Prediction Of Cyber-attacks Research Articles

Novel adaptive cyberattack prediction model using an enhanced genetic algorithm and deep learning (AdacDeep)

ABSTRACT Some of the problems of extant cyberattack prediction approaches are low prediction accuracy, high false positive rate, very long training time, and the choice of hyperparameters to overcome overfitting or under fitting the model on the training data. These problems have culminated in the escalation of cyberattacks in recent times and as such significant improvement to the performance of extant models is crucial. Some deep learning architectures such as Recurrent Neural Networks (RNN) have been applied to cyberattack prediction. However, Recurrent Neural Networks (RNN) suffer from the vanishing and exploding gradient problem, and are difficult to train. Also, determining the different states and hyperparameters of the network for optimal prediction performance is difficult. Therefore, this paper proposes a novel approach called AdacDeep that uses an Enhanced Genetic Algorithm (EGA), Deep Autoencoder and a Deep Feedforward Neural Network (DFFNN) with backpropagation learning to accurately predict different attack types. The performance of AdacDeep is evaluated using two well-known datasets, namely, the CICIDS2017 and UNSW_NB15 datasets as the benchmark. The experimental results show that AdacDeep outperforms other state-of-the-art comparative models in terms of prediction accuracy with 0.22–35% improvement, F-Score with 0.1–34.7% improvement and very low false positive rate.

Security Enhancement Framework through Cyber Attack Prediction based on Attacker Attack Tool

Security Enhancement Framework through Cyber Attack Prediction based on Attacker Attack Tool

Cyberthreat risk identification based on constructing entity-event ontologies from publicly available texts

Aim . Out of the currently used methods of ensuring cyber security the most productive ones are traffic analysis, malware detection, denial of unauthorized access to internal networks, incident analysis and other methods of corporate perimeter protection. The efficiency of such methods however depends on the timeliness and quality of threat data. The Aim of the paper is to study the ways of improving the cyber threat awareness and capabilities to analyze texts in open sources for the purpose of cyberattack prediction, identification and monitoring of new threats, detection of zero-day vulnerabilities before they are made public and leaks are discovered. Methods. Publicly available knowledge on cyber security is acquired through continuous collection of data from the Internet (including fragments of its non-indexed part and specialized sources) and other public data networks (including a large number of specialized resources and sites in the TOR network). The collected texts in various languages are analyzed using methods of natural language processing for the purpose of extracting entities and events that are then grouped into canonical entities and events, and all of that information is used for continuous updating of a subject-matter event-entity ontology. It includes general forms of entities and events required for the context and specialized forms of events and entities for purposes of cyber security (technical identifiers, attack vectors, attack surfaces, hashes, identifiers, etc.) Such ontology can function as a knowledge base and be used for structured queries by cyber security analysts. Results. The proposed method and the system based upon it can be used for analyzing computer security information, monitoring, detection of zero-day vulnerabilities before they are made public and leaks are discovered. The information retrieved by the system can be used as highly informative features in statistical models. The latter served as the basis for a classifier that defines the risk of exploits for a specific vulnerability, as well as an IP address scoring system that can be used for automatic blocking. Additionally, a method was developed for risk-based ranking of events and entities associated with cyber threats that allows identifying – within the abundance of available information – the entities and events that require special attention, as well as taking timely and appropriate preventive measures. Conclusion. The proposed method is of direct practical value as regards the problems of analytics, risk-based ranking and monitoring of cyber threats, and can be used for the analysis of large volumes of text-based information and creation of informative features for improving the quality of machine learning models used in computer security.

