Traffic Logs Research Articles

Dynamic Malware Analysis Using a Sandbox Environment, Network Traffic Logs, and Artificial Intelligence.

Dynamic Malware Analysis Using a Sandbox Environment, Network Traffic Logs, and Artificial Intelligence.

CrySyS dataset of CAN traffic logs containing fabrication and masquerade attacks

Despite their known security shortcomings, Controller Area Networks are widely used in modern vehicles. Research in the field has already proposed several solutions to increase the security of CAN networks, such as using anomaly detection methods to identify attacks. Modern anomaly detection procedures typically use machine learning solutions that require a large amount of data to be trained. This paper presents a novel CAN dataset specifically collected and generated to support the development of machine learning based anomaly detection systems. Our dataset contains 26 recordings of benign network traffic, amounting to more than 2.5 hours of traffic. We performed two types of attack on the benign data to create an attacked dataset representing most of the attacks previously proposed in the academic literature. As a novelty, we performed all attacks in two versions, modifying either one or two signals simultaneously. Along with the raw data, we also publish the source code used to generate the attacks to allow easy customization and extension of the dataset.

ILIDViz: An Incremental Learning-Based Visual Analysis System for Network Anomaly Detection

BackgroundWith the development of information technology, network traffic logs mixed with various kinds of cyber-attacks have grown explosively. Traditional intrusion detection systems (IDS) have limited ability to discover new inconstant patterns and identify malicious traffic traces in real-time. It is urgent to implement more effective intrusion detection technologies to protect computer security. MethodsIn this paper, we design a hybrid IDS, combining our incremental learning model (KAN-SOINN) and active learning, to learn new log patterns and detect various network anomalies in real-time. Results & ConclusionsThe experimental results on the NSLKDD dataset show that the KAN-SOINN can be improved continuously and detect malicious logs more effectively. Meanwhile, the comparative experiments prove that using a hybrid query strategy in active learning can improve the model learning efficiency.

PD-PAn: Prefix- and Distribution-Preserving Internet of Things Traffic Anonymization

One of the features of network traffic in Internet of Things (IoT) environments is that various IoT devices periodically communicate with their vendor services by sending and receiving packets with unique characteristics through private protocols. This paper investigates semantic attacks in IoT environments. An IoT semantic attack is active, covert, and more dangerous in comparison with traditional semantic attacks. A compromised IoT server actively establishes and maintains a communication channel with its device, and covertly injects fingerprints into the communicated packets. Most importantly, this server not only de-anonymizes other IPs, but also infers the machine states of other devices (IPs). Traditional traffic anonymization techniques, e.g., Crypto-PAn and Multi-View, either cannot ensure data utility or is vulnerable to semantic attacks. To address this problem, this paper proposes a prefix- and distribution-preserving traffic anonymization method named PD-PAn, which generates multiple anonymized views of the original traffic log to defend against semantic attacks. The prefix relationship is preserved in the real view to ensure data utility, while the IP distribution characteristic is preserved in all the views to ensure privacy. Intensive experiments verify the vulnerability of the state-of-the-art techniques and effectiveness of PD-PAn.

Leveraging History to Predict Infrequent Abnormal Transfers in Distributed Workflows.

Scientific computing heavily relies on data shared by the community, especially in distributed data-intensive applications. This research focuses on predicting slow connections that create bottlenecks in distributed workflows. In this study, we analyze network traffic logs collected between January 2021 and August 2022 at the National Energy Research Scientific Computing Center (NERSC). Based on the observed patterns, we define a set of features primarily based on history for identifying low-performing data transfers. Typically, there are far fewer slow connections on well-maintained networks, which creates difficulty in learning to identify these abnormally slow connections from the normal ones. We devise several stratified sampling techniques to address the class-imbalance challenge and study how they affect the machine learning approaches. Our tests show that a relatively simple technique that undersamples the normal cases to balance the number of samples in two classes (normal and slow) is very effective for model training. This model predicts slow connections with an F1 score of 0.926.

