Normal Packets Research Articles

An intelligent multi-layer framework with SHAP integration for botnet detection and classification

In increasingly interconnected digital world, the threat of cyber-attacks and data breaches are a pervasive and growing concern. The Botnets are the most dangerous threats that launch a wide range of cyberattacks such as distributed denial of service (DDoS) attacks, sending spam emails, spreading malware, and stealing sensitive information. The identification and categorization of botnets has become a highly complex and critical process due to the massive amount of network traffic generated every second. This paper presents a multilayer botnet detection and classification framework based on explainable machine learning algorithms. The proposed approach comprises of three distinct layers: Feature Selection Layer, Botnet Detection Layer and Botnet Classification Layer. The Feature Selection Layer reduces the dataset into six essential features, that enhance the accuracy and efficiency of the framework. The botnet detection layer detects botnet activity by filtering the reduced dataset into normal packets and botnet packets. The filtered botnet packets further examined by botnet classification layer to classify the botnet packets into different types of botnets. Moreover, SHAP (SHapley Additive exPlanations) technique is utilized to provide transparency to the model's decision-making process. To evaluate the effectiveness of the proposed model, NCC-2 and CTU-13 datasets are examined. 10-fold cross-validation technique is applied to validate the experimental findings. The average accuracy achieved by proposed approach in botnet detection stands impressively at 99.98%, while the average accuracy achieved in classifying botnet families is 99.30%, exhibiting an exceptional level of performance. The comparative analysis is performed which demonstrates its superiority over existing methods in terms of accuracy, precision, recall, F1-Score.

LSTM-NV: A combined scheme against selective forwarding attack in event-driven wireless sensor networks under harsh environments

Wireless Sensor Networks (WSNs) are susceptible to selective forwarding attacks, which can lead to reduced network efficiency and compromise the integrity of transmitted data. The indistinguishability between malicious behavior and normal packet loss in harsh environments exacerbates the challenge. To address this, in this paper, we provide a combined detection scheme called LSTM-NV, consisting of a training stage and a detecting stage. During the training stage, we integrate variational mode decomposition (VMD) with a long short term memory (LSTM) model to learn normal nodes’ forwarding behavior and then predict errors for each node. During the detecting stage, dynamic thresholds are determined to identify local anomaly points and a novel neighbor voting method is employed to differentiate between malicious and normal nodes. Our scheme demonstrates superior performance with a low average missed detection rate (MDR) of 0.6% and a low average false detection rate (FDR) of 3.3% compared to other effective methods, while also offering lower detection algorithmic complexity.

A novel network intrusion detection method based on metaheuristic optimisation algorithms

The growing use of the Internet with its vulnerabilities has necessitated the adoption of Intrusion Detection Systems (IDS) to assure security. IDSs are protective systems that detect outsider infiltrations, unauthorised accesses and malfunctions occurring in computer networks. Intrusions can be detected and reported to the network administrator by IDSs using various pieces of information such as port scanning and irregular traffic detection. Intrusion detection is a classification problem, and identifying effective features is an essential aspect of classification methods. Standard methods used for classification are neural networks, fuzzy logic, data mining techniques and metaheuristics. One of the novel metaheuristic algorithms introduced to address optimisation problems is the Horse herd Optimisation Algorithm (HOA). This paper introduces a new approach on the basis of HOA for network intrusion detection. The new method uses horse behaviours in the herd to select effective features to detect intrusions and interactions between features. For the purpose of the new approach, HOA is first updated into a discrete algorithm using the floor function. The binarised algorithm is then converted into a quantum-inspired optimiser by integrating the concepts of quantum computing with HOA to improve the social behaviours of the horses in the herd. In quantum computing, Q-bit and Q-gate aid in striking a greater balance between the exploration and exploitation processes. The resulting algorithm is then converted into a multi-objective algorithm, where the objectives can be chosen from a set of optimal solutions. The new algorithm, MQBHOA, is then used for intrusion detection in computer networks, which is a multi-objective optimisation problem. For the classification, the K-Nearest Neighbour (KNN) classifier is applied. To evaluate the new algorithm’s performance, two data sets, NSL-KDD (Network Security Laboratory—Knowledge Discovery and Data Mining) and CSE-CIC-IDS2018, are employed in which the network packets are classified into five categories: normal packets plus four intrusions packet types of Denial of Service (DoS), User to Root (U2R), Remote to Local (R2L) and Probing (Prob). The new algorithm’s performance was evaluated and compared with other well-known metaheuristic algorithms, and the influence of the parameters of the algorithm on the degree of intrusion was investigated. The results show a 6% more success rate in the average size of feature selection and the accuracy of classification in comparison with other evaluated algorithms. It also demonstrates an accuracy of 99.8% in detecting network intrusions compared to other methods.