Conceptualisation of Cyberattack prediction with deep learning

The state of the cyberspace portends uncertainty for the future Internet and its accelerated number of users. New paradigms add more concerns with big data collected through device sensors divulging large amounts of information, which can be used for targeted attacks. Though a plethora of extant approaches, models and algorithms have provided the basis for cyberattack predictions, there is the need to consider new models and algorithms, which are based on data representations other than task-specific techniques. Deep learning, which is underpinned by representation learning, has found widespread relevance in computer vision, speech recognition, natural language processing, audio recognition, and drug design. However, its non-linear information processing architecture can be adapted towards learning the different data representations of network traffic to classify benign and malicious network packets. In this paper, we model cyberattack prediction as a classification problem. Furthermore, the deep learning architecture was co-opted into a new model using rectified linear units (ReLU) as the activation function in the hidden layers of a deep feed forward neural network. Our approach achieves a greedy layer-by-layer learning process that best represents the features useful for predicting cyberattacks in a dataset of benign and malign traffic. The underlying algorithm of the model also performs feature selection, dimensionality reduction, and clustering at the initial stage, to generate a set of input vectors called hyper-features. The model is evaluated using CICIDS2017 and UNSW_NB15 datasets on a Python environment test bed. Results obtained from experimentation show that our model demonstrates superior performance over similar models.

Deep learning model for preicting multistage cyber attacks

The prediction of cyberattacks has been a major concern in cybersecurity. This is due to the huge financial and resource losses incurred by organisations after a cyberattack. The emergence of new applications and disruptive technologies has come with new vulnerabilities, most of which are novel – with no immediate remediation available. Recent attacks signatures are becoming evasive, deploying very complex techniques and algorithms to infiltrate a network, leading to unauthorized access and modification of system parameters and classified data. Although there exists several approaches to mitigating attacks, challenges of using known attack signatures and modeled behavioural profiles of network environments still linger. Consequently, this paper discusses the use of unsupervised statistical and supervised deep learning techniques to predict attacks by mapping hyper-alerts to class labels of attacks. This enhances the processes of feature extraction and transformation, as a means of giving structured interpretation of the dynamic profiles of a network.Keywords: Alert correlation, Cyberattack prediction, Cybersecurity, Deep learning, Cyberattacks, Supervised and Unsupervised LearningVol. 26 No 1, June 2019

A Novel PCA-Firefly Based XGBoost Classification Model for Intrusion Detection in Networks Using GPU

The enormous popularity of the internet across all spheres of human life has introduced various risks of malicious attacks in the network. The activities performed over the network could be effortlessly proliferated, which has led to the emergence of intrusion detection systems. The patterns of the attacks are also dynamic, which necessitates efficient classification and prediction of cyber attacks. In this paper we propose a hybrid principal component analysis (PCA)-firefly based machine learning model to classify intrusion detection system (IDS) datasets. The dataset used in the study is collected from Kaggle. The model first performs One-Hot encoding for the transformation of the IDS datasets. The hybrid PCA-firefly algorithm is then used for dimensionality reduction. The XGBoost algorithm is implemented on the reduced dataset for classification. A comprehensive evaluation of the model is conducted with the state of the art machine learning approaches to justify the superiority of our proposed approach. The experimental results confirm the fact that the proposed model performs better than the existing machine learning models.

사이버 공격예측 및 대응을 위한 유연적 시험환경 구축

최근 사이버 공격은 공격자 및 적용기술에 따라 다양한 전략 · 전술 · 절차적 특징을 갖고 있으며, 사이버 공격기술 또한 빠르게 변화하고 있다. 이와 같은 상황에서 사이버 공격 특징을 분석하고 공격을 예측하며, 각 공격 절차의 변화에 대응할 수 있는 시험환경 구축이 필요하다. 본 논문에서는 빠르게 변화하고 있는 사이버 공격을 분석 · 예측하고 검증할 수 있는 보다 유연한 시험환경을 제공하기 위해 테스트베드 상에서 모의공격자가 공격을 수행하는 방안, 테스트베드 상에서 모의공격자 대신 위협모의기를 통하여 공격을 수행하는 방안, 테스트베드 없이 수집된 정보와 에뮬레이션 SW를 활용하는 방안 등 세 가지 형태의 시험환경 구축 방안을 제시하였다. 시험 단계 및 환경에 따라 적합한 구성 방안을 선택하여 유연하게 시험에 적용할 수 있다.

