it challenging for traditional anomaly detection systems to analyze and detect malicious network attacks. The increasing advancedness of cyber threats calls for innovative approaches to identify malicious patterns within network traffic precisely. The primary issue lies in the fact that these approaches do not focus on the essential adaptive features of network traffic. We proposed an effective anomaly detection system for malicious network traffic attacks called the Deep Ensemble Learning Model (DELM). We leverage the structure of the Feedforward Deep Neural Network (FDNN), and Deep Belief Network (DBN), incorporating multiple hidden layers with non-linear activation functions. Integrating Adaptive Feature Aggregation (AFA) with the FDNN algorithm dynamically adjusts the feature aggregation process based on incoming traffic characteristics to improve adaptability. The Conditional Generative Network was employed to enhance DELM for generating data for minority classes. To improve the model’s accuracy, we applied batch normalization and data augmentation techniques for preprocessing, utilized n-gram, one-hot encoding, and feature aggregation methods for effective feature extraction. This study significantly contributes to network security by enhancing systems for detecting malicious network traffic. With its interpretability and adaptability, our proposed model shows promise in addressing the evolving cyber threat and fortifying critical network infrastructure. The experimental results demonstrate that our model performs with higher stability than the existing state-of-the-art detection approaches, as reflected by its higher accuracy, precision, recall, F1-score, and AUC-ROC.

Opportunities and Challenges of Intelligent Computer Network Configuration and Security with its Technologies

This paper explores the dual aspects of opportunities and challenges posed by intelligent computer network configuration and security, highlighting the role of emerging technologies while emphasizing the need for robust strategies to address the accompanying risks. Intelligent network configuration utilizes technologies like artificial intelligence (AI), machine learning (ML) and software-defined networking (SDN) to automate and optimize network management. This automation enhances efficiency, scalability and adaptability, allowing networks to respond dynamically to traffic patterns and emerging threats. AI-powered security mechanisms further bolster defenses against sophisticated cyberattacks by enabling real-time monitoring, threat detection and proactive mitigation strategies. However, alongside these opportunities come challenges. Implementing intelligent technologies requires addressing issues like system complexity, interoperability and the need for continuous updates to handle evolving cyber threats. Additionally, privacy concerns, the integration of legacy systems and ensuring compliance with regulatory standards are key hurdles in adopting these technologies

Improving the security of NOMA cognitive networks

Aiming at the scenario where the eavesdropper try to eavesdrop on the confidential messages of secondary trusted users, two physical-layer network coding (PNC) strategies, namely dual power superposition (PS-PS) encoding strategy and bit-level exclusive-or power superposition (XOR-PS) encoding strategy, are proposed to improve the security performance of cognitive non-orthogonal multiple access (NOMA) networks with the help of the data transmitted by the primary user. Considering the overlay spectrum sharing mechanism and the imperfect successive interference cancellation (SIC) technology, we first derive the closed-form accurate expressions of the outage probability and intercept probability of the secondary network with these two schemes over Rayleigh fading, and also give the asymptotic outage probability in the high signal-to-noise ratio (SNR) regime. Then, the correctness of the theoretical results is verified by simulation. For comparison, we also use the scheme without the assistance of the primary user as the benchmark scheme, which is represented by NPS. Finally, the simulation results show that the security of the proposed PS-PS and XOR-PS schemes is much better than that of the NPS scheme in the case of without reducing the outage performance.

Enhanced intrusion detection framework for securing IoT network using principal component analysis and CNN

ABSTRACT The Internet of Things (IoT) has transformed our world by connecting smart devices and enabling seamless interactions. This reliance, however, has led to new security issues and types of attacks. It is of the utmost importance to safeguard the security of IoT networks, with network intrusion detection systems (NIDS) having a significant impact. This paper proposes a novel approach integrating Principal Component Analysis (PCA), Pearson Correlation Coefficient (PCC), and Convolutional Neural Network (CNN) to overcome these security issues. Our innovative method reduces data dimensionality and selects highly correlated features using PCC and PCA, addressing overfitting and improving model performance while maintaining high computational speed and low costs. Our approach uniquely distinguishes between benign and threat packets by employing 1D-CNN, 2D-CNN, and 3D-CNN algorithms trained on Edge-IIoTset and NSL-KDD benchmark datasets. The findings from our experiments indicate that the proposed framework significantly enhances accuracy, precision, recall, and F1-score compared to existing models for both binary and multiclass classifications. Our binary classification models achieved exceptional performance, with an average accuracy of 99.76%, 99.79% precision, 99.89% recall, and 99.85% F1-score on the Edge-IIoTset dataset. On the NSL-KDD dataset, the models attained 99.20% accuracy, 98.07% precision, 97.95% recall, and 97.71% F1-score. For multiclass classification, the proposed model demonstrated an average accuracy of 99.41%, precision of 98.61%, recall of 98.49%, and an F1-score of 98.56% on the Edge-IIoTset dataset. On the NSL-KDD dataset, the model achieved 92.43% accuracy, 93.21% precision, 93.60% recall, and a 93.7% F1-score. Our research introduces a significant advancement that substantially improves NIDS capabilities, making IoT networks safer and more connected.

