Unknown Threats Research Articles

An Efficient Network Intrusion Detection and Classification System using Machine Learning

In today's digital landscape, network security is of paramount importance, with intrusion detection systems (IDS) playing a crucial role in protecting sensitive data from malicious attacks. Traditional IDS, often reliant on signature-based methods, struggle with high false positive rates, difficulty in adapting to novel threats, and significant computational demands. This paper explores the development of an efficient network intrusion detection and classification system utilizing machine learning techniques to address these challenges. By leveraging datasets such as NSL-KDD and UNSW-NB15, our study employs a combination of supervised learning algorithms, including Support Vector Machines (SVM), Random Forests, and Neural Networks, alongside comprehensive data preprocessing and feature engineering strategies. The evaluation of our models through metrics like accuracy, precision, recall, and ROC-AUC demonstrates a marked improvement in detection capabilities and computational efficiency. Our findings suggest that machine learning-based IDS can significantly enhance network security by reducing false positives and adapting to emerging threats more effectively than traditional systems. This research not only underscores the potential of advanced machine learning techniques in IDS but also provides a robust framework for future developments in the field. In the rapidly evolving landscape of cybersecurity, effective network intrusion detection and classification systems are critical for safeguarding sensitive data and maintaining operational integrity. This paper presents a novel approach utilizing machine learning techniques to enhance the efficiency and accuracy of intrusion detection systems (IDS). By employing a combination of supervised and unsupervised learning algorithms, our system can identify and classify both known and unknown threats in real-time. We leverage advanced feature selection methods to optimize the performance of our models, ensuring high detection rates with minimal false positives. Our experimental results, validated on benchmark datasets, demonstrate significant improvements in detection accuracy and processing speed compared to traditional IDS solutions. The proposed system not only strengthens network defenses but also provides a scalable and adaptive framework for future cybersecurity challenges..

A hybrid approach using support vector machine rule-based system: detecting cyber threats in internet of things

While the proliferation of the Internet of Things (IoT) has revolutionized several industries, it has also created severe data security concerns. The security of these network devices and the dependability of IoT networks depend on efficient threat detection. Device heterogeneity, computing resource constraints, and the ever-changing nature of cyber threats are a few of the obstacles that make detecting cyber threats in IoT systems difficult. Complex threats often go undetected by conventional security measures, requiring more sophisticated, adaptive detection methods. Therefore, this study presents the Hybrid approach based on the Support Vector Machines Rule-Based Detection (HSVMR-D) method for an all-encompassing approach to identifying cyber threats to the IoT. The HSVMR-D employs SVM to categorize known and unknown threats using attributes acquired from IoT data. Identifying known attack signatures and patterns using rule-based approaches improves detection efficiency without retraining by adapting pre-trained models to new IoT contexts. Moreover, protecting vital infrastructure and sensitive data, HSVMR-D provides a thorough and adaptable solution to improve the security posture of IoT deployments. Comprehensive experiment analysis and simulation results compared to the baseline study have confirmed the efficiency of the proposed HSVMR-D. Furthermore, increased resilience to completely novel changing threats, fewer false positives, and improved accuracy in threat detection are all outcomes that show the proposed work outperforms others. The HSVMR-D approach is helpful where the primary objective is a secure environment in the Internet of Things (IoT) when resources are limited.

Design and implementation of anti-mapping security access technology based on illegal scanning

Abstract In the current field of information security, illegal network scanning activities are prevalent, and such behaviors are usually aimed at detecting security vulnerabilities in network systems and preparing for future attack activities. This study proposes a secure access system based on anti-mapping technology, which aims to effectively block illegal scanning behaviors while ensuring that the normal access of legitimate users is not affected. The system integrates advanced behavioral analysis algorithms that utilize machine learning techniques for deep learning and pattern recognition of network traffic, and is able to accurately distinguish between normal user activities and malicious scanning attempts. At the core of the system is a set of dynamic adaptive identification mechanisms that update the detection algorithms in real time to adapt to emerging scanning techniques and attack strategies by continuously learning from changes in network traffic. In addition, the system employs role-based access control (RBAC) policies to enhance the protection of sensitive resources. The Secure Access Gateway is deployed at the boundary of the network to monitor and filter all ingress traffic, effectively intercepting unauthorized scanning activities by comprehensively evaluating the source, behavior and frequency of traffic. Experimental results show that the proposed two-layer network structure performs well in detecting common threats such as port scanning, DDoS attacks, and SQL injections, with an accuracy rate of over 95%. Especially for complex and covert APT (advanced persistent threat) attacks, the system can significantly reduce the false alarm rate and effectively improve the detection speed. However, when dealing with some highly customized malware, the system's recognition ability still needs to be improved, which indicates that future research needs to focus more on enhancing the ability to learn and adapt to unknown threats.