Using Pattern of On-Off Routers and Links and Router Delays to Protect Network-on-Chip Intellectual Property

Intellectual Property (IP) reuse is a well known practice in chip design processes. Nowadays, network-on-chips (NoCs) are increasingly used as IP and sold by various vendors to be integrated in a multiprocessor system-on-chip (MPSoC). However, IP reuse exposes the design to IP theft, and an attacker can launch IP stealing attacks against NoC IPs. With the growing adoption of MPSoC, such attacks can result in huge financial losses. In this article, we propose four NoC IP protection techniques using fingerprint embedding: ON-OFF router-based fingerprinting (ORF), ON-OFF link-based fingerprinting (OLF), Router delay-based fingerprinting (RTDF), and Row delay-based fingerprinting (RWDF). ORF and OLF techniques use patterns of ON-OFF routers and links, respectively, while RTDF and RWDF techniques use router delays to embed fingerprints. We show that all of our proposed techniques require much less hardware overhead compared to an existing NoC IP security solution (square spiral routing) and also provide better security from removal and masking attacks. In particular, our proposed techniques require between 40.75% and 48.43% less router area compared to the existing solution. We also show that our solutions do not affect the normal packet latency and hence do not degrade the NoC performance.

Artificial Intelligence Algorithms for Detecting and Classifying MQTT Protocol Internet of Things Attacks

The Internet of Things (IoT) grew in popularity in recent years, becoming a crucial component of industrial, residential, and telecommunication applications, among others. This innovative idea promotes communication between physical components, such as sensors and actuators, to improve process flexibility and efficiency. Smart gadgets in IoT contexts interact using various message protocols. Message queuing telemetry transfer (MQTT) is a protocol that is used extensively in the IoT context to deliver sensor or event data. The aim of the proposed system is to create an intrusion detection system based on an artificial intelligence algorithm, which is becoming essential in the defense of the IoT networks against cybersecurity threats. This study proposes using a k-nearest neighbors (KNN) algorithm, linear discriminant analysis (LDA), a convolutional neural network (CNN), and a convolutional long short-term memory neural network (CNN-LSTM) to identify MQTT protocol IoT intrusions. A cybersecurity system based on artificial intelligence algorithms was examined and evaluated using a standard dataset retrieved from the Kaggle repository. The dataset was injected by five attacks, namely brute-force, flooding, malformed packet, SlowITe, and normal packets. The deep learning algorithm achieved high performance compared with the developing security system using machine learning algorithms. The performance accuracy of the KNN method was 80.82%, while the accuracy of the LDA algorithm was 76.60%. The CNN-LSTM model attained a high level of precision (98.94%) and is thus very effective at detecting intrusions in IoT settings.

A New Abnormal Node Detection Method With Dynamic Hoeffding Test

In this letter, we propose a new method based on the dynamic Hoeffding test that can distinguish the abnormal relay nodes from those with normal packet loss in wireless communications. An asymptotic analysis of the detection performance on the Hoeffding test is conducted to determine the new dynamic detection threshold for decreasing the total probability of errors. With the theoretical guarantees, both false alarm and missed detection probabilities of the proposed scheme converge <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">exponentially</i> as the number of detection periods increases. Simulation results validate our analysis and demonstrate the superior detection performance of the proposed method.