A cloud-edge based data security architecture for sharing and analysing cyber threat information

Cyber-attacks affect every aspect of our lives. These attacks have serious consequences, not only for cyber-security, but also for safety, as the cyber and physical worlds are increasingly linked. Providing effective cyber-security requires cooperation and collaboration among all the entities involved. Increasing the amount of cyber threat information (CTI) available for analysis allows better prediction, prevention and mitigation of cyber-attacks. However, organizations are deterred from sharing their CTI over concerns that sensitive and confidential information may be revealed to others. We address this concern by providing a flexible framework that allows the confidential sharing of CTI for analysis between collaborators. We propose a five-level trust model for a cloud-edge based data sharing infrastructure. The data owner can choose an appropriate trust level and CTI data sanitization approach, ranging from plain text, through anonymization/pseudonymization to homomorphic encryption, in order to manipulate the CTI data prior to sharing it for analysis. Furthermore, this sanitization can be performed by either an edge device or by the cloud service provider, depending upon the level of trust the organization has in the latter. We describe our trust model, our cloud-edge infrastructure, and its deployment model, which are designed to satisfy the broadest range of requirements for confidential CTI data sharing. Finally we briefly describe our implementation and the testing that has been carried out so far by four pilot projects that are validating our infrastructure.

From product recommendation to cyber-attack prediction: generating attack graphs and predicting future attacks

Modern information society depends on reliable functionality of information systems infrastructure, while at the same time the number of cyber-attacks has been increasing over the years and damages have been caused. Furthermore, graphs can be used to show paths than can be exploited by attackers to intrude into systems and gain unauthorized access through vulnerability exploitation. This paper presents a method that builds attack graphs using data supplied from the maritime supply chain infrastructure. The method delivers all possible paths that can be exploited to gain access. Then, a recommendation system is utilized to make predictions about future attack steps within the network. We show that recommender systems can be used in cyber defense by predicting attacks. The goal of this paper is to identify attack paths and show how a recommendation method can be used to classify future cyber-attacks in terms of risk management. The proposed method has been experimentally evaluated and validated, with the results showing that it is both practical and effective.

Contextual information fusion for intrusion detection: a survey and taxonomy

Research in cyber-security has demonstrated that dealing with cyber-attacks is by no means an easy task. One particular limitation of existing research originates from the uncertainty of information that is gathered to discover attacks. This uncertainty is partly due to the lack of attack prediction models that utilize contextual information to analyze activities that target computer networks. The focus of this paper is a comprehensive review of data analytics paradigms for intrusion detection along with an overview of techniques that apply contextual information for intrusion detection. A new research taxonomy is introduced consisting of several dimensions of data mining techniques, which create attack prediction models. The survey reveals the need to use multiple categories of contextual information in a layered manner with consistent, coherent, and feasible evidence toward the correct prediction of cyber-attacks.

Designing a monitoring model for cluster super–computers

Recently there has been an increase in the number of cyber attacks against computational systems. Growth in the amounts of information that passes through computational clusters and savings on staff requires an application of effective means of monitoring computational resources for the purpose of prediction and elimination of cyber attacks. An analysis of hacker attacks revealed that the break-in was not detected by technical equipment. We examined a concept of building existing systems of monitoring of cluster super-computers. Deficiencies are established in the monitoring systems, which lead not only to the reduction in efficiency of computational clusters but to their safety violations. We described a formal model for the detection of anomalies in the functioning of a computational cluster. The model is the sets of the states of the system depending on functional tasks, it separates processes of targeted functioning of the system from the interface processes of interaction with the network infrastructure and provides for the possibility of their use in neural network technology for detecting anomalies in the functioning of a computational cluster. This model makes it possible to locally control parameters for each process and, based on the formed vector, to detect anomalous influence on the system as a whole. Data of the study can be used for the improvement of already existing subsystems of monitoring of super-computer technologies, as well as form a foundation for creating fundamentally new neural network multi-agent system of monitoring of the detection of anomalous incidents in the performance of computational clusters.