Machine Learning in Cybersecurity: A Comprehensive Analysis of Intrusion Detection Systems

Cyber threats are getting more complex and larger, and traditional security measures can't keep up with the sophisticated attacks. Machine Learning (ML) has emerged as a powerful tool in enhancing cybersecurity, particularly in the development of Intrusion Detection Systems (IDS). a comprehensive analysis of the role of machine learning in intrusion detection, focusing on its ability to detect and respond to both known and unknown threats in real-time. various machine learning techniques, including supervised, unsupervised, and deep learning models, and evaluates their effectiveness in identifying anomalies and preventing security breaches. Key performance metrics such as accuracy, false positive rates, and scalability are analyzed, with a focus on the advantages and limitations of each approach. Additionally, the paper explores the challenges associated with implementing ML-based IDS, including data quality, adversarial attacks, and computational requirements. Through case studies and real-world examples, this paper highlights how machine learning is revolutionizing intrusion detection and presents insights into future advancements that will further strengthen cybersecurity defenses.

Improved identification of network anomalies through optimal CURE clustering

Abstract In this paper, we propose an advanced network anomaly behavior identification framework to overcome the constraints inherent in conventional rule- or signature-based approaches, which often struggle with emerging and previously unknown threats. Central to our framework is an Enhanced CURE (Cluster Updating and REfining) clustering algorithm, meticulously tailored and refined to incorporate a density-based methodology. This enhancement enables the algorithm to discern subtle shifts in network anomaly patterns with heightened precision. The implementation workflow commences with the application of the optimized CURE algorithm to analyze network data, followed by the deployment of a sophisticated anomaly degree ranking mechanism. This mechanism, through meticulous calculation of individual data points' anomaly degrees and subsequent ranking, effectively isolates those deviating significantly from standard behavioral norms, incorporating a strategic threshold to filter out false positives. To validate our methodology's efficacy and its superiority over existing techniques, experiments were conducted utilizing a substantial real-world network dataset. These tests affirm not only a marked increase in the accuracy of abnormal behavior recognition and a reduction in computational intricacy but also demonstrate the adaptability across diverse network ecosystems. Our approach has proven successful in pinpointing a wide array of network anomalies, encompassing malicious cyberattacks, fraudulent activities, unauthorized intrusions, and breaches of security protocols, thereby highlighting its comprehensive capability in bolstering network defense strategies. Despite the notable advancements and successful identification of various network anomalies, our framework currently lacks integration with real-time learning capabilities, limiting its immediate responsiveness to rapidly evolving attack patterns and necessitating ongoing research for dynamic updates and adaptive learning mechanisms.

Catalysing vaccines and biologics manufacturing in Africa

Catalysing vaccines and biologics manufacturing in Africa Professor Faith Osier, Director of the Chanjo Hub at Imperial College London, shares her vision for vaccines and biologics manufacturing in Africa to secure lives and livelihoods and drive economic growth. The COVID-19 pandemic demonstrated that Africa should not rely on donations from rich countries. Africa has the highest burden of endemic infectious diseases globally, accounting for >227mn years of health life lost, an annual productivity loss of >$800bn and an infection-related mortality of ~10m/ year. The list of diseases is long, diverse and challenging. It includes infectious diseases like cholera, Ebola, meningitis, measles, yellow fever, mpox and COVID-19, to mention a few. Some are caused by zoonotic pathogens that spill over from animals to humans. The need for local capacity to rapidly respond to known and unknown threats and to mitigate global impacts is urgent.

