Unknown Attack Types Research Articles

Cyber–physical event reasoning for distributed energy resources

The widespread adoption of internet-connected and remotely controllable solar plants and energy storages renders coordinated cyber–physical attacks against distributed energy resources (DERs) an emerging risk for power systems. Effective incident response can be facilitated by online DER monitoring providing real-time information on event root causes and physical impacts. Such online event identification is challenged by the lack of historical attack observations, and emergence of new attack strategies. The Cyber-Physical Event Reasoning System CyPhERS provides real-time information on both known and unknown attack types in form of informative and interpretable event signatures, without need to be trained on historical attack samples. To date, CyPhERS has only been demonstrated on a laboratory water distribution testbed of limited complexity, considering human evaluation of event signatures. This work methodologically adapts CyPhERS to specificities of DER operation such as weather and consumer-induced volatility, and introduces an automated signature evaluation system. The feasibility of applying CyPhERS for automated DER monitoring is investigated on a dataset recorded from a real photovoltaic-battery system targeted by several cyber and cyber–physical attack types. The results demonstrate that the proposed methodological adaptations and signature evaluation system enable the application of CyPhERS for automated online identification of different attack types targeting DERs, while greatly reducing the false positive rate.

Artificial Intelligence based Intrusion Detection System – A Detailed Survey

The Internet and communications have rapidly expanded, leading to a significant rise in data generation and heterogeneity. Intrusion detection systems play a crucial role in ensuring the security and integrity of computer systems. These systems have been developed by researchers, academicians, and practitioners to effectively detect and mitigate network attacks. Intrusion detection systems are designed to analyze network traffic and compare it with a baseline of normal behavior, allowing them to identify any deviations or inconsistencies that may indicate an intrusion. Furthermore, the cooperative and distributed architecture of intrusion detection systems enables them to effectively detect attacks and protect the network from unauthorized access. Additionally, to enhance the performance of intrusion detection systems, techniques such as resampling the dataset and utilizing classifier ensemble are used to improve the classification accuracy. Moreover, intrusion detection systems have been integrated with intrusion response systems to ensure a timely and effective response to detected attacks. AI-based Intrusion Detection Systems have emerged as a crucial tool in ensuring network security and combating cyber threats. These systems utilize artificial intelligence algorithms to analyze network traffic, identify patterns of malicious activity, and detect potential cyber-attacks. They have proven to be highly effective in improving the detection accuracy, reducing false alarms, and even detecting previously unknown types of attacks. In summary, the development of accurate and efficient intrusion detection systems is crucial for ensuring network security. In today’s rapidly changing world, the significance of accurate intrusion detection systems cannot be overstated.

An Effective Method for Detecting Unknown Types of Attacks Based on Log-Cosh Variational Autoencoder

The increasing prevalence of unknown-type attacks on the Internet highlights the importance of developing efficient intrusion detection systems. While machine learning-based techniques can detect unknown types of attacks, the need for innovative approaches becomes evident, as traditional methods may not be sufficient. In this research, we propose a deep learning-based solution called the log-cosh variational autoencoder (LVAE) to address this challenge. The LVAE inherits the strong modeling abilities of the variational autoencoder (VAE), enabling it to understand complex data distributions and generate reconstructed data. To better simulate discrete features of real attacks and generate unknown types of attacks, we introduce an effective reconstruction loss term utilizing the logarithmic hyperbolic cosine (log-cosh) function in the LVAE. Compared to conventional VAEs, the LVAE shows promising potential in generating data that closely resemble unknown attacks, which is a critical capability for improving the detection rate of unknown attacks. In order to classify the generated unknown data, we employed eight feature extraction and classification techniques. Numerous experiments were conducted using the latest CICIDS2017 dataset, training with varying amounts of real and unknown-type attacks. Our optimal experimental results surpassed several state-of-the-art techniques, achieving accuracy and average F1 scores of 99.89% and 99.83%, respectively. The suggested LVAE strategy also demonstrated outstanding performance in generating unknown attack data. Overall, our work establishes a solid foundation for accurately and efficiently identifying unknown types of attacks, contributing to the advancement of intrusion detection techniques.