Design of Prevent Quantification Model for APT Attack in Smart Meter

Recently, not only technological engineering techniques as well as social engineering have been applied to target attacks such as APT. The security system to prevent cyber-attack against smart meter must consider the smart meter environment and also apply cognition and behavior pattern of the attacker from both technical and social engineering perspective and quantified prediction of flexible and strategic cyber-attacks should precede it. Therefore, in this paper, a model was designed to quantify APT attack on smart grid in advance.

Defending Cross Site Reference Forgery (CSRF) Attacks on Contemporary Web Applications Using a Bayesian Predictive Model

This work presents specific solutions to defend a recent, not very well understood web vulnerability known as the Cross Site Reference Forgery (CSRF). A methodical approach is used to investigate CSRF attacks and propose remedies by introducing a novel and distinctive variation of the well recognized Bayesian Belief Networks (BBN). Critical networks and infrastructures are susceptible to disruptions and industrial espionage under a coordinated CSRF attack. The threat to launch CSRF attacks from a network of thousands of malicious machines is a real threat to the national and commercial cyber security of honest web applications. Some high profile CSRF reported attacks include: ING Direct (Attacker opens additional accounts on behalf of an authenticated user and transfers funds from a user's account to the attacker's account); YouTube (Nearly every action a user can perform on YouTube is hijacked by the attacker); MetaFilter (Allowed an attacker to take control of a user's account); The New York Times (User email addresses, identity and profiles accessed by the attacker, sent spam). Additionally, known CSRF vulnerabilities have also been reported with Google’s Gmail service, in a banking application in Korea, etc. The urgency to come up with appropriate defense mechanism against the lethal CSRF attacks is indicated due to expanding cloud based technologies, HTML5, Semantic Web, and various emerging security frameworks comprised of inchoate vestigial of “Big Data” that demand exceedingly evolved defense mechanisms. In this paper, we present a BBN Predictive Model (BPM) to detect, predict and provide solutions for CSRF attacks on contemporary Web Applications and Web Services environment. While some remedies have been proposed recently, they rely mostly on server side implementations. There are significant disadvantages of server-side countermeasures in that they require modifications of server-side programs which bear a direct operational impact in terms of performance and maintenance. Updating and modifying servers may cost too much and take long time before a substantial fraction of the web gets updated. A more attractive idea, perused in this work, is that CSRF countermeasures can be applied on the client-side, as browser extensions. The basic idea is simple: the browser can strip session and authentication information from malicious requests, or it can block such requests altogether. However, the difficulty is in determining a malicious request with confidence. There is a compelling case to use Bayesian approach for augmenting the full functionality of the proposed BPM defense model. A significant volume of research provides number of qualities that recommend Bayesian reasoning as the foundation for determining the confidence level in scenarios where a decision has to be made to proceed to the next level, as is the case in the proposed CSRF model. The most often cited quality is the ability to include prior information, as well as its capacity to simplify the logic of building a coherent system. While describing empirical approaches in the design and development of the BPM model, the paper attempts to answer the following: 1. What is the current state of prediction and detection of cyber attacks on contemporary web applications and services? 2. How does a CSRF attack take place? What are known mitigation approaches? 3. How does a Bayesian Belief Network provide a useful and robust detection and defensive mechanism against CSRF attacks?The paper concludes with recommendations and guidelines for future extensions including the design and development of browser based plug, comparing the performance of BPM with other known models for CSRF defense, extending BPM scope in the areas of client based cyber and local security.

COMPUTER INTRUSION DETECTION WITH CLASSIFICATION AND ANOMALY DETECTION, USING SVMs

This paper describes experiences and results applying Support Vector Machine (SVM) to a Computer Intrusion Detection (CID) dataset. First, issues in supervised classification are discussed, then the incorporation of anomaly detection enhancing the modeling and prediction of cyber-attacks. SVM methods are seen as competitive with benchmark methods and other studies, and are used as a standard for the anomaly detection investigation. The anomaly detection approaches compare one class SVMs with a thresholded Mahalanobis distance to define support regions. Results compare the performance of the methods and investigate joint performance of classification and anomaly detection. The dataset used is the DARPA/KDD-99 publicly available dataset of features from network packets, classified into nonattack and four-attack categories.