Suspicious Users Research Articles

Proactive Eavesdropping via Jamming in NOMA Network

Recently, non-orthogonal multiple access (NOMA) has been considered as a promising technique in 5G network, and many investigations have addressed on the physical layer security to improve the security performance. In this paper, an alternative problem, where the eavesdropping process is considered as a legal activity, will be analyzed to track suspicious communications. More specifically, we study a wireless surveillance system in which the legitimate monitor is equipped with multi-antenna to overhear the messages between the suspicious receiver and the suspicious transmitter. Suspicious users are grouped into pairs and use the NOMA technique to transmit signals to a suspicious base station. Meanwhile, the legitimate monitor (LM) simultaneously transmits jamming signals, listens to suspicious links, decode-and-forward (DF) the eavesdropped information to the legitimate eavesdropper (LE). Based on the proposed mechanism, we investigate the power allocation policies for jamming signals of the legitimate monitor under deterministic and non-deterministic interference channel. Accordingly, we derive the closed-form expression of the successful eavesdropping probability for the best and the worst user to evaluate the system performance. Monte Carlo simulations are provided to verify our analytical results.

Detecting malicious users in the social networks using machine learning approach

Social networking plays a very important role in today's life. It helps to share ideas, information, multimedia messages and also provides the means of communication between the users. The popular social medias such as Facebook, Twitter, Instagram, etc., where the billions of data are being created in huge volume. Every user has their right to use any social media and a large number of users allowed malicious users by providing private or sensitive information, which results in security threats. In this research, they are proposing an natural language processing (NLP) technique to find suspicious users based on the daily conversations between the users. They demonstrated the behaviour of each user through their anomaly activities. Another machine learning technique called support vector machine (SVM) classifiers to detect the toxic comments in the comments blog. In this paper, the preliminary work concentrates on detecting the malicious user through the anomaly activities, behaviour profiles, messages and comment section.

Implementation of a Centralized Reference Database for GSM Service Providers in Nigeria

The advent of Global System for Mobile communication also known as GSM in Nigeria (although has provided Nigerians with effective telecommunication services) leveraged many societal ills. This has not only complicated the security problem in the country; it has also affected the economy negatively. To effectively and efficiently check these ills, a centralized referenced database for all the GSM operators in the country is of utmost important. This study is concerned with the design and implementation of a simulated centralized reference database for GSM providers in Nigeria. The traditional individual operator’s databases have not been efficient in providing access points that could allow security and regulatory bodies to monitor at real time, the activities of suspicious users. This study simulated a centralized reference database for GSM providers in Nigeria because of their cost implication. The Object-Oriented System Analysis and Design Methodology (OOSADM) were used for the analysis while the implementation was done using HTML, CSS, PHP and MYSQL database technologies. The system developed, provided access points to security and regulatory agents to monitor user activities at real time. It also performs user SIM registration; sends SMS; provide call detail records; blacklist suspicious subscriber at real time and monitor processes. The test result showed that security agents were able to receive feedback from the system seconds after a user action.

Detection of Suspicious or Un-Trusted Users in Crypto-Currency Financial Trading Applications

In this age, where cryptocurrencies are slowly creeping into the banking services and making a name for them, it is becoming crucially essential to figure out the security concerns when users make transactions. This paper investigates the untrusted users of cryptocurrency transaction services, which are connected using smartphones and computers. However, as technology is increasing, transaction frauds are growing, and there is a need to detect vulnerabilities in systems. A methodology is proposed to identify suspicious users based on their reputation score by collaborating centrality measures and machine learning techniques. The results are validated on two cryptocurrencies network datasets, Bitcoin-OTC, and Bitcoin-Alpha, which contain information of the system formed by the users and the user's trust score. Results found that the proposed approach provides improved and accurate results. Hence, the fusion of machine learning with centrality measures provides a highly robust system and can be adapted to prevent smart devices' financial services.