A network security protection scheme for tax system based on elliptic curve cryptography

With the rapid development of modern information technology and network technology, the construction of tax informatization plays an important role in improving the level of tax management and work efficiency. However, in the centralized data processing mode, the establishment of large data center and the efficient, stable, and secure connection of server bandwidth have become key challenges. Moreover, the openness and interconnectivity of the tax system network pose various network security threats, seriously threatening the integrity and security of data. For the above issues, this article proposes a tax system network security protection scheme based on elliptic curve cryptography. This scheme combines hash function and elliptic curve cryptography to achieve user anonymity and secure generation of session keys, effectively ensuring the secure transmission of confidential information. The security and effectiveness of the scheme are verified through informal and formal security analysis based on security proof, BAN logic and AVISPA tool. And a comprehensive evaluation of the scheme is conducted, and the results show that the scheme significantly reduced the costs while providing security features.

Enhancing Security in Social Networks through Machine Learning: Detecting and Mitigating Sybil Attacks with SybilSocNet

This study contributes to the Sybil node-detecting algorithm in online social networks (OSNs). As major communication platforms, online social networks are significantly guarded from malicious activity. A thorough literature review identified various detection and prevention Sybil attack algorithms. An additional exploration of distinct reputation systems and their practical applications led to this study’s discovery of machine learning algorithms, i.e., the KNN, support vector machine, and random forest algorithms, as part of our SybilSocNet. This study details the data-cleansing process for the employed dataset for optimizing the computational demands required to train machine learning algorithms, achieved through dataset partitioning. Such a process led to an explanation and analysis of our conducted experiments and comparing their results. The experiments demonstrated the algorithm’s ability to detect Sybil nodes in OSNs (99.9% accuracy in SVM, 99.6% in random forest, and 97% in KNN algorithms), and we propose future research opportunities.

A COMPREHENSIVE REVIEW OF MACHINE LEARNING AND DEEP LEARNING APPLICATIONS IN CYBERSECURITY: AN INTERDISCIPLINARY APPROACH

Cybersecurity is increasingly becoming a critical concern as the complexity and frequency of cyber-attacks continue to rise. Machine learning (ML) and deep learning (DL) have emerged as powerful tools to enhance cybersecurity systems, offering dynamic capabilities in real-time threat detection, anomaly detection, and intrusion prevention. This article (45) presents a systematic review of the applications of ML and DL in cybersecurity, adhering to the PRISMA guidelines. The review covers several key domains, including network security, cloud security, and Internet of Things (IoT) security, highlighting how ML/DL models like convolutional neural networks (CNNs) and recurrent neural networks (RNNs) outperform traditional rule-based systems. It also addresses challenges such as adversarial attacks, data privacy concerns, and the computational resource demands of DL models. Current solutions like adversarial training, federated learning, and model optimization techniques are examined for their potential to mitigate these issues. The findings suggest that while ML/DL technologies hold great promise, further research and innovation are necessary to overcome the inherent challenges, ensuring that these systems can be deployed effectively and securely in real-world environments.

Research of ways to improve the security of corporate networks

Objective. The article explores a way to improve the security of a corporate network by using the technique of spoofing sender addresses when forwarding packets between computers. Method. Network traffic analysis methods, network protocol level programming and data packet processing algorithms are used. Computers on the network are connected to one server. When sending packets between computers in the network, the sender's address is replaced, and when a packet is received by another computer, the packet is disassembled, and the real sender's address is inside it. Result. The method allows for effective protection of a corporate network from attacks associated with the forgery of addresses of data packet senders. Conclusion. Using the sender address substitution technique when transmitting data in a corporate network is an effective way to increase security and protection from external threats. Further research is aimed at developing complex and reliable methods for protecting networks.

Innovative Machine Learning Strategies for DDoS Detection: A Review

This is a broad survey that investigates the use of machine learning (ML) methods for detecting distributed denial of service (DDoS) attacks. Traditional intrusion detection systems face difficulties in application-layer DDoS attacks because they target legal web traffic forms using standard transmission control protocol connections. This paper reviews different ML methods used in recent studies to tackle these issues. These studies use various data sets, such as UNSW-np-15, CICDDoS2019, and the novel dataset LATAM-DDoS-Internet of Things., which prove the efficacy of the proposed models in terms of accuracy and performance metrics. The second group of studies shows more advanced designs, such as protocol-based deep intrusion detection and autoencoder-multi-layer perceptron. These use deep learning to find features and group attacks. All of these approaches present favorable outcomes when it comes to distinguishing normal, DoS, and DDoS traffic with a high level of accuracy. Furthermore, the review discusses works that emphasize the early detection of noise-robust models and distributed frameworks. Different techniques, such as snake optimizer with ensemble learning, metastability theory, and spark-based anomaly detection, highlight the trend of predicting DDoS attacks, whereas hyperband-tuned deep neural networks and evolutionary support vector machine models show higher accuracy in cloud systems as well as software-defined networking environments. Hence, this review gives a general observation of how DDoS attacks develop on their way and proves that ML techniques help to strengthen network security.