CapBad: Content-Agnostic, Payload-Based Anomaly Detector for Industrial Control Protocols

Efficient anomaly detection methods are urgently needed to prevent attacks in the application layer of the Industrial Internet of Things (IIoT). The existing intrusion detection systems have certain limitations in detecting abnormal packets exploited by the application-layer attacks. In this article, a content-agnostic-payload-based anomaly detector named the CapBad is proposed to detect malicious packets in the application layer of the IIoT system. Specifically, a phase-aware hidden semi-Markov model (pHSMM) is used to model the industrial control protocol packets and automatically learn the packets’ payload characteristics. The packet types are then inferred based on the packet likelihoods obtained by the pHSMM. In addition, the probabilistic suffix tree is employed to analyze the packets’ contextual similarity to the historical packets. The abnormal packets are finally detected by comparing their contextual similarity with that of the historical normal packets. The proposed algorithm is verified by simulations, and the results show that the CapBad has an excellent performance in detecting abnormal packets in the application layer.

Detecting block ciphers generic attacks: An instance-based machine learning method

Cryptography facilitates selective communication through encryption of messages and or data. Block-cipher processing is one of the prominent methods for modern cryptographic symmetric encryption schemes. The rise in attacks on block-ciphers led to the development of more difficult encryption schemes. However, attackers decrypt block-ciphers through generic attacks given sufficient time and computing. Recent research had applied machine learning classification algorithms to develop intrusion detection systems to detect multiple types of attacks. These intrusion detection systems are limited by misclassifying generic attacks and suffer reduced effectiveness when evaluated for detecting generic attacks only. Hence, this study introduced and proposed k-nearest neighbors, an instance-based machine learning classification algorithm, for the detection of generic attacks on block-ciphers. The value of k was varied (i.e., 1, 3, 5, 7, and 9) and multiple nearest neighbors classification models were developed and evaluated using two distance functions (i.e., Manhattan and Euclidean) for classifying between generic attacks and normal network packets. All nearest neighbors models using the Manhattan distance function performed better than their Euclidean counterparts. The 1-nearest neighbor (Manhattan distance function) model had the highest overall accuracy of 99.6%, a generic attack detection rate of 99.5% which tallies with the 5, 7, and 9 nearest neighbors models, and a false alarm rate of 0.0003 which is the same for all Manhattan nearest neighbors classification models. These instance-based methods performed better than some existing methods that even implemented an ensemble of deep-learning algorithms. Therefore, an instance-based method is recommended for detecting block-ciphers generic attacks.

Histogram-Based Intrusion Detection and Filtering Framework for Secure and Safe In-Vehicle Networks

In this paper, we propose H-IDFS, a Histogram-based Intrusion Detection and Filtering framework, which assembles the CAN packets into windows, and computes their corresponding histograms. The latter are fed to a multi-class IDS classifier to identify the class of the traffic windows. If the window is found malicious, the filtering system is invoked to filter out the normal CAN packets from each malicious window. To this end, we propose a novel one-class SVM, named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">OCSVM-attack</i> that is trained on normal traffic and considers the invariant and quasi-invariant features of the attack. Experimental results on two CAN datasets: OTIDS and Car-Hacking, show the superiority of the proposed H-IDFS, as it achieves an accuracy of 100% for window classification, and correctly filters out between 94.93% and 100% of normal packets from malicious windows.

Hybrid deep-learning model to detect botnet attacks over internet of things environments

In recent years, the use of the internet of things (IoT) has increased dramatically, and cybersecurity concerns have grown in tandem. Cybersecurity has become a major challenge for institutions and companies of all sizes, with the spread of threats growing in number and developing at a rapid pace. Artificial intelligence (AI) in cybersecurity can to a large extent help face the challenge, since it provides a powerful framework and coordinates that allow organisations to stay one step ahead of sophisticated cyber threats. AI provides real-time feedback, helping rollover daily alerts to be investigated and analysed, effective decisions to be made and enabling quick responses. AI-based capabilities make attack detection, security and mitigation more accurate for intelligence gathering and analysis, and they enable proactive protective countermeasures to be taken to overwhelm attacks. In this study, we propose a robust system specifically to help detect botnet attacks of IoT devices. This was done by innovatively combining the model of a convolutional neural network with a long short-term memory (CNN-LSTM) algorithm mechanism to detect two common and serious IoT attacks (BASHLITE and Mirai) on four types of security camera. The data sets, which contained normal malicious network packets, were collected from real-time lab-connected camera devices in IoT environments. The results of the experiment showed that the proposed system achieved optimal performance, according to evaluation metrics. The proposed system gave the following weighted average results for detecting the botnet on the Provision PT-737E camera: camera precision: 88%, recall: 87% and F1 score: 83%. The results of system for classifying botnet attacks and normal packets on the Provision PT-838 camera were 89% for recall, 85% for F1 score and 94%, precision. The intelligent security system using the advanced deep learning model was successful for detecting botnet attacks that infected camera devices connected to IoT applications.