Detection of Unauthorized Actions in Networks Using Wavelet Analysis

Signal processing techniques are used to analyze and detect network anomalies because of their ability to detect new and unknown intrusions. The paper proposes a method of modeling network signals for the detection of network anomalies, which combines wavelet approximation and the theory of system identification. To characterize the behavior of network traffic, fifteen functions are provided, which are used as input signals within the system. At the same time, it is assumed that security violations within the network can be detected by checking abnormal patterns of system functioning according to audit data.
 Despite the fact that machine learning methods have achieved significant results in detecting network anomalies, they still face the difficulty of using the implemented algorithms, in the presence of differences in the behavior of the training data and test data, which in turn leads to inefficient performance of the algorithms. This effect is exacerbated by the limitation of algorithms to detect previously unknown types of attacks due to the large number of false positives.
 The paper develops a new method of modeling network signals for detecting anomalies in networks using wavelet analysis. In particular, the general architecture of the approach consists of three components: feature analysis, modeling of normal network traffic based on wavelet approximation and prediction using ARX model, intrusion or non-intrusion decision making
 The result is evaluated using the DARPA intrusion detection dataset, which performs a comprehensive analysis of the intrusions in the dataset. Evaluation results show that this approach provides a high level of detection of both instances and types of attacks.

Improved adaptive neuro-fuzzy inference system based on modified salp swarm algorithm and golden eagle optimizer algorithm for intrusion detection in networks

With the increase in the growth of computer networks throughout the past years, network security has become an essential issue. Among the numerous network security measures, intrusion detection systems play a dynamic function with integrity, confidentiality, and accessibility of resources. An Intrusion Detection System (IDS) is a software program or hardware device which monitors computer system and/or network activities for malicious activities and produces alerts to security experts. In IDS there are three major problems namely generating many alerts, a huge rate of false positive alerts, and unknown attack types per generated alerts. Alert management methods are used to manage these problems. One of the methods of alert management is alert reduction and alert classification. The proposed approach focuses on enhancing the efficiency of the adaptive neuro-fuzzy inference system (ANFIS) using a modified salp swarm algorithm (SSA) and Golden Eagle optimizer (GEOSSA). The present study uses the Golden Eagle optimization algorithm to improve SSA behaviors. The proposed model (GEO-SSA-ANFIS) intends to determine the appropriate parameters using the GEO-SSA algorithm because these parameters are considered the main component affecting the ANFIS forecasting process. The results of the intrusion detection based on the NSL-KDD dataset were better and more efficient compared with those models because the detection rate was 96.68% and the FAR result was 0.438%.

A Marine Hydrographic Station Networks Intrusion Detection Method Based on LCVAE and CNN-BiLSTM

Marine sensors are highly vulnerable to illegal access network attacks. Moreover, the nation’s meteorological and hydrological information is at ever-increasing risk, which calls for a prompt and in depth analysis of the network behavior and traffic to detect network attacks. Network attacks are becoming more diverse, with a large number of rare and even unknown types of attacks appearing. This results in traditional-machine-learning (ML)-based network intrusion detection (NID) methods performing weakly due to the lack of training samples. This paper proposes an NID method combining the log-cosh conditional variational autoencoder (LCVAE) with convolutional the bi-directional long short-term memory neural network (LCVAE-CBiLSTM) based on deep learning (DL). It can generate virtual samples with specific labels and extract more significant attack features from the monitored traffic data. A reconstructed loss term based on the log-cosh model is introduced into the conditional autoencoder. From it, the virtual samples are able to inherit the discrete attack data and enhance the potential features of the imbalance attack type. Then, a hybrid feature extraction model is proposed by combining the CNN and BiLSTM to tackle the attack’s spatial and temporal features. The following experiments evaluated the proposed method’s performance on the NSL-KDD dataset. The results demonstrated that the LCVAE-CBiLSTM obtained better results than state-of-the-art works, where the accuracy, F1-score, recall, and FAR were 87.30%, 87.89%, 80.89%, and 4.36%. The LCVAE-CBiLSTM effectively improves the detection rate of a few classes of samples and enhances the NID performance.