Jamming-Assisted Legitimate Eavesdropping and Secure Communication in Multicarrier Interference Networks

This article investigates legitimate eavesdropping and secure communication in a multicarrier interference network, where a suspicious link coexists with an unsuspicious link, in the presence of a full-duplex monitor. It is assumed that the unsuspicious users (UUs) are under illegal eavesdropping threat from the suspicious users (SUs), and the monitor can send jamming signals to interfere with the SUs. The UUs are required to cooperate with the monitor for reducing the secrecy outage probability of the UUs to be lower than that without the monitor’s jamming. Under this secrecy outage constraint along with the transmit power constraints, the problem for maximizing the successful eavesdropping probability of the monitor by jointly allocating the transmit powers of the monitor and the UUs is investigated. The problem is solved with the Lagrange duality method by proving the time-sharing property holds, where two algorithms are proposed for obtaining the dual function based on the block coordinate descent method and the successive convex approximation method. Simulation results verify that the proposed algorithms are superior to the noncooperative strategy and the passive eavesdropping strategy, and achieve high successful eavesdropping probability and low secrecy outage probability simultaneously.

Proactive Eavesdropping of Suspicious Non-Orthogonal Multiple Access Networks

In this correspondence, legitimate surveillance of a downlink suspicious non-orthogonal multiple access (NOMA) network with multiple groups of suspicious users (SUs), in the presence of a full-duplex monitor equipped with a successive interference cancellation (SIC) decoder, is investigated. Proactive eavesdropping is adopted, i.e., the monitor simultaneously eavesdrops the suspicious communications, and sends jamming signals. The problem of maximizing the number of successfully eavesdropped SUs by jointly optimizing the jamming power allocation and the decoding order at the monitor is investigated considering both imperfect full-duplex self-interference cancellation, and imperfect SIC. By exploring the particular problem structure, a heuristic iterative algorithm is proposed, where the optimal decoding at the monitor is proved to be equal to that at the SUs. Extensive simulations confirm that the proposed algorithm achieves performance very close to the optimal one but with significantly lower complexity, and outperforms various benchmark algorithms.

Multi-observable reputation scoring system for flagging suspicious user sessions

Conventionally, network and cloud infrastructure security is handled by firewalls which monitor traffic and block malicious access by matching certain observables, e.g., IP, and DNS, to blacklisted entries in intelligence databases. Therefore, such an approach fails to deal with emerging threats that utilize unclassified observables, and to report suspicious activities of individual users. In this paper we propose MuSeR, a novel approach to assign reputation scores for observables, even when no prior information is available, and flag suspicious sessions by conducting inter-observable analysis of user requests. In essence, MuSeR opts to assist network and cloud administrators mitigate attacks while avoiding unwarranted blocking of benign access. MuSeR achieves such an objective by associating session reputation scores based on the trustworthiness of the user navigation pattern, and conducting dynamic analysis of individual observables involved within requests. Specifically, MuSeR employs a new machine learning model for classifying observables using features specifically chosen to factor in evidence provided by blacklists, and access patterns of known attacks. To determine a request score, MuSeR maps the classifier probabilities to adaptive subjective logic and then uses multinomial fusion to leverage evidence from the different observables. Given the request scores, MuSeR further promotes a novel session reputation scoring model that uses three-valued subjective logic to handle trust propagation and aggregation over user requests. The effectiveness ofMuSeR is validated using a large dataset obtained from popular databases such as WHOIS, CYMUS, and passive DNS databases.

Legitimate Surveillance of Suspicious Communications With QoS Guarantees for Unsuspicious Users

In this letter, legitimate surveillance of a pair of suspicious users (SUs) who shares the same spectrum with a pair of unsuspicious users (UUs), in the presence of a full-duplex monitor, is investigated. The monitor can proactively jam the suspicious communication for better eavesdropping performance. The problem of jamming transmit power optimization for maximizing the successful eavesdropping probability under the constraint that the quality of service (QoS) of the UUs is not affected, is investigated. After important properties of the problem are obtained, a high-complexity optimal algorithm and a low-complexity suboptimal algorithm are derived. The superiority of the proposed algorithms compared to the benchmark algorithm is verified by simulation results.