Protecting Network-on-Chip Intellectual Property Using Timing Channel Fingerprinting

The theft of Intellectual property (IP) is a serious security threat for all businesses that are involved in the creation of IP. In this article, we consider such attacks against IP for Network-on-Chip (NoC) that are commonly used as a popular on-chip scalable communication medium for Multiprocessor System-on-Chip. As a protection mechanism, we propose a timing channel fingerprinting method and show its effectiveness by implementing five different solutions using this method. We also provide a formal proof of security of the proposed method. We show that the proposed technique provides better security and requires much lower hardware overhead (64%–74% less) compared to an existing NoC IP security solution without affecting the normal packet latency or degrading the NoC performance.

Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier

Early detection of network intrusions is a very important factor in network security. However, most studies of network intrusion detection systems utilize features for full sessions, making it difficult to detect intrusions before a session ends. To solve this problem, the proposed method uses packet data for features to determine if packets are malicious traffic. Such an approach inevitably increases the probability of falsely detecting normal packets as an intrusion or an intrusion as normal traffic for the initial session. As a solution, the proposed method learns the patterns of packets that are unhelpful in order to classify network intrusions and benign sessions. To this end, a new training dataset for Generative Adversarial Network (GAN) is created using misclassified data from an original training dataset by the LSTM-DNN model trained using the original one. The GAN trained with this dataset has ability to determine whether the currently received packet can be accurately classified in the LSTM-DNN. If the GAN determines that the packet cannot be classified correctly, the detection process is canceled and will be tried again when the next packet is received. Meticulously designed classification algorithm based on LSTM-DNN and validation model using GAN enable the proposed algorithm to accurately perform network intrusion detection in real time without session termination or delay time for collecting a certain number of packets. Various experiments confirm that the proposed method can detect intrusions very early (before the end of the session) while maintaining detection performance at a level similar to that of the existing methods.

Hybrid Intrusion Detection System

One of the most challenging aspects of a rule-based network intrusion detection system is the high false-positive rate, which makes it unreliable. This research study has developed a new hybrid system based on two-stage intrusion detectors in series to lower the system's high false-positive rate. At first, the rule-based system identifies incoming network packets as intrusion packets or normal packets. The trained machine learning model with feature reduction technique assists the classifiers in classifying the incoming packets as intrusion or normal. For the rule-based system, "Snort" is used, and for the second stage, a classification decision tree is used. A Genetic Algorithm (GA) technique is used for feature selection purposes. The final decision about intrusions is based on the prediction of both the learning systems. The experimental results show that this approach successfully reduces the false positive and false negative rates and increases rule-based NIDS accuracy.

Security: Intrusion Prevention System Using Deep Learning on the Internet of Vehicles

Internet of vehicles supports to transfer of safety-related messages, which help to mitigate road accidents. Internet of vehicles allows vehicle to cooperative communicate, share position and speed data among vehicles and road side units. The vehicular network become prone to large number of attacks including false warnings, mispositioning of vehicles etc. The authentication of messages to identify the normal message packet from attack messages packet and its prevention is a major challenging task. This paper focuses on applying deep learning approach using binary classification to classify the normal packets from malicious packets. The process starts with preparing the training dataset from the open-source KDD99 and CICIDS 2018 datasets, consisting of 1,20,223 network packets with 41 features. The one-dimensional network data is preprocessed using an autoencoder to eliminate the unwanted data in the initial stage. The valuable features are then filtered as 23 out of 41, and the model is trained with structured deep neural networks, then combined with the Softmax classifier and Relu activation functions. The proposed Intrusion prevention model is trained and tested with google Colab, an open platform cloud service, and the open-source tensor flow. The proposed prevention classifier model was validated with the simulation dataset generated in network simulation. The experimental results show 99.57% accuracy, which is the highest among existing RNN and CNN-based models. In the future, the model can be trained on different datasets, which will further improve the model's efficiency and accuracy.