Agentless Approach for Security Information and Event Management in Industrial IoT

The Internet of Things (IoT) provides ease of real-time communication in homes, industries, health care, and many other dependable and interconnected sectors. However, in recent years, smart infrastructure, including cyber-physical industries, has witnessed a severe disruption of operation due to privilege escalation, exploitation of misconfigurations, firmware hijacking, malicious node injection, botnets, and other malware infiltrations. The proposed agentless module for Wazuh security information and event management (SIEM) solution contributes to securing small- to large-scale IoT networks of industry 4.0. An agentless module is implemented by vigilantly examining the IoT device traffic without installing any agent or software on the endpoints. In the proposed research scheme, a module sniffs the network traffic of IoT devices captured from the gateway and passes it to a machine learning model for initial detection and prediction. The output of the ML model is embedded in the JSON log format and passed through the Wazuh agent to the Wazuh server where a decoder is added that decodes the network traffic logs. For event monitoring in Wazuh, industrial protocols are also thoroughly analyzed, and the feature set is determined. These features are used to write rules which are tested on the SWaT dataset, utilizing a common industrial protocol (CIP) for communication. Custom and dynamic rules are written at the Wazuh end to generate alerts to respond to any anomaly detected by the machine learning (ML) model or in the protocols used. Finally, in case of any event or an attack is detected, the alerts are fired on the Wazuh dashboard. This agentless SIEM solution has practical implications for the security of the industrial control systems of industry 4.0.

A Blockchained AutoML Network Traffic Analyzer to Industrial Cyber Defense and Protection

Network traffic analysis can raise privacy concerns due to its ability to reveal sensitive information about individuals and organizations. This paper proposes a privacy-preserving Block-chained AutoML Network Traffic Analyzer (BANTA). The system securely stores network traffic logs in a decentralized manner, providing transparency and security. Differential privacy algorithms protect sensitive information in the network flow logs while allowing administrators to analyze network traffic without the risk of leakages. The BANTA uses blockchain technology, where smart contracts automate the process of network traffic analysis, and a multi-signature system ensures the system’s security, safety, and reliability. The proposed approach was evaluated using a real-world network traffic dataset. The results demonstrate the system’s high accuracy and real-time anomaly detection capabilities, which makes it well-suited for scalable cybersecurity operations. The system’s privacy protection, decentralized storage, automation, multi-signature system, and real-world effectiveness ensure that the organization’s data is private, secure, and effectively protected from cyber threats, which are the most vexing issue of modern cyber-physical systems.

The Impact of Fly Over Construction at Simpang Ramayana Mall in An Effort to Reduce Traffic Logs and Community Economic Growth in Tanjungpinang City

This is descriptive research that describes the characteristics of the population or phenomenon being studied. So that this one research method is the main focus is to explain the object of research. The purpose of this study is to try to reduce the number of vehicles that use the DI road. The research method focuses more on discussing why an event or phenomenon occurs. The results described the construction of the fly over at the Ramayana intersection in Tanjungpinang City is a design whose goal is to try to prevent traffic jams from occurring at that location and to make travel time efficient so as to minimize the impacts such as wasted time due to traffic jams.

Pengembangan Perangkat Lunak Untuk Deteksi DDoS Berbasis Neural Network

System security issues are a vital factor that needs to be considered in the operation of systems and networks, which will later be used for disaster mitigation and preventing attacks on the network. Distributed Denial of Services (DDoS) is a form of attack carried out by individuals or groups to damage data through servers or malware in the form of flooding packets, therefore it can paralyze the network system used. Network security is a factor that must be maintained and considered in an information system. DDoS can take the form of Ping of Death, flood, Remote control attack, User Data Protocol (UDP) flood, and Smurf Attack. This study aims to develop software to detect DDoS attacks based on network traffic logs. The software has been tested and run according to the neural network algorithm. This software was developed with an interface that makes it easier for users to detect the source IP whether the IP is carrying out a DDoS attack or normal.

