Traffic Anomalies Research Articles

A Deep Learning Assisted Software Defined Security Architecture for 6G Wireless Networks: IIoT Perspective

The 6G wireless network is expected to drive cyber-physical systems (CPS) from merely connected things to securely connected intelligence. While 6G will offer real-time communication between cyber and physical entities, due to convergence of operational technology (OT) and information technology (IT) networks, security, and trustworthiness of the massive amount of data shared between cyber and physical entities will remain of great concern. Attackers having AI capability will be able to mount massive numbers of automated and novel attacks on the future 6G network. Human security specialists teaming with an AI-powered adaptive defense mechanism will be needed to counter emerging AI-based attacks on the massively connected CPS through 6G wireless networks. 6G networks are expected to add industrial immunity to IT, OT, and IIoT networks with the help of AI. 6G is expected to offer deep learning (DL) assisted security function virtualization (SFV) to support software defined security (SDS) architecture for dynamic defense mechanisms, intelligently monitor network traffic anomalies at different network endpoints and segments, and offer increased visibility across attack surfaces. In this article, we study the security challenges in 6G networks posed by the recent convergence of OT and IT networks and propose distributed DL-assisted SDS for 6G vertical that will autonomously detect, localize, and isolate security threats via SFV. Finally, we present future directions and the challenges ahead.

Traffic Anomaly Detection Model Using K-Means and Active Learning Method

Traffic Anomaly Detection Model Using K-Means and Active Learning Method

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

With an increase in the number and types of network attacks, traditional firewalls and data encryption methods can no longer meet the needs of current network security. As a result, intrusion detection systems have been proposed to deal with network threats. The current mainstream intrusion detection algorithms are aided with machine learning but have problems of low detection rates and the need for extensive feature engineering. To address the issue of low detection accuracy, this paper proposes a model for traffic anomaly detection named a deep learning model for network intrusion detection (DLNID), which combines an attention mechanism and the bidirectional long short-term memory (Bi-LSTM) network, first extracting sequence features of data traffic through a convolutional neural network (CNN) network, then reassigning the weights of each channel through the attention mechanism, and finally using Bi-LSTM to learn the network of sequence features. In intrusion detection public data sets, there are serious imbalance data generally. To address data imbalance issues, this paper employs the method of adaptive synthetic sampling (ADASYN) for sample expansion of minority class samples, to eventually form a relatively symmetric dataset, and uses a modified stacked autoencoder for data dimensionality reduction with the objective of enhancing information fusion. DLNID is an end-to-end model, so it does not need to undergo the process of manual feature extraction. After being tested on the public benchmark dataset on network intrusion detection NSL-KDD, experimental results show that the accuracy and F1 score of this model are better than those of other comparison methods, reaching 90.73% and 89.65%, respectively.

Aggregated Traffic Anomaly Detection Using Time Series Forecasting on Call Detail Records

Mobile network operators store an enormous amount of information like log files that describe various events and users’ activities. Analysis of these logs might be used in many critical applications such as detecting cyber attacks, finding behavioral patterns of users, security incident response, and network forensics. In a cellular network, call detail records (CDRs) is one type of such logs containing metadata of calls and usually includes valuable information about contacts such as the phone numbers of originating and receiving subscribers, call duration, the area of activity, type of call (SMS or voice call), and a timestamp. With anomaly detection, it is possible to determine abnormal reduction or increment of network traffic in an area or for a particular person. This paper’s primary goal is to study subscribers’ behavior in a cellular network, mainly predicting the number of calls in a region and detecting anomalies in the network traffic. In this paper, a new hybrid method is proposed based on various anomaly detection methods such as GARCH, K-means, and neural network to determine the anomalous data. Moreover, we have discussed the possible causes of such anomalies.