A novel GPU based intrusion detection system using deep autoencoder with Fruitfly optimization

Intrusion Detection Systems (IDSs) have received more attention to safeguarding the vital information in a network system of an organization. Generally, the hackers are easily entering into a secured network through loopholes and smart attacks. In such situation, predicting attacks from normal packets is tedious, much challenging, time consuming and highly technical. As a result, different algorithms with varying learning and training capacity have been explored in the literature. However, the existing Intrusion Detection methods could not meet the desired performance requirements. Hence, this work proposes a new Intrusion Detection technique using Deep Autoencoder with Fruitfly Optimization. Initially, missing values in the dataset have been imputed with the Fuzzy C-Means Rough Parameter (FCMRP) algorithm which handles the imprecision in datasets with the exploit of fuzzy and rough sets while preserving crucial information. Then, robust features are extracted from Autoencoder with multiple hidden layers. Finally, the obtained features are fed to Back Propagation Neural Network (BPN) to classify the attacks. Furthermore, the neurons in the hidden layers of Deep Autoencoder are optimized with population based Fruitfly Optimization algorithm. Experiments have been conducted on NSL_KDD and UNSW-NB15 dataset. The computational results of the proposed intrusion detection system using deep autoencoder with BPN are compared with Naive Bayes, Support Vector Machine (SVM), Radial Basis Function Network (RBFN), BPN, and Autoencoder with Softmax.Article HighlightsA hybridized model using Deep Autoencoder with Fruitfly Optimization is introduced to classify the attacks.Missing values have been imputed with the Fuzzy C-Means Rough Parameter method.The discriminate features are extracted using Deep Autoencoder with more hidden layers.

Void Hole Avoidance Based on Sink Mobility and Adaptive Two Hop Vector-Based Forwarding in Underwater Wireless Sensor Networks

Underwater Wireless Sensor Network (UWSN) accomplishes the consideration of a few scientists and academicians towards itself. Because of the brutality of the climate lies submerged represents various difficulties, i.e., high transmission delay, outstanding piece mistake rate, more expense in usage, sinks development and energy imperatives, unequal surface highlights of an area and low data transfer capacity, and so forth Void opening evasion is compulsory for to motivation behind limiting the utilization of energy and amplifying throughput and region inclusion. In this exploration work, the creator planned plans for void opening shirking initial one is, Avoiding Void Hole Adaptive Hop by Hop Vector-Based Forwarding (AVH-AHH-VBF) in submerged remote sensor organization and a second plan for limiting utilization of energy and expanding the lifetime of the organization, Sink Mobility-Adaptive Hop by Hop Vector-Based Forwarding (SM-AHH-VBF). Reproduction results show that our plans beat contrasted and standard arrangement as far as normal Packet Delivery Ratio (PDR), energy charge. Our reproduction confirms the effectiveness of our proposed procedure AVH-AHH-VBF equivalents to 0.17 and SM-AHH-VBF equivalents to 0.24 regarding normal PDR, AVH-AHH-VBF equivalents to 24j and SM-AHH-VBF equivalents to 5j for the normal energy charge, AVH-AHH-VBF had a tradeoff of 63% in light of considering two jumps and SM-AHH-VBF approaches 20% tradeoff for normal start to finish.