Understanding Security Risks of Ad-based URL Shortening Services Caused by Users' Behaviors

URL shortening services enable us to shorten or simplify URLs. Ad-based URL shortening services display advertisements to users who access short URLs and reward short URL creators. However, ad-based URL shortening services have specific security risks that URL shortening services without ads do not, such as displaying malicious advertisements to users. In this study, we reveal previously unknown security risks of these services caused by users' behaviors. We conducted a comprehensive measurement of ad-based URL shortening services. First, we accessed short URLs of these services, clicked buttons on the web pages, and reached the final destinations of the short URLs. Then, we reveal the security risks posed to users by monitoring and analyzing traffic logs when such short URLs are accessed. We found that all services generated an average of 86.5 web requests to malicious domain names per short URL. We then showed the security risk of unintentionally communicating malicious domain names even when users click only on buttons that correctly move users to their desired destinations. Finally, we discuss countermeasures to mitigate these risks from the perspective of each stakeholder in ad-based URL shortening services.

A Novel Model for Anomaly Detection in Network Traffic Based on Support Vector Machine and Clustering

New vulnerabilities and ever-evolving network attacks pose great threats to today’s cyberspace security. Anomaly detection in network traffic is a promising and effective technique to enhance network security. In addition to traditional statistical analysis and rule-based detection techniques, machine learning models are introduced for intelligent detection of abnormal traffic data. In this paper, a novel model named SVM-C is proposed for the anomaly detection in network traffic. The URLs in the network traffic log are transformed into feature vectors via statistical laws and linear projection. The obtained feature vectors are fed into a support vector machine (SVM) classifier and classified as normal or abnormal. Based on the idea of SVM and clustering, we construct an optimization model to train the parameters of the feature extraction method and traffic classifier. Numerical tests indicate that the proposed model outperforms the state of the arts on all the tested datasets.

Smarter Base Station Sleeping for Greener Cellular Networks

One approach to achieving greener cellular networks is to power them with renewable energy. When there is insufficient renewable energy, base stations (BSs) with lower predicted traffic loads are dynamically switched to sleep mode as a means of reducing total BS energy consumption. Prediction is done using only the traffic logs of active BSs since traffic logs are not available for sleeping BSs. However, prediction accuracy is degraded if information for the entire network is not used. We propose a scheme built on software-defined-networking and edge computing technologies for maintaining the accuracy of traffic prediction by incorporating the most important traffic logs into the prediction even when using only traffic logs for active BSs. It works by estimating the contribution of the traffic logs for each BS to traffic prediction accuracy. Evaluation of the proposed scheme through extensive numerical experiments using a dataset of actual BS traffic logs demonstrates that the proposed scheme is superior to two benchmark schemes in terms of prediction accuracy and robustness against the reduction of active BSs for energy saving and different BS sets.

Mitigating Sodinokibi Ransomware Attack on Cloud Network Using Software-Defined Networking (SDN)

Sodinokibi Ransomware virus becomes a severe threat by targeting data encryption on a server, and this virus infection continues to spread to encrypt data on other computers. This study aims to mitigate by experiment with building a prevention system through computer network management. The mitigation process is carried out through static, dynamic, and Software-Defined Networking (SDN) analysis to prevent the impact of attacks through programmatic network management. SDN consists of two main components in its implementation, the Ryu controller and Open Virtual Switch (OVS). Result testing mitigation system on infected networks by crippling TCP internet protocol access can reduce virus spread by 17.13% and suppress Sodinokibi traffic logs by up to 73.97%. Based on the percentage data, SDN-based mitigation in this study is per the objectives to make it possible to mitigate Ransomware attacks on computer network traffic.