MFT: A novel memory flow transformer efficient intrusion detection method

Intrusion detection is a critical field in network security research that is devoted to detecting malicious traffic or attacks on networks. Even with the advances in today's Internet environment, a lot of intrusion detection techniques still fail to take into account the long-term characteristics present in network data, which results in a high false alarm rate. Some researchers have tried to address this problem by using the traditional transformer model; however, it is not very effective when dealing with complex relationships and the subtle classification requirements of large amounts of sequential data. This work presents a novel solution called the memory flow transformer (MFT) in response to the limitations of the conventional transformer model. By utilizing a carefully designed memory flow structure, MFT transcends traditional limitations and makes it possible to obtain complex long-term features from network traffic. This innovation enables the model to identify deep connections at a finer level between a wide variety of network traffic data. Extensive experiments were carried out on the complex CICIDS 2017 and NSL-KDD datasets to validate the effectiveness of the MFT model. The results were outstanding, demonstrating MFT's powerful detection abilities. With regard to performance metrics like accuracy, F1 score, false alarm rate, and training time, MFT is superior to current state-of-the-art approaches. Network security is greatly strengthened by MFT, which provides practitioners in the intrusion detection field with novel and effective techniques.

Event Based Control for Network Security Systems Subject to Actuator Saturation

Abstract As a typical nonlinear link, actuator saturation exists in most network security protection systems. It easily disrupts the closed-loop performance of the system, leading to instability. The event triggering control policy generally adopts an aperiodic sampling mechanism and transmits information only when the triggering condition is met, which can save system communication and computing resources. An event-triggered controller is designed for a network security system with actuator saturation, and the system stabilization is realized. The attractor domain of the system is estimated by solving optimization problems in the form of linear matrix inequalities. Simulation results show the validity of the conclusions obtained in this paper.

Application of Reinforcement Learning in Network Security in Dynamical Adjusting Defense Strategies

Application of Reinforcement Learning in Network Security in Dynamical Adjusting Defense Strategies

Advanced Hybrid Techniques for Cyberattack Detection and Defense in IoT Networks

ABSTRACTThe Internet of Things (IoT) represents a vast network of devices connected to the Internet, making it easier for users to connect to modern technology. However, the complexity of these networks and the large volume of data pose significant challenges in protecting them from persistent cyberattacks, such as distributed denial‐of‐service (DDoS) attacks and spoofing. It has become necessary to use intrusion detection systems and protect these networks. Existing intrusion detection systems for IoT networks face many problems and limitations, including high false alarm rates and delayed detection. Also, the datasets used for training may be outdated or sparse, which reduces the model's accuracy, and mechanisms may not be used to defend the network when any intrusion is detected. To address these limitations, a new hybrid deep learning and machine learning methodology is proposed that contributes to detecting DDoS and spoofing attacks, reducing false alarms, and then implementing the necessary defensive measures. In proposed hybrid methodology consists of three stages: the first stage is to propose a hybrid method for feature selection consisting of techniques (correlation coefficient and sequential feature selector); the second stage is to propose a hybrid model by integrating deep learning neural networks with a machine learning classifier (cascaded long short‐term memory [LSTM] and Naive Bayes classifier); and in the third stage, improving network defense mechanisms and blocking ports after detecting threats and maintaining network integrity. In training and evaluating the performance of the proposed methodology, three datasets (CIC‐DDoS2019, CIC‐IoT2023, and CIC‐IoV2024) were used, and these data were also balanced to obtain effective results. The accuracy of 99.91%, 99.88%, and 99.77% was obtained. Also, a cross‐validation technique was used with the test data to ensure no overfitting. The proposed methodology has proven its high performance in detecting attacks, as it provides a powerful solution to enhance the security of IoT networks and protect them from cyberattacks, as it can be applied in many fields and to other attacks.

Towards Superior Android Ransomware Detection: An Ensemble Machine Learning Perspective

Ransomware remains a pervasive threat to Android devices, with its ability to encrypt critical data and demand ransoms causing significant disruptions to users and organizations alike. This research proposes a novel ensemble-based machine learning approach for the detection of Android ransomware, leveraging the strengths of multiple classifiers to enhance detection accuracy and robustness. Utilizing a comprehensive dataset comprising 203,556 network traffic records across 10 distinct ransomware types and benign traffic, we meticulously preprocess and feature-engineer the data to ensure optimal model performance. The methodology integrates various ensemble classifiers, evaluating each through rigorous cross-validation. Feature importance analysis using Random Forest identifies key indicators of ransomware activity, enabling us to refine our models and focus on the most predictive features. The results demonstrate that the ensemble models, particularly Bagging, achieve near-perfect detection rates, with precision, recall, and F1 scores consistently exceeding 99% for different binary attacks and multi-class classification. Finally, in-depth statistical analysis further validates the superiority of our approach, showcasing significant improvements over traditional machine learning methods. This research sets a new benchmark for Android ransomware detection, offering a robust, scalable, and highly accurate solution that enhances the security and resilience of mobile networks against evolving cyber threats.