Deployment of Robust Security Scheme in SDN Based 5G Network over NFV Enabled Cloud Environment

In this Modern era, Software Defined Network (SDN), Network Function Virtualization (NFV), and cloud computing participating of Fifth Generation (5G) network emergence. This paper presents a robust security scheme to provide fortification against major threats along with user privacy in 5G network, two additional entities are introduced. For mobile users, initial authentication is provided at access points by an inventive Highly Secured Authentication and Handover Mechanism (HS-AOHM) scheme which minimizes handover latency without loss of user privacy. Then the authorized user packets are arrived at dispatcher in which a novel Tree Based Switch Assignment (TBSA) algorithm is incorporated. TBSA mitigates the flow table overloading attack by assigning packets to underloaded switches. In controller, DDoS attack is detected with the assist of entropy analysis. Then the suspicious packets are redirected to scrubbing Virtual Network Function (sVNF) in cloud. In sVNF, suspicious packets are classified into normal packets and malicious packets by using Hybrid Fuzzy with Artificial Neural Network (HF-ANN) classifier based on packet features. Normal packets are allowed to access applications whereas malicious packets are dropped at sVNF. Extensive simulation shows security improvement in 5G network in terms of handover latency, holding time, switch failure rate, detection accuracy, and delay.

Improved feature selection method for features reduction in intrusion detection systems

Many methods have been used to build intrusion detection system based on the intended aim to be achieved in with the selected method. The hybrid methods (more than one method) usually gives better results and accuracy. The recent developments and popularization of network &amp; information technologies have necessitated the need for network information security. Human-based smart intrusion detection systems (IDSs) are built with the capability to either warn or intercept network intrusion; this is not possible with the conventional network security systems. However, most information security studies have focused on improvement of the effectiveness of smart network IDSs. This study used TLBO algorithm as a feature selection algorithm to choose the best subset features and SVM classifier to classify the packet if it is intrusion or normal packet, two machine learning datasets used to test the proposed algorithm, the results show that the proposed algorithm perform better than many of the existing work in IDS.

Detection Technique and Mitigation Against a Phishing Attack

Wireless networking is a main part of our daily life during these days, each one wants to be connected. Nevertheless, the massive progress in the Wi-Fi trends and technologies leads most people to give no attention to the security issues. Also detecting a fake access point is a hard security issue over the wireless network. All the currently used methods are either in need of hardware installation, changing the protocol or needs analyzing frames. Moreover, these solutions mainly focus on a single digital attack identification. In this paper, we proposed an admin side way of detection of a not real access point. That works on multiple cyber-attacks especially the phishing attack. We shed the light on detecting WI-phishing or Evil Twin, DE authentication attack, KARMA attack, advanced WI-phishing attack and differentiate them from the normal packets. By performing the frame type analysis in real time and analyzing different static and dynamic parameters as any change in the static features will be considered as an evil twin attack. Also, providing that the value of the dynamic parameters surpasses the threshold, it reflects Evil Twin. The detector has been tested experimentally and it reflects average accuracy of 94.40%, 87.08% average precision and an average specificity of 96.39% for the five types of attack.

PACKET THRESHOLD ALGORITHM COUPLED WITH MACHINE LEARNING FOR DDoS CLASSIFICATION ATTACKS

Today, DDoS attacks are the most common Internet threats. DDoS attacks are generated by attackers from anywhere to disable a company's servers from being accessed by users worldwide. An attacker can easily launch one or more types of DDoS attacks at a time. DDoS attacks that can be generated by attackers include Slowloris, UDP flood, Smurf, HTTP flood, TCP SYN flood and more. Therefore, we have proposed a technique called the Packet Threshold Algorithm (PTA) in this paper, where it is combined with several machine learning to classify normal packet and DDoS attacks, namely UDP flood, Smurf, TCP SYN flood and Ping of Death. There are four machine learning, which are K-Nearest Neighbor (KNN), Naïve Bayes, Logistic Regression and Support Vector Machine (SVM) combined with the Packet Threshold Algorithm (PTA) to reduce the false positive rate to obtain high detection accuracy. Among the four combinations of techniques, PTA-KNN has been considered the best technique in the context of the reduction of false positive rates. The determination of this best technique is based on the PTA-KNN has achieved the highest detection accuracy (99.83%) compared to the other three techniques with only a 0.02% false positive rate. The determination of this best technique is based on the PTA-KNN has achieved the highest detection accuracy (99.83%) compared to the other three techniques with only a 0.02% false positive rate.