Stacked One-Class Broad Learning System for Intrusion Detection in Industry 4.0

With the vigorous development of Industry 4.0, industrial Big Data has turned into the core element of the Industrial Internet of Things. As one of the most fundamental and indispensable components in industrial cyber-physical systems (CPS), intelligent anomaly detection is still an essential and challenging issue. However, with the development of the network, there may exist unknown types of attacks, which are difficult to collect. Facing one-class industrial intrusion detection scenario that the collected training data only includes normal state, the one-class broad learning system (OCBLS) and the stacked OCBLS (ST-OCBLS) algorithms are developed. Benefiting from the characteristics of BLS, our proposed approaches retain the advantage of efficient training process. Moreover, the high-level hidden features of the network traffic data can be learned through the progressive encoding and decoding mechanism in ST-OCBLS. Extensive comparative experiments on several real-world intrusion detection tasks are carried out to demonstrate that our proposed methods have competitive performance and high efficiency in the face of complex network data and diversified types of intrusions. Overall, this article provides a new alternative solution for network intrusion detection in Industry 4.0.

Towards an Effective Intrusion Detection Model Using Focal Loss Variational Autoencoder for Internet of Things (IoT).

As the range of security attacks increases across diverse network applications, intrusion detection systems are of central interest. Such detection systems are more crucial for the Internet of Things (IoT) due to the voluminous and sensitive data it produces. However, the real-world network produces imbalanced traffic including different and unknown attack types. Due to this imbalanced nature of network traffic, the traditional learning-based detection techniques suffer from lower overall detection performance, higher false-positive rate, and lower minority-class attack detection rates. To address the issue, we propose a novel deep generative-based model called Class-wise Focal Loss Variational AutoEncoder (CFLVAE) which overcomes the data imbalance problem by generating new samples for minority attack classes. Furthermore, we design an effective and cost-sensitive objective function called Class-wise Focal Loss (CFL) to train the traditional Variational AutoEncoder (VAE). The CFL objective function focuses on different minority class samples and scrutinizes high-level feature representation of observed data. This leads the VAE to generate more realistic, diverse, and quality intrusion data to create a well-balanced intrusion dataset. The balanced dataset results in improving the intrusion detection accuracy of learning-based classifiers. Therefore, a Deep Neural Network (DNN) classifier with a unique architecture is then trained using the balanced intrusion dataset to enhance the detection performance. Moreover, we utilize a challenging and highly imbalanced intrusion dataset called NSL-KDD to conduct an extensive experiment with the proposed model. The results demonstrate that the proposed CFLVAE with DNN (CFLVAE-DNN) model obtains promising performance in generating realistic new intrusion data samples and achieves superior intrusion detection performance. Additionally, the proposed CFLVAE-DNN model outperforms several state-of-the-art data generation and traditional intrusion detection methods. Specifically, the CFLVAE-DNN achieves 88.08% overall intrusion detection accuracy and 3.77% false positive rate. More significantly, it obtains the highest low-frequency attack detection rates for U2R (79.25%) and R2L (67.5%) against all the state-of-the-art algorithms.

Analysis of Autoencoders for Network Intrusion Detection.

As network attacks are constantly and dramatically evolving, demonstrating new patterns, intelligent Network Intrusion Detection Systems (NIDS), using deep-learning techniques, have been actively studied to tackle these problems. Recently, various autoencoders have been used for NIDS in order to accurately and promptly detect unknown types of attacks (i.e., zero-day attacks) and also alleviate the burden of the laborious labeling task. Although the autoencoders are effective in detecting unknown types of attacks, it takes tremendous time and effort to find the optimal model architecture and hyperparameter settings of the autoencoders that result in the best detection performance. This can be an obstacle that hinders practical applications of autoencoder-based NIDS. To address this challenge, we rigorously study autoencoders using the benchmark datasets, NSL-KDD, IoTID20, and N-BaIoT. We evaluate multiple combinations of different model structures and latent sizes, using a simple autoencoder model. The results indicate that the latent size of an autoencoder model can have a significant impact on the IDS performance.