Network Forensics Against Ryuk Ransomware Using Trigger, Acquire, Analysis, Report, and Action (TAARA) Method

This study aims to reconstruct an attack event and analyze the source of viral infection based on network traffic logs so that the information obtained can be used for a new reference in the security system. Recent attacks on computer network systems cannot be easily detected, as cybercrime has used a variant of the Ryuk Ransomware virus to penetrate security systems, encrypt drives, and computer network resources. This virus is very destructive and has an effective design with a file size of about 200,487 Bytes so it does not look suspicious. The research steps are done through Trigger, Acquire, Analysis, Report, and Action (TAARA). The forensic tools used to obtain log data are Wireshark, NetworkMiner, and TCPDUMP. Based on the results of forensic data obtained include a timestamp, source of the attack, IP address, MAC address, hash signature sha256, internet protocol, and the process of infection. Based on the data obtained in this study has been by the expected objectives.

Detection of dos attacks using naive bayes method based on internet of things (iot)

Internet of Things (IoT) is a technology that is currently on a trend. Interconnecting networks on IoT are useful in the automation process, but it has vulnerabilities to network-based disruptions and attacks; such as Denial of Service (DoS). This study aimed at implementing the Naive Bayes algorithm to predict attribute classes using training data-sets from NSLKDD with the KDD99 format and obtained testing-data from the logging process of DoS attacks on IoT-based devices. The advantage of using Naive Bayes is that this method only requires a small amount of training data to determine the estimated parameters needed in the classification process. The results of the conducted research could detect attacks on IoT devices by using the help of snort tools to capture traffic logs. The results from the log were then converted into KDD99 format and processed by the Naive Bayes method. This research uses a training dataset from NSLKDD with KDD99 format which is widely used in various studies and testing data obtained from the IDS log process on the Raspberry Pi 3. The attributes used are 9 attributes namely; service, flag, src_bytes, dst_bytes, srv_serror_rate, same_srv_rate, diff_srv_rate, dst_host_srv_diff_host_rate and dst_host_srv_serror_rate. The results of the research analysis showed an accuracy of 64.02%. These results were smaller than previous results, but some aspects were still different from the actual results because the testing data and training data were taken from two different data-sets, thereby they had different characteristics.

Predicting Incident Duration Based on Machine Learning Methods

Traffic incidents dont only cause various levels of traffic congestion but often contribute to traffic accidents and secondary accidents, resulting in substantial loss of life, economy, and productivity loss in terms of injuries and deaths, increased travel times and delays, and excessive consumption of energy and air pollution. Therefore, it is essential to accurately estimate the duration of the incident to mitigate these effects. Traffic management center incident logs and traffic sensors data from Eastbound Interstate 70 (I-70) in Missouri, United States collected during the period from January 2015 to January 2017, with a total of 352 incident records were used to develop incident duration estimation models. This paper investigated different machine learning (ML) methods for traffic incidents duration prediction. The attempted ML techniques include Support Vector Machine (SVM), Random Forest (RF), and Neural Network Multi-Layer Perceptron (MLP). Root mean squared error (RMSE) and Mean absolute error (MAE) were used to evaluate the performance of these models. The results showed that the performance of the models was comparable with SVM models slightly outperforms the RF, and MLP models in terms of MAE index, where MAE was 14.23 min for the best-performing SVM models. Whereas, in terms of the RMSE index, RF models slightly outperformed the other two models given RMSE of 18.91 min for the best-performing RF model. Index Terms— Incident Duration, Neural Network Multi-Layer Perceptron, Random Forest, Support Vector Machine.

Towards website domain name classification using graph based semi-supervised learning

In this work, we tackle the problem of classifying websites domain names to a category, e.g., mapping bbc.com to the ”News and Media” class. Domain name classification is challenging due to the high number of class labels and the highly skewed class distributions. Differently from prior efforts that need to crawl and use the web pages’ actual content, we rely only on traffic logs passively collected, observing traffic regularly flowing in the network, without the burden to crawl and parse web pages. We exploit the information carried by network logs, using just the name of the websites and the sequence of visited websites by users. For this, we propose and evaluate different classification methods based on machine learning. Using a large dataset with hundreds of thousands of domain names and 25 different categories, we show that semi-supervised learning methods are more suitable for this task than traditional supervised approaches. Using graphs, we incorporate in the classifier aspects not strictly related to the labeled data, and we can classify most of the unlabeled domains. However, in this framework, classification scores are lower than those usually found when exploiting the page-specific content. Our work is the first to perform an extensive evaluation of domain name classification using only passive flow-level logs to the best of our knowledge.