CPA-MAC: A Collision Prediction and Avoidance MAC for Safety Message Dissemination in MEC-Assisted VANETs

Vehicular ad hoc networks (VANETs) have been widely recognized as a promising solution to improve traffic safety and efficiency for the ability to provide situation awareness even though the potential dangers and traffic anomalies are out of the visual range. In VANETs, time-division multiple access (TDMA) based overlay protocols can prevent transmission collisions and play an important role in providing an efficient communication channel. However, due to high vehicle mobility and time-varying traffic flow, the existing TDMA-based slot allocation approaches cannot fully utilize the channel resources, resulting in high transmission delay and packet collision. To overcome these shortcomings, we propose a collision prediction and avoidance MAC (CPA-MAC) protocol that utilizes the capability of mobile edge computing (MEC) and machine learning in this paper. Specifically, we propose a new slot assignment method that aims to guarantee the high channel utilization and low delay of safety message under dynamic traffic conditions. Furthermore, we propose a new same-direction collisions prediction algorithm that combines the V2R communication and LSTM-based trajectory prediction algorithm. Finally, we conduct extensive experiments to demonstrate the effectiveness of the proposed protocol.

Anomaly Detection Using Hybrid Neuro Genetic Model

With a steady increase in the population of Internet users, a plethora of network services have emerged on the global level. As an offshoot of this phenomenal rise in network services and their capabilities riding on the wave of internet, we are witnessing a massive risk of attacks on network security. Many security vulnerabilities are exposed and exploited by attackers, endangering the safety of massive amounts of data. To improve a network’s effectiveness, it’s critical to detect network traffic anomalies accurately and quickly. A new hybrid model that effectively detects anomalies in network services is proposed in this work. The genetic phase and NN phase represent the 2-phased approach making each one dependent on the other for weight assignment and prediction. The genetic phase generates optimal weights for classification of normal and anomaly patterns. The NN phase learns the input output relationship of network patterns employing GA in the training phase. Detection is accomplished using trained NN and it utilizes pre-processed KDD dataset containing normal and abnormal samples for training. The outcomes demonstrated that the suggested approach outperforms all other algorithms.

Combining Unsupervised Approaches for Near Real-Time Network Traffic Anomaly Detection

The 0-day attack is a cyber-attack based on vulnerabilities that have not yet been published. The detection of anomalous traffic generated by such attacks is vital, as it can represent a critical problem, both in a technical and economic sense, for a smart enterprise as for any system largely dependent on technology. To predict this kind of attack, one solution can be to use unsupervised machine learning approaches, as they guarantee the detection of anomalies regardless of their prior knowledge. It is also essential to identify the anomalous and unknown behaviors that occur within a network in near real-time. Three different approaches have been proposed and benchmarked in exactly the same condition: Deep Autoencoding with GMM and Isolation Forest, Deep Autoencoder with Isolation Forest, and Memory Augmented Deep Autoencoder with Isolation Forest. These approaches are thus the result of combining different unsupervised algorithms. The results show that the addition of the Isolation Forest improves the accuracy values and increases the inference time, although this increase does not represent a relevant problematic factor. This paper also explains the features that the various models consider most important for classifying an event as an attack using the explainable artificial intelligence methodology called Shapley Additive Explanations (SHAP). Experiments were conducted on KDD99, NSL-KDD, and CIC-IDS2017 datasets.

Research and Design of Optimal Solution for Network Traffic Anomaly based on Multi-objective Decision Algorithm

To help maintainers recover from network outages caused by network traffic anomalies, the paper proposes an optimal solution for network traffic anomaly based on multi-objective decision algorithm. It is achieved by combining network traffic anomaly detection with multi-objective decision algorithm, while meeting the objectives of the shortest recovery time, the minimum reduction of security protection and the maximum consistency with the original mode.

Traffic Anomaly Prediction Based on Joint Static-Dynamic Spatio-Temporal Evolutionary Learning