A Novel Intrusion Detection System for RPL-Based Cyber–Physical Systems

The physical layer of cyber–physical systems (CPSs) is composed of resource-constrained devices connected in a wireless sensor network (WSN). Although this layer is easy to deploy, in most cases, it has many security issues. Several intrusion detection systems (IDSs) have been proposed and tested as effective and efficient solutions to detect only a few known attacks. In this article, we propose a novel, Supervised machine learning-based IDS that is capable of detecting several attacks. This article discusses all IDS design steps, starting from data collection to the feature engineering analysis and building the trained models. Experimental results show that the proposed IDS can detect four different types of attacks that were seen by the machine learning models during the training phase. The IDS can also detect the existence of several other attacks that are not seen by the model and classify them as unknown attack types. The proposed model achieves 99.97% classification accuracy when detecting known attacks and 85% classification accuracy when detecting a new attack type.

An Improved K‐Means Clustering Intrusion Detection Algorithm for Wireless Networks Based on Federated Learning

The existing wireless network intrusion detection algorithms based on supervised learning confront many challenges, such as high false detection rate, difficulty in finding unknown attack behaviors, and high cost in obtaining labeled training data sets. This paper presents an improved k‐means clustering algorithm for detecting intrusions on wireless networks based on Federated Learning. The proposed algorithm allows multiple participants to train a global model without sharing their private data and can expand the amount of data in the training model and protect the local data of each participant. Furthermore, the cosine distance of multiple perspectives is introduced in the algorithm to measure the similarity between network data objects in the improved k‐means clustering process, making the clustering results more reasonable and the judgment of network data behavior more accurate. The AWID, an open wireless network attack data set, is selected as the experimental data set. Its dimensionality reduces by the method of principal component analysis (PCA). Experimental results show that the improved k‐means clustering intrusion detection algorithm based on Federated Learning has better performance in detection rate, false detection rate, and detection of unknown attack types.

A Prediction Method of Network Security Situation based on QPSO-SVM

In network security situation awareness system, situation prediction is the key point. The traditional intrusion detection method lacks scalability in the face of the changing network structure and lacks adaptability in the face of unknown attack types. In order to ensure and improve the accuracy of situation prediction, a QPSO-SVM prediction model is proposed by combining the optimization performance of quantum particle swarm optimization and the prediction accuracy of support vector machines. By adding the original sequence to the original sequence, this model weakens the irregular disturbance in the original sequence and enhances the regularity of the sequence. Compared with the traditional SVM and PSOSVM, the superiority of the prediction precision is better, the prediction accuracy can be ensured, and the validity of the model is tested by the simulation experiment.

NAS-FAS: Static-Dynamic Central Difference Network Search for Face Anti-Spoofing.

Face anti-spoofing (FAS) plays a vital role in securing face recognition systems. Existing methods heavily rely on the expert-designed networks, which may lead to a sub-optimal solution for FAS task. Here we propose the first FAS method based on neural architecture search (NAS), called NAS-FAS, to discover the well-suited task-aware networks. Unlike previous NAS works mainly focus on developing efficient search strategies in generic object classification, we pay more attention to study the search spaces for FAS task. The challenges of utilizing NAS for FAS are in two folds: the networks searched on 1) a specific acquisition condition might perform poorly in unseen conditions, and 2) particular spoofing attacks might generalize badly for unseen attacks. To overcome these two issues, we develop a novel search space consisting of central difference convolution and pooling operators. Moreover, an efficient static-dynamic representation is exploited for fully mining the FAS-aware spatio-temporal discrepancy. Besides, we propose Domain/Type-aware Meta-NAS, which leverages cross-domain/type knowledge for robust searching. Finally, in order to evaluate the NAS transferability for cross datasets and unknown attack types, we release a large-scale 3D mask dataset, namely CASIA-SURF 3DMask, for supporting the new 'cross-dataset cross-type' testing protocol. Experiments demonstrate that the proposed NAS-FAS achieves state-of-the-art performance on nine FAS benchmark datasets with four testing protocols.