RETRACTED ARTICLE: SybilWatch: a novel approach to detect Sybil attack in IoT based smart health care

Internet of things (IoT) in health care is gaining popularity in the field of research to improve quality in smart health care systems and applications. However, security and privacy of Smart Health (S-Health) data are the challenging issues due to Sybil attacks. Sybil attack is one of the most common attacks where a malicious node uses morphed identities to generate Sybil nodes. Sybil nodes can acquire an authorized node identity and misbehaves by affecting its routing information, incurs interruption on communication line and storage. One of the IoT based smart health methodology is Privacy-Aware Smart Health (PASH), in which policy hiding is used to protect the privacy of users. The major issues in PASH is expensive to implement in S-Health applications, also it does not deal with attribute revocation and node traceability. To addresses these issues, a novel SybilWatch Enhanced Privacy-Aware Smart Health (E-PASH) approach is proposed in this paper. This approach has three major phases such as initialization phase, secure communication and Sybil node detection. A Lightweight Encryption Algorithm (LEA) is used to transmit SHRs (Smart Health Record) in encrypted form using prime order grouping. A novel BlueTits Detection (BTD) algorithm is used in detection phase where cluster head gathers the recent activities of the suspicious user, and based on the gathered parameters (Master key and Last One-Time Authentication), the cluster head declares it as a Sybil node. As soon as Sybil node is detected, revised revocation list is shared with active users. The proposed approach is less expensive compared to the existing approach, it also supports attribute revocation and node traceability which are the major setbacks is PASH. Simulation results and comparison analysis shows that proposed SybilWatch is efficient and cost effective compared to the existing approach, the proposed approach yields high detection rate of 99.7% and also false positive rate is reduced to 1% in the smart health systems, which is better compared to the existing approaches.

A Review of Intrusion Detection Datasets and Techniques

As network applications grow rapidly, network security mechanisms require more attention to improve speed and accuracy. The evolving nature of new types of intrusion poses a serious threat to network security: although many network securities tools have been developed, the rapid growth of intrusive activities is still a serious problem. Intrusion detection systems (IDS) are used to detect intrusive network activity. In order to prevent and detect the unauthorized access of any computer is a concern of Computer security. Hence computer security provides a measure of the level associated with Prevention and Detection which facilitate to avoid suspicious users. Deep learning have been widely used in recent years to improve intrusion detection in networks. These techniques allow the automatic detection of network traffic anomalies. This paper presents literature review on intrusion detection techniques.

Probabilistic Inference and Trustworthiness Evaluation of Associative Links toward Malicious Attack Detection for Online Recommendations

The increasing use of recommender systems as personalization recommendation services has stressed the demand for secure and usable abnormality detection techniques. With the emergence of new attacks, how to defend diverse malicious attacks for online recommendations is a challenging issue. Moreover, characterizing and evaluating sparse rating behaviors are a long-standing problem that still remains open, leading to an upsurge of research. This paper investigates probabilistic inference and trustworthiness evaluation of behavioral links according to a coupled association network converted from rating behaviors, and presents a unified detection framework from a novel perspective to spot diverse malicious threats. Firstly, an association graph is constructed from the original rating matrix based on both the inherent rating motivation of users and atomic propagation rules of coupled networks. Then, we evaluate the trustworthiness of link behaviors in the targeted network of associated cross network by exploiting a factor graph model of coupled network, and redetermine concerned links in the targeted network. Finally, suspicious users and items can be empirically inferred by comprehensively evaluating the trustworthiness of both links and nodes in the targeted network. Extensive experiments on synthetic and real-world data demonstrate the effectiveness of the proposed detection approach compared with competing benchmarks.