Accurate traffic anomaly prediction offers an opportunity to save the wounded at the right location in time. However, the complex process of traffic anomaly is affected by both various static factors and dynamic interactions. The recent evolving representation learning provides a new possibility to understand this complicated process, but with challenges of imbalanced data distribution and heterogeneity of features. To tackle these problems, this paper proposes a spatio-temporal evolution model named SNIPER for learning intricate feature interactions to predict traffic anomalies. Specifically, we design spatio-temporal encoders to transform spatio-temporal information into vector space indicating their natural relationship. Then, we propose a temporally dynamical evolving embedding method to pay more attention to rare traffic anomalies and develop an effective attention-based multiple graph convolutional network to formulate the spatially mutual influence from three different perspectives. The FC-LSTM is adopted to aggregate the heterogeneous features considering the spatio-temporal influences. Finally, a loss function is designed to overcome the 'over-smoothing' and solve the imbalanced data problem. Extensive experiments show that SNIPER averagely outperforms state-of-the-arts by 3.9%, 0.9%, 1.9% and 1.6% on Chicago datasets, and 2.4%, 0.6%, 2.6% and 1.3% on New York City datasets in metrics of AUC-PR, AUC-ROC, F1 score, and accuracy, respectively.

Research and Application of Network Anomaly Traffic Detection System

This paper puts forward a network security computing platform which based on the open source big data technology. This network anomaly traffic detection system includes a comprehensive and effective traffic anomaly detection algorithm. The algorithm combines the exponentially weighted moving average algorithm (EWMA) and the anomaly flow interval mapping algorithm two methods. The test experiments contain the physical cluster building parameters, the performance of the system and the DDoS attack verification. It is verified by the Tianjin Education metropolitan area network traffic and the NSFOCUS against denial attack event log service system (NSFOCUS ANTI-DDoS system). In Particular, the network anomaly traffic detection system can accurately identify the occurrence period of anomaly traffic such as the flow direction and the event priority. What’ more, it has strong fault tolerance which can achieve error recovery in a short time. All the test experiment results can verify that the system can effectively detect anomaly traffic and real-time monitor the dynamic network.

A Multicriteria-Based Forwarding Strategy for Interest Flooding Mitigation on Named Data Wireless Networking

In wireless networks, the Named Data Networking (NDN) architecture maximizes contents' availability throughout multiple network paths based on multicast-based communication combined with stateful forwarding and caching in intermediate nodes. Despite its benefits, the downside of the architecture resides in the packet flooding not efficiently prevented by current forwarding strategies and mainly associated with the native flooding of the architecture or malicious packets from Interest Flooding Attack (IFA). This work introduces iFLAT, a multicriteria-based forwarding strategy for <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</b> nterest <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">FL</b> ooding mitig <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">AT</b> ion on named data wireless networking. It follows a cross-layer approach that considers: (i) the Received Signal Strength (RSS) to adjust itself to the current status of the wireless network links, (ii) the network traffic ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">meInfo</i> ) to detect flooding issues and traffic anomalies, and (iii) a fake Interest Blacklist to identify IFA-related flooding. In doing so, the strategy achieves better efficiency on Interest flooding mitigation, addressing both native and IFA types of flooding. We evaluated the proposed strategy by reproducing a Flying Ad hoc Network (FANET) composed of Unmanned Aerial Vehicles (UAVs) featured by the NDN stack deployed in all nodes. Simulation results show that iFLAT can effectively detect and mitigate flooding, regardless of its origin or nature, achieving greater packet forwarding efficiency than competing strategies. In broadcast storm and IFA scenarios, it achieved 25.75% and 37.37% of traffic reduction, whereas Interest satisfaction rates of 16.36% and 51.78% higher, respectively.

Detection of traffic anomalies in the home Wi-Fi network using Waidps and Nzyme utilities

The article examines Waidps and Nzyme utilities used for monitoring wireless networks. Some basic WLAN terms were described with possible attacks on WLANs in general and how dangerous they are. It has been studied how each of the utilities works: its capabilities, disadvantages and the order of application.