A hybrid unsupervised clustering-based anomaly detection method

In recent years, machine learning-based cyber intrusion detection methods have gained increasing popularity. The number and complexity of new attacks continue to rise; therefore, effective and intelligent solutions are necessary. Unsupervised machine learning techniques are particularly appealing to intrusion detection systems since they can detect known and unknown types of attacks as well as zero-day attacks. In the current paper, we present an unsupervised anomaly detection method, which combines Sub-Space Clustering (SSC) and One Class Support Vector Machine (OCSVM) to detect attacks without any prior knowledge. The proposed approach is evaluated using the well-known NSL-KDD dataset. The experimental results demonstrate that our method performs better than some of the existing techniques.

Intrusion detection using dynamic feature selection and fuzzy temporal decision tree classification for wireless sensor networks

Intrusion detection systems assume a noteworthy job in the provision of security in wireless Sensor networks. The existing intrusion detection systems focus only on the detection of the known types of attacks. However, it neglects to recognise the new types of attacks, which are introduced by malicious users leading to vulnerability and information loss in the network. In order to address this challenge, a new intrusion detection system, which detects the known and unknown types of attacks using an intelligent decision tree classification algorithm, has been proposed. For this purpose, a novel feature selection algorithm named dynamic recursive feature selection algorithm, which selects an optimal number of features from the data set is proposed. In addition, an intelligent fuzzy temporal decision tree algorithm is also proposed by extending the decision tree algorithm and integrated with convolution neural networks to detect the intruders effectively. The experimental analysis carried out using KDD cup data set and network trace data set demonstrates the effectiveness of this proposed approach. It proved that the false positive rate, energy consumption, and delay are reduced in the proposed work. In addition, the proposed system increases the network performance through increased packet delivery ratio.

Online Alternate Generator against Adversarial Attacks.

The field of computer vision has witnessed phenomenal progress in recent years partially due to the development of deep convolutional neural networks. However, deep learning models are notoriously sensitive to adversarial examples which are synthesized by adding quasi-perceptible noises on real images. Some existing defense methods require to re-train attacked target networks and augment the train set via known adversarial attacks, which is inefficient and might be unpromising with unknown attack types. To overcome the above issues, we propose a portable defense method, online alternate generator, which does not need to access or modify the parameters of the target networks. The proposed method works by online synthesizing another image from scratch for an input image, instead of removing or destroying adversarial noises. To avoid pretrained parameters exploited by attackers, we alternately update the generator and the synthesized image at the inference stage. Experimental results demonstrate that the proposed defensive scheme and method outperforms a series of state-of-the-art defending models against gray-box adversarial attacks.

Network Intrusion Detection Based on Conditional Wasserstein Generative Adversarial Network and Cost-Sensitive Stacked Autoencoder

In the field of intrusion detection, there is often a problem of data imbalance, and more and more unknown types of attacks make detection difficult. To resolve above issues, this article proposes a network intrusion detection model called CWGAN-CSSAE, which combines improved conditional Wasserstein Generative Adversarial Network (CWGAN) and cost-sensitive stacked autoencoders (CSSAE). First of all, the CWGAN network that introduces gradient penalty and L2 regularization is used to generate specified minority attack samples to reduce the class imbalance of the training dataset. Secondly, the stacked autoencoder is used to intelligently extract the deep abstract features of the network data. Finally, a cost-sensitive loss function is constructed to give a large misclassification cost to a minority of attack samples. Thus, effective detection of network intrusion attacks can be realized. The experimental results based on KDDTest <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> , KDDTest-21, and UNSW-NB15 datasets show that the CWGAN-CSSAE network intrusion detection model improves the detection accuracy of minority attacks and unknown attacks. In addition, the method in this article is compared with other existing intrusion detection methods, excellent results have been achieved in performance indicators such as accuracy and F1 score. The accuracy on the above datasets reached 90.34%, 80.78% and 93.27% respectively. The accuracy of U2R on the KDDTest <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> and KDDTest-21 datasets both reached 42.50%. The accuracy of R2L on the KDDTest <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">+</sup> and KDDTest-21 datasets reached 54.39% and 52.51%, respectively. And the F1 score on the above datasets reached 91.01%, 87.18% and 93.99% respectively.