Wireless Surveillance With Interference Exploitation in Unauthorized Underlaid D2D Networks

Interference exploitation has been considered an effective method to improve secrecy in underlaid device-to-device (D2D) communication networks. This paper studied interference exploitation in unauthorized underlaid D2D communication networks, where a cellular user (CU) transmits uplink information to a base station (BS) and a pair of suspicious D2D users (DUs) transmit the suspicious information at the same time. We used the beamforming of the full-duplex (FD) CU to simultaneously achieve the legitimate uplink transmission of the CU and wireless surveillance on the suspicious DUs. Considering the different priority levels of the tasks, we divided the real-time quality of service (QoS) requirements of the CU into three cases and formulated the problem in each case. We derived beamforming expressions for each problem in the perfect self-interference cancellation (PSIC) and then proposed targeted algorithms in the imperfect self-interference cancellation (ISIC). Finally, simulation results are provided to validate the effectiveness and the advantages of our proposed schemes in situations with different QoS requirements.

Recommendation of sustainable economic learning course based on text vector model and support vector machine

The sustainable economic learning course recommendation can quickly find the knowledge information that the user really needs from the massive information space and realize the personalized recommendation to the user. However, the occurrence of trust attacks seriously affects the normal recommendation function of the recommendation system, resulting in its failure to provide users with reliable and reliable recommendation results. In order to solve the vulnerability of the recommendation system to the support attack, based on text vector model and support vector machine, this paper makes a comprehensive analysis of the current research status of the robust recommendation technology. Moreover, based on the idea of suspicious user metrics, this paper has conducts in-depth research on how to design highly robust recommendation algorithms, and constructs a highly reliable sustainable economic learning course recommendation model. In addition to this, this research tests the performance of the system from two perspectives of course recommendation satisfaction and system retrieval accuracy. The experiment proves that the model constructed in this paper performs well in the recommendation of sustainable economic learning courses.

Jamming-Assisted Legitimate Surveillance of Suspicious Interference Networks With Successive Interference Cancellation

This letter investigates legitimate surveillance of a suspicious interference network in the presence of a full-duplex monitor. To improve the surveillance performance, jamming from the monitor is applied to interfere with the suspicious users and successive interference cancellation (SIC) decoder is equipped at the monitor to better decode signals from multiple suspicious users. To maximize the number of successfully eavesdropped suspicious users, the jamming power as well as the SIC decoding order at the monitor are optimized. By exploring the particular problem structure, high-complexity optimal and low-complexity suboptimal algorithms are proposed. It is shown that the suboptimal algorithm is practically optimal and the proposed algorithms outperform the benchmark algorithms with conventional SIC decoding order.

A novel Kalman Filter based shilling attack detection algorithm.

Collaborative filtering has been widely used in recommendation systems to recommend items that users might like. However, collaborative filtering based recommendation systems are vulnerable to shilling attacks. Malicious users tend to increase or decrease the recommended frequency of target items by injecting fake profiles. In this paper, we propose a Kalman filter-based attack detection model, which statistically analyzes the difference between the actual rating and the predicted rating calculated by this model to find the potential abnormal time period. The Kalman Filter filters out suspicious ratings based on the abnormal time period and identifies suspicious users based on the source of these ratings. The experimental results show that our method performs much better detection performance for the shilling attack than the traditional methods.

VASABI: Hierarchical User Profiles for Interactive Visual User Behaviour Analytics.

User behaviour analytics (UBA) systems offer sophisticated models that capture users' behaviour over time with an aim to identify fraudulent activities that do not match their profiles. Motivated by the challenges in the interpretation of UBA models, this paper presents a visual analytics approach to help analysts gain a comprehensive understanding of user behaviour at multiple levels, namely individual and group level. We take a user-centred approach to design a visual analytics framework supporting the analysis of collections of users and the numerous sessions of activities they conduct within digital applications. The framework is centred around the concept of hierarchical user profiles that are built based on features derived from sessions, as well as on user tasks extracted using a topic modelling approach to summarise and stratify user behaviour. We externalise a series of analysis goals and tasks, and evaluate our methods through use cases conducted with experts. We observe that with the aid of interactive visual hierarchical user profiles, analysts are able to conduct exploratory and investigative analysis effectively, and able to understand the characteristics of user behaviour to make informed decisions whilst evaluating suspicious users and activities.