Entropy-based network traffic anomaly classification method resilient to deception

Entropy-based network traffic anomaly detection techniques are attractive due to their simplicity and applicability in a real-time network environment. Even though flow data provide only a basic set of information about network communications, they are suitable for efficient entropy-based anomaly detection techniques. However, a recent work reported a serious weakness of the general entropy-based anomaly detection related to its susceptibility to deception by adding spoofed data that camouflage the anomaly. Moreover, techniques for further classification of the anomalies mostly rely on machine learning, which involves additional complexity. We address these issues by providing two novel approaches. Firstly, we propose an efficient protection mechanism against entropy deception, which is based on the analysis of changes in different entropy types, namely Shannon, R?nyi, and Tsallis entropies, and monitoring the number of distinct elements in a feature distribution as a new detection metric. The proposed approach makes the entropy techniques more reliable. Secondly, we have extended the existing entropy-based anomaly detection approach with the anomaly classification method. Based on a multivariate analysis of the entropy changes of multiple features as well as aggregation by complex feature combinations, entropy-based anomaly classification rules were proposed and successfully verified through experiments. Experimental results are provided to validate the feasibility of the proposed approach for practical implementation of efficient anomaly detection and classification method in the general real-life network environment.

Traffic Anomaly Detection in Wireless Sensor Networks Based on Principal Component Analysis and Deep Convolution Neural Network

With the popularity of wireless networks, wireless sensor networks (WSNs) have advanced rapidly, and their flexibility and ease of deployment have resulted in more security concerns, making it critical to research network intrusion prevention for WSNs. Denial of service (DoS) is a common network attack, achieving its goal by bringing down the target network. A DoS attack on WSNs devices with limited resources would be fatal. This paper proposes a method based on principal component analysis (PCA) and a deep convolution neural network (DCNN) for DoS traffic anomaly detection in WSNs, based on the vulnerability of WSNs to attacks and the limited storage space of their devices. Compared with the conventional deep learning structure, the proposed model has a lightweight structure and more effective feature extraction capability, which can effectively detect network abnormal traffic in WSNs devices with limited storage capacity. To assure the effectiveness of the proposed model, receiver operating characteristic (ROC) curves, various classification metrics, and confusion matrices are used to verify the classification results of the model. Through experimental comparison, the proposed model, with small model size, outperforms other mainstream abnormal traffic detection models in terms of classification effect.

Adversarial Machine Learning: A Multilayer Review of the State-of-the-Art and Challenges for Wireless and Mobile Systems

Machine Learning (ML) models are susceptible to adversarial samples that appear as normal samples but have some imperceptible noise added to them with the intention of misleading a trained classifier and misclassifying the input. Adversarial Machine Learning (AML) was initially coined following upon researchers pointing out certain blind spots in image classifiers in computer vision field which were exploited by these adversarial samples to deceive the model. Although this has been investigated remarkably in computer vision, the impact of AML in wireless and mobile systems has recently attracted attention. Wireless and mobile networks have intensely benefited from the application of ML classifiers to detect network traffic anomalies and malware detection. However, ML detectors themselves can be exfiltrated/evaded by the samples carefully designed by attackers, raising security concerns for ML-based network applications. Thus, it is crucial to detect such samples to safeguard the network. This survey article presents a systematic mapping and a comprehensive literature review on AML to wireless and mobile systems from physical layer to network and application layers. The article reviews the state-of-the-art AML approaches in the generation and detection of adversarial samples. The samples can be generated by adversarial models such as Generative Adversarial Networks (GANS) and techniques such as Fast Gradient Sign Method (FGSM). The samples can be detected by adversarial models acting as classifiers or ML classifiers reinforced with knowledge on how to detect such samples. For each approach, a high-level overview is provided alongside its impact on solving the problems in wireless and mobile settings. Furthermore, this article provides detailed discussions to highlight the open issues and challenges faced by these approaches, as well as research opportunities which can be of interest to the researchers and developers in Artificial Intelligence (AI)-driven wireless and mobile networking.

Intrusion detection in internet of things networks based on machine learning methods

Introduction: The growing amount of digital data generated, among others, by smart devices of the Internet of Things makes it important to study the application of machine learning methods to the detection of network traffic anomalies, namely the presence of network attacks. Purpose: To propose a unified approach to detecting attacks at different levels of IoT network architecture, based on machine learning methods. Results: It was shown that at the wireless sensor network level, attack detection is associated with the detection of anomalous behavior of IoT devices, when the deviation of an IoT device behavior from its profile exceeds a predetermined level. Smart IoT devices are profiled on the basis of statistical characteristics, such as the intensity and duration of packet transmission, the proportion of retransmitted packets, etc. At the level of a local or global wired IoT network, data is aggregated and then analyzed using machine learning methods. Trained classifiers can become a part of a network attack detection system, making decisions about compromising a node on the fly. Models of classifiers of network attacks were experimentally selected both at the level of a wireless sensor network and at the level of a local or global wired network. The best results in terms of completeness and accuracy estimates are demonstrated by the random forest method for a wired local and/or global network and by all the considered methods for a wireless sensor network. Practical relevance: The proposed models of classifiers can be used for developing intrusion detection systems in IoT networks.