Forensic Analysis on False Data Injection Attack on IoT Environment

False Data Injection Attack (FDIA) is an attack that could compromise Advanced Metering Infrastructure (AMI) devices where an attacker may mislead real power consumption by falsifying meter usage from end-users smart meters. Due to the rapid development of the Internet, cyber attackers are keen on exploiting domains such as finance, metering system, defense, healthcare, governance, etc. Securing IoT networks such as the electric power grid or water supply systems has emerged as a national and global priority because of many vulnerabilities found in this area and the impact of the attack through the internet of things (IoT) components. In this modern era, it is a compulsion for better awareness and improved methods to counter such attacks in these domains. This paper aims to study the impact of FDIA in AMI by performing data analysis from network traffic logs to identify digital forensic traces. An AMI testbed was designed and developed to produce the FDIA logs. Experimental results show that forensic traces can be found from the evidence logs collected through forensic analysis are sufficient to confirm the attack. Moreover, this study has produced a table of attributes for evidence collection when performing forensic investigation on FDIA in the AMI environment.

MD-MinerP: Interaction Profiling Bipartite Graph Mining for Malware-Control Domain Detection

Despite the efforts of information security experts, cybercrimes are still emerging at an alarming rate. Among the tools used by cybercriminals, malicious domains are indispensable and harm from the Internet has become a global problem. Malicious domains play an important role from SPAM and Cross-Site Scripting (XSS) threats to Botnet and Advanced Persistent Threat (APT) attacks at large scales. To ensure there is not a single point of failure or to prevent their detection and blocking, malware authors have employed domain generation algorithms (DGAs) and domain-flux techniques to generate a large number of domain names for malicious servers. As a result, malicious servers are difficult to detect and remove. Furthermore, the clues of cybercrime are stored in network traffic logs, but analyzing long-term big network traffic data is a challenge. To adapt the technology of cybercrimes and automatically detect unknown malicious threats, we previously proposed a system called MD-Miner. To improve its efficiency and accuracy, we propose the MD-MinerP here, which generates more features with identification capabilities in the feature extraction stage. Moreover, MD-MinerP adapts interaction profiling bipartite graphs instead of annotated bipartite graphs. The experimental results show that MD-MinerP has better area under curve (AUC) results and found new malicious domains that could not be recognized by other threat intelligence systems. The MD-MinerP exhibits both scalability and applicability, which has been experimentally validated on actual enterprise network traffic.

Analisis Serangan DDoS Menggunakan Metode Jaringan Saraf Tiruan

DDoS attack (Distribute Denial of Service) is one of the weapons of choice from hackers because it’s proven it has become threat on the internet worlds. The frequent of DDoS attacks creates a threat to internet users or servers, so that requires the introduction of several new methods that occur, one of which can use the IDS (Intrusion Detection System) method. This study took advantage of Neural Network ability to detect DDoS attack or normal based on traffic log processed statistically using Fixed Moving Window. The DDOS attack scheme uses a network topology that has been designed based on the needs and objectives that are found in monitoring network traffic. In each DDoS data and normal consist of 27 traffic log with total numbers of dataset as much as 54 data along with each testing data as much as 10 DDoS data and normal. Data collection was performed using LOIC, HOIC, and DoSHTTP with 300 seconds of traffic monitoring. The result of the Fixed Moving Window processing is the extraction value that will be put in the Neural Networks have 6 input values, one hidden layer with 300 neurons and 2 outputs which consist of a normal dataset and a DDoS dataset. The results of this study showed that Neural Network can detect DDoS and Normal in a good way with accuracy value as much as 95%.