Intrusion detection system using deep learning for in-vehicle security

With the development of vehicle intelligence technology, the combination of network and vehicle becomes inevitable, which brings much convenience to people. At the same time, hackers can also use technical vulnerabilities to attack vehicles, leading to severe traffic accidents and even vehicle crash. Based on this situation, the vehicle information security protection techniques have drawn great attention from researchers. This paper studies the vehicle intrusion detection system (IDS) based on the neural network algorithm in deep learning, and uses gradient descent with momentum (GDM) and gradient descent with momentum and adaptive gain (GDM/AG) to improve the efficiency and accuracy of IDS. The accuracy and efficiency of the proposed model are validated and evaluated by using real vehicles at the end of the paper. Experiments show that the GDM/AG algorithm can achieve faster convergence in comparison with the GDM algorithm in vehicle anomaly detection, and can detect anomaly data at the level of milliseconds. At the same time, the proposed model can adapt itself to detect unknown attacks. The veracity rate ranges from 97% to 98% in directing the adaptation when facing unknown attack types.

Data Clustering for Anomaly Detection in Content-Centric Networks

Content-Centric Networks (CCNs) have recently emerged as an innovative trend to overcome many inherent security problems in the IP-based (host-based) networks by securing the content it- self rather than the channel through which it travels. In this net- work architecture new kinds of attacks -ranging from DoS to pri- vacy attacks- will appear. Therefore, it is becoming necessary to design a flexible and powerful mechanism to be able to detect them in an intelligent manner the first time they are employed. In this paper, a novel anomaly detection system has been pro- posed to detect known and previously unknown types of attacks using an efficient unsupervised learning engine that utilizes clus- tering with the optimal number of clusters, high detection rate, and low false positive rate in the same time over the CCN traf- fics flows. This paper compares the performance of five different clustering algorithms in the proposed anomaly detection system in- cluding K-means and Farthest First as Partitioning clustering, Cob- web as Hierarchical clustering, DBSCAN as Density-based clus- tering and Self Organizing Map (SOM) as Model-based cluster- ing. Results show that DBSCAN method is the most efficient one for this purpose since it outperforms the other ones in terms of high detection rate and low false positive rate in the same time. General Terms:

Intrusion detection in MANET using classification algorithms: The effects of cost and model selection

Intrusion detection is frequently used as a second line of defense in Mobile Ad-hoc Networks (MANETs). In this paper we examine how to properly use classification methods in intrusion detection for MANETs. In order to do so we evaluate five supervised classification algorithms for intrusion detection on a number of metrics. We measure their performance on a dataset, described in this paper, which includes varied traffic conditions and mobility patterns for multiple attacks. One of our goals is to investigate how classification performance depends on the problem cost matrix. Consequently, we examine how the use of uniform versusweighted cost matrices affects classifier performance. A second goal is to examine techniques for tuning classifiers when unknown attack subtypes are expected during testing. Frequently, when classifiers are tuned using cross-validation, data from the same types of attacks are available in all folds. This differs from real-world employment where unknown types of attacks may be present. Consequently, we develop a sequential cross-validation procedure so that not all types of attacks will necessarily be present across all folds, in the hope that this would make the tuning of classifiers more robust. Our results indicate that weighted cost matrices can be used effectively with most statistical classifiers and that sequential cross-validation can have a small, but significant effect for certain types of classifiers.