Machine learning algorithms in SIEM systems for enhanced detection and management of security events

As cyber threats become increasingly sophisticated, traditional Security Information and Event Management (SIEM) systems face challenges in effectively identifying and responding to these dangers. This research presents the development of a SIEM system integrated with machine learning (ML) to enhance threat detection, anomaly identification, and automated incident response. The integration of ML allows the SIEM system to go beyond conventional rule-based approaches, enabling the detection of previously unknown threats by learning from historical data. The system employs advanced algorithms to analyze large-scale log data and network traffic, providing real-time insights and reducing false positives. Key features of this SIEM include anomaly detection, predictive analytics, and adaptive thresholds, which allow it to adjust dynamically based on contextual data. By adapting to new and evolving cyber threats, the system provides a more resilient and proactive defense against potential attacks. The results indicate that integrating machine learning into SIEM systems can offer organizations a more effective, scalable, and adaptive security solution, ensuring the protection of critical infrastructure and data in a rapidly changing digital landscape.

Impact of chemical aging on pyrogenic carbon colloid facilitated transport and transformation of Cr (VI) in anoxic environments

Frequent wildfires have accumulated the pyrogenic carbon (PyC) colloids in the environment, where they undergo environmental aging processes. The altered properties of aged PyC colloids may affect their ability to facilitate transformation and transport of contaminants in post-fire environments, posing unknown threats to ecological security. This study investigated the effect of chemical aging on the PyC colloid-facilitated transformation and transport of chromium (Cr) using batch experiments, column experiments, and transport model simulations. Results showed that aged PyC colloids exhibited weaker electron-donating capacity, and the reduction of Cr (VI) to Cr (III) decreased from 37.6 % to 13.5 % with the increasing aging time. Although PyC colloid transport increased with aging time, the PyC colloid-facilitated Cr (III) transport decreased because of the weakened reduction of Cr (VI). The transport of PyC colloid-facilitated Cr (III) was weaker at low pH. The reactive solute transport model well simulated the aged PyC colloid-facilitated transformation and transport of Cr (VI). Our findings highlight the significance of aging processes and environmentally relevant conditions in influencing the PyC colloid-facilitated transformation and transport of Cr, which is crucial for assessing risks of wildfire-driven Cr pollution and the potential of PyC for in-situ pollution control.

Adaptive multi-granularity trust management scheme for UAV visual sensor security under adversarial attacks

The big data provided by unmanned aerial vehicle (UAV) visual sensors offers essential information resources for activities across various industries. However, various adversarial threats are inevitable throughout the lifecycle of data generation, transmission, and utilization, leading to serious security risks. Trust assessment of visual sensors is a prerequisite for securing UAVs, but the multidimensionality of the trust elements and the uncertainty of the evidence limit its practical application. To advance this research, we innovatively propose a trust management scheme based on multi-granularity evidence fusion within the framework of belief functions (BFs) theory to adaptively respond to both known and unknown threats. We first propose a direct trust assessment model for known threats, which constructs multidimensional coarse-grained trust elements (MCTEs) and integrates multiple lightweight sub-models for basic belief assignment (BBA) to meet the need for fast response. Then, to address the unknown threats, we introduce pre-trained models to build multidimensional fine-grained trust elements (MFTEs) to construct trust recommendation models for indirect trust assessment for visual sensors. In addition, to accurately characterize the trustworthiness of visual sensors, we also introduce a BBA-weighted fusion method to achieve more reasonable trust aggregation by weakening highly conflicting evidence sources. Finally, to validate the effectiveness of the proposed method, we conducted a comprehensive trust assessment and security experiment on UAV aerial images. The results indicate that the proposed method demonstrates excellent performance and is beneficial for enhancing UAV security in adversarial attack scenarios.