Models of monitoring of self-like traffic of information and communication networks for attack detection systems

Autoregressive, fractal and multifractal models of network self-similar traffic are con-sidered, which allow to form an adequate reference model (template) of "normal" traffic and to detect traffic anomalies in attack detection and prevention systems. Models of fractal Brownian motion and fractal Gaussian noise were considered as models of fractal motions, because they have self-similarity and long-term dependence properties that correspond to the properties of experimental data, as well as the possibility of their analytical interpretation. When evaluating and identifying processes for the implementation of autoregressive models use adaptive filters-approximators, among which there are neural network and neuro-wavelet. The following were used as multifractal models: a multifractal wavelet model with a beta distribution and a hybrid multifractal wavelet model in which the beta distribution is used on a coarse scale and the dis-tribution of point masses on an accurate scale By modeling as a result of adaptation and learning of models, autocorrelation functions, spectra and variances of model signals qualitatively correspond to the graphs of the experimental signal. In addition, the qualitative and numerical values of the characteristics of the model signals generally correspond to the characteristics of the experimental signal. In this case, beta multifractal wavelet models have a smaller error of determination of characteristics than hybrid multifractal wavelet models, and the relative root mean square error of approximation of the experimental signal using a neural network adaptive filter approximator does not exceed 0.046. Statistical verification by non-parametric criterion of signs allowed to establish the adequacy of experimental and model signals with a significance level of 0.01. Further research should be aimed at developing and using predictive models of self-similar traffic in attack detection and prevention systems, which will increase the efficiency of attack detection.

Algorithm for Online Detection of Traffic Anomalies in High-Speed Enterprise Multiservice Communication Networks

Algorithm for Online Detection of Traffic Anomalies in High-Speed Enterprise Multiservice Communication Networks

Classification of Road Traffic Anomaly Based on Travel Data Analysis

Autonomous Vehicles (AVs) collect travel data based on various smart devices and sensors, with the goal of enabling a vehicle to operate under its own power. Fully automation vehicle is expected to have full control over all functions. In order to manage large amounts of data in different formats collected via various types of communication channels, such as vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication, a deep learning concept, inspired by the human central nervous system, is proposed. Deep learning is a type of machine learning in which a model learns to perform classification tasks directly from input datasets. In this case, it also refers to a three-layer structure: an input layer, a hidden layer, and an output layer. In this paper, various machine learning schemes have been proposed in order to detect anomalous conditions in urban road traffic. Furthermore, an evaluation of performance analysis based on simulation result of these schemes is performed. A deep learning concept is introduced to manage vehicle speed data, with the goal of detecting anomalous conditions in urban road traffic.

Detection and classification of sensor anomalies for simulating urban traffic scenarios

Sensor network infrastructures are widely used in smart cities to monitor and analyze urban traffic flow. Starting from punctual information coming from traffic sensor data, traffic simulation tools are used to create the digital twin” mobility data model that helps local authorities to better understand urban mobility. However, sensors can be faulty and errors in sensor data can be propagated to the traffic simulations, leading to erroneous analysis of the traffic scenarios. Providing real-time anomaly detection for time series data streams is highly valuable since it enables to automatically recognize and discard or repair sensor faults in time-sensitive processes. In this paper, we implement a data cleaning process that detects and classifies traffic anomalies distinguishing between sensor faults and unusual traffic conditions, and removes sensor faults from the input of the traffic simulation model, improving its performance. Experiments conducted on a real scenario for 30 days have demonstrated that anomaly detection coupled with anomaly classification boosts the performance of the traffic model in emulating real urban traffic.