Proactive Eavesdropping With Jamming and Eavesdropping Mode Selection

In this paper, we study a legitimate proactive eavesdropping scenario where a central monitor covertly wiretaps the communications between a pair of suspicious users via multiple intermediate nodes. For this system, it is necessary to ensure the eavesdropping channel capacity higher than the data rate of the suspicious users so that the central monitor can reliably decode the intercepted information. To this end, the intermediate nodes operate in either eavesdropping or jamming modes. The eavesdropping nodes forward the intercepted data from the suspicious users to the central monitor, while the jamming nodes transmit jamming signals to control the data rate of the suspicious users if necessary. We optimize the mode selection and transmit power of each intermediate node to achieve the maximum eavesdropping rate. Two different scenarios are investigated, in which the intermediate nodes communicate with the central monitor through wired links or wireless channels. For both configurations, globally optimal solutions are developed for joint mode selection and transmit power optimization problems. We also propose low-complexity methods which achieve near-optimal performance with reduced computational complexity. The numerical results validate the efficiency of our proposed algorithms.

Detecting shilling attacks in social recommender systems based on time series analysis and trust features

In social recommender systems or trust-based recommender systems, malicious users can bias the recommendations by injecting a large number of fake profiles and by building bogus trust relationships. The existing shilling attack detection methods suffer from low precision when detecting attacks in social recommender systems because they focus mainly on the rating pattern differences between attack profiles and genuine ones and ignore the trust relationships between users. In this paper, we propose an approach for detecting shilling attacks in social recommender systems based on time series analysis and trust features (TSA–TF). Firstly, we construct rating distribution time series for items and propose a dynamic rating distribution prediction model to detect suspicious items by using a single exponential smoothing method. Then, we filter out a part of genuine user profiles by analyzing suspicious items and obtain the set of suspicious user profiles. Secondly, we propose four features by combining rating patterns and trust relationships and train a support vector machine (SVM) classifier to discriminate attack profiles in the set of suspicious user profiles. Experiments on the CiaoDVD dataset and Epinions dataset show that the proposed approach can improve the detection precision while maintaining a high recall.

HAP: detection of HTTP flooding attacks in cloud using diffusion map and affinity propagation clustering

The extreme growth of Internet resources leads to several kinds of attacks. Cybercrime is one of the dominant threats apart from data defence mechanism, which enhances the economy, resource management, and service quality. Among them, HTTP flooding attacks in the cloud are one of the most prevalent threats as it depletes the cloud resources and services. It is difficult to distinguish the anomalous traffic by extracting the actual payload since most of the payload could not be accessed as they are encrypted and varies dynamically based on the user input. Hence, the proposed method uses web server logs that can be easily accessed to detect the attacks. This study highlights the detection methods by extracting the features from the web server logs and also deals with the reduction in the dimensionality of the features using diffusion map. The anomalies are detected by affinity propagation clustering technique and also by monitoring the status of the virtual machine. Furthermore, the Dempster-Shafer theory focuses on the identification of the suspicious user. It is inferred from the experimental results that the proposed method enhances the detection performance with very few false alarms than existing methods.

Detecting shilling attacks in recommender systems based on analysis of user rating behavior

The existing unsupervised methods for detecting shilling attacks are mostly based on the rating patterns of users, ignoring the rating behavior difference between genuine users and attack users, and these methods suffer from low accuracy in detecting various shilling attacks without a priori knowledge of the attacks. To address these limitations, we propose a novel unsupervised shilling attack detection model based on an analysis of user rating behavior. First, we identify the target item(s) and the corresponding intentions of the attack users by analyzing the deviation of rating tendencies on each item, and based on this analysis, a set of suspicious users is constructed. Second, we analyze the users’ rating behaviors from an interest preference and rating preference perspective. In particular, we measure the diversity and memory of users’ interest preferences by entropy and block entropy, respectively, and we analyze the memory of user rating preferences by a self-correlation analysis. Finally, we calculate the suspicious degree and spot attack users in the set of suspicious users based on measurements of user rating behavior. Experimental results on the Netflix dataset, the MovieLens 1M dataset and the sampled Amazon review dataset demonstrate the effectiveness of the proposed detection model.