Malware classification through Abstract Syntax Trees and L-moments

The ongoing evolution of malware presents a formidable challenge to cybersecurity: identifying unknown threats. Traditional detection methods, such as signatures and various forms of static analysis, inherently lag behind these evolving threats. This research introduces a novel approach to malware detection by leveraging the robust statistical capabilities of L-moments and the structural insights provided by Abstract Syntax Trees (ASTs) and applying them to PowerShell. L-moments, recognized for their resilience to outliers and adaptability to diverse distributional shapes, are extracted from network analysis measures like degree centrality, betweenness centrality, and closeness centrality of ASTs. These measures provide a detailed structural representation of code, enabling a deeper understanding of its inherent behaviors and patterns. This approach aims to detect not only known malware but also uncover new, previously unidentified threats. A comprehensive comparison with traditional static analysis methods shows that this approach excels in key performance metrics such as accuracy, precision, recall, and F1 score. These results demonstrate the significant potential of combining L-moments derived from network analysis with ASTs in enhancing malware detection. While static analysis remains an essential tool in cybersecurity, the integration of L-moments and advanced network analysis offers a more effective and efficient response to the dynamic landscape of cyber threats. This study paves the way for future research, particularly in extending the use of L-moments and network analysis into additional areas.

A review of black-box adversarial attacks and defenses in machine learning-based malware detection

In recent years, significant advancements have been made in cyber security, particularly through the application of machine learning (ML) methods. ML-based techniques have enhanced system security by effectively distinguishing between malicious and benign objects across various domains, including spam email detection, social media content filtering, intrusion detection systems, and malware detection. This paper focuses on the specific area of ML-based malware detection and its advantages over traditional methods, such as improved accuracy and the ability to generalize to unknown threats. Despite these advancements, ML-based malware detection systems are vulnerable to adversarial attacks, especially in black-box scenarios where the internal workings of the detection model are not accessible. This paper provides a comprehensive review of adversarial attacks on black-box malware detection systems and examines the current defense mechanisms against these attacks. Understanding the challenges and strategies in this field, this review aims to offer insights into enhancing the robustness and security of ML-based malware detection systems.

Assessment of Quality of Life of Doctors during Corona Pandemic in a Tertiary Hospital in Dhaka City

Background: Corona pandemic is an event where there is a rupture of the normal life pattern. The healthcare professionals specially doctors had faced an unknown potential threat to life that made them work in an intense and fearful situation. So, their quality of life (QOL) was affected in that pandemic. Objectives: To assess the physical health, psychological, social relationship, and environmental domains of quality of life of doctors during COVID-19 pandemic in a tertiary level hospital. Methods: It was a cross sectional study that included 100 doctors who were working during corona pandemic in BSMMU. Then they were interviewed with a semi-structured socio-demographic questionnaire. Quality of life was assessed by validated Bengali version of World Health Organization quality of life scale brief (WHOQOL-BREF). Data analysis was performed by statistical package for social science (SPSS), version-20. Results: Among the four domains, the environmental domain had the lowest score followed by physical health and psychological health domain and the social relationship domain showed a relatively higher score. Besides, environmental health scores of female doctors were significantly higher than those of male doctors. Perceptions of quality of life were significantly poor among doctors who were in current economic struggle (p=0.034) or in fear of future economic struggle (p=0.009). Score of environmental health domain were significantly low among doctors who were in current economic struggle (p=0.0137) as well as in fear of future economic struggle (p=0.015). Conclusion: All domains of quality of life were impaired in doctors during COVID-19 pandemic situation. Among the four domains of WHOQOL-BREF scale, environmental domain was mostly affected. Environmental health of male doctors was worse than female doctors during COVID-19 pandemic. Current as well as fear of future economic struggle in COVID-19 pandemic detrimentally affected perception of quality of life among responded doctors. These also caused poor environmental health among doctors in COVID-19 pandemic. J Com Med Col Teachers Asso Jan 2024; 28(1): 09-13

Why nanny statism matters: evidence from the first wave of COVID-19

BackgroundA nanny state imposes restrictions on people’s liberty and freedom of action in order to advance their interest and welfare. The extent to which this is desirable, or even ethically acceptable, is debated in the literature. This paper formulates and tests the following hypothesis: the more of a nanny a state has been in the past, the more likely it is that the incumbent government will respond to a new, unknown threat with interventions of a paternalist nature, irrespective of other factors that might contribute to shaping government’s response. This hypothesis is then taken to the data using the first wave of COVID-19 as an empirical test.MethodsData are collected from secondary sources for a sample of 99 countries. Nanny statism is measured by the number of paternalist laws and regulations adopted by a country in the past. The response to COVID is proxied by the time of adoption of control and containment measures and their stringency. The public health outcome is measured by the COVID-19 death toll at the end of June 2020. These variables, plus several controls, are then used to estimate a set of linear and probit regressions and a proportional hazard model of the timing of adoption of control and containment measures.ResultsAn increase in nanny statism by 0.1 (on a scale from 0 to 10) on average increases the probability of adoption of control and containment measures by 0.077 (i.e. 7.7 percentage points). The central tenement of the hypothesis is therefore consistent with the empirical evidence. The linear and probit regressions also show that there is no evidence of a significant effect of nanny statism on the stringency of the measures adopted. Irrespective of stringency, however, early adoption of control and containment measures is found to reduce the death toll of COVID-19 in the first half of 2020: an increase in nanny statism by 0.1 reduces the COVID death toll by approximately 7%.ConclusionsA tradition of nanny statism potentially leads to a more timely and effective public policy response to a new, unknown crisis. Further tests of the hypothesis should look at the relationship between nanny statism and public health outcomes from natural disasters.

AIS-NIDS: An intelligent and self-sustaining network intrusion detection system

The ever-evolving landscape of network security is continually molded by the dynamic evolution of attack vectors and the relentless emergence of new, highly sophisticated attacks. Attackers consistently employ increasingly advanced techniques, rendering their actions elusive and formidable. In response to this ever-growing threat, the demand for intelligent and autonomous security systems has reached paramount importance. In this paper, we introduce AIS-NIDS (An Intelligent and Self-Sustaining Network Intrusion Detection System), an innovative network intrusion detection system (NIDS) that delves into the realm of packet-level analysis. By doing so, AIS-NIDS is capable of identifying threats with intricate payload-level details, a level of granularity that traditional NIDS relying solely on flow-level data may overlook. The defining feature of AIS-NIDS is its dual functionality, driven by autonomous and intelligent learning. It not only autonomously distinguishes between benign and unknown attacks using machine learning models but also conducts incremental learning, adapting to new attack classes. In essence, AIS-NIDS bridges the gap between traditional NIDS and the next generation of intelligent systems, endowing the system with the capacity for independent decision-making and real-time adaptability in the face of evolving threats. Our extensive experiments stand as a testament to AIS-NIDS’ ability to efficiently manage and identify new attack classes, thus establishing it as a valuable asset in the reinforcement of network infrastructures. Through our experimentation, we have demonstrated the practical efficacy of the proposed approach by simulating a real-world scenario in which certain attack classes are unknown. AIS-NIDS not only effectively identified these unknown threats but also autonomously learned to recognize them as it encountered them, enhancing the system’s capabilities for future encounters with these threats.

Intrusion Detection System to Secure a Network using ACNN Model and Machine Learning

As cyber threats continue to evolve in sophistication and diversity, the need for robust Intrusion Detection Systems (IDS) becomes paramount to safeguarding network integrity. This research explores the application of an innovative approach by integrating an Attention-based Convolutional Neural Network (ACNN) model with machine learning techniques to enhance the accuracy and efficiency of intrusion detection. The proposed system leverages the ACNN's ability to capture contextual dependencies in network traffic data, enabling the extraction of intricate patterns indicative of potential intrusions. The ACNN's attention mechanism focuses on relevant features within the data, improving the model's discriminative power and adaptability to dynamic cyber threats. To achieve optimal performance, the ACNN is complemented with a machine learning framework that includes feature engineering, dimensionality reduction, and classification algorithms. This integrated approach allows the system to adapt and learn from evolving attack vectors, providing a proactive defense mechanism against both known and unknown threats. The research evaluates the proposed ACNN-based IDS using benchmark datasets and real-world network traffic scenarios. Comparative analysis against traditional IDS models showcases the superiority of the ACNN in terms of detection accuracy, false positive rates, and computational efficiency. Furthermore, the system's adaptability to emerging threats is demonstrated through continuous learning and retraining mechanisms. Results indicate that the ACNN-based IDS not only exhibits superior performance but also demonstrates resilience against evasion techniques employed by malicious actors. The research findings contribute to the advancement of network security by presenting a cuttingedge solution that combines deep learning and machine learning for effective and adaptive intrusion detection.

Enhancing Intrusion Detection Systems with Recurrent Neural Networks in D23 Deep Learning

Strong cybersecurity safeguards are increasingly necessary as the digital landscape changes to protect sensitive data and vital infrastructure. To detect and reduce any risks to network security, intrusion detection systems, or IDS, are essential. To improve the precision and effectiveness of anomaly detection, this paper suggests a novel method of intrusion detection that makes use of recurrent neural networks (RNNs). Standard intrusion detection systems (IDS) frequently depend on static rule-based systems, which may find it difficult to adjust to changing and dynamic cyber threats. On the other hand, sequence-retention neural networks, or RNNs, they have a special capacity to recognize patterns and temporal connections in sequential input. Traditional IDS methods are contrasted with the suggested system, which is assessed using common datasets. The RNN-based IDS is successful at detecting known and unknown threats while reducing false positives, according to preliminary data.

A performance-based approach to developing capabilities for building resilience to climate hazards in transportation systems

Purpose This paper discusses a multifaceted approach to developing specific and general climate resilience in a state transportation system that focuses on organizations and physical infrastructure. The paper focuses on resilience building to the dynamically evolving climate-related threats and extreme events in a transportation agency. This paper aims to enable agencies to understand better how their systems are exposed to different hazards and provide the information necessary for prioritizing their assets and systems for resilience improvement. Design/methodology/approach This paper leverages long-term climate hazard databases, spatial and statistical analyses and nonprobabilistic approaches for specific and general climate resilience improvement. Spatial and temporal variability assessments were conducted on granular historical records of exposure obtained from Spatial Hazards Events and Losses Database for the United States data set to identify emerging hot spots of exposure. These were then assessed in combination with various asset specific vulnerability parameters, presented with examples of pavements and bridges. Specific metrics were obtained for the various aspects of vulnerability in the context of a given asset to estimate the overall vulnerability. A criticality-vulnerability matrix was then developed to provide a prioritization model for transportation systems. Findings This paper provides insights into the evolving nature of exposure, vulnerability and risk assessments and an approach to systematically account for climate change and the uncertainties associated with it in resilience planning. The Multi-Hazards Exposure, Vulnerability and Risk Assessment tool presented in this paper conducts climate hazard exposure, vulnerability and risk analysis on pavements, bridges and culverts and can be applied by any transportation agency. Research limitations/implications This study does not address operational aspects of the transportation system nor include future climate scenario data, but uses the historical records available at hand for resilience planning. With better climate projection data available in the future, the approach should be enhanced by leveraging scenario-based planning. Practical implications This paper is of potential value to practitioners and researchers interested in developing resilience building capabilities to manage the effects of climate-related hazards and extreme events as well as unknown threats on infrastructure and organizational performance. Originality/value This paper bridges an important gap in infrastructure resilience approaches by systematically accounting for the dynamic nature of climate change and the system level context of vulnerability beyond the physical condition of assets.

Mitigating Gradient-Based Data Poisoning Attacks on Machine Learning Models: A Statistical Detection Method

Objectives: This research paper aims to develop a novel method for identifying gradient-based data poisoning attacks on industrial applications like autonomous vehicles and intelligent healthcare systems relying on machine learning and deep learning techniques. These algorithms performs well only if they are trained on good quality dataset. However, the ML models are prone to data poisoning attacks, targeting the training dataset, manipulate its input samples such that the machine learning algorithm gets confused and produces wrong predictions. The current detection techniques are effective to detect known attacks and lack generalized detection to unknown attacks. To address this issue, this paper aims to integrate security elements within the machine learning framework, guaranteeing effective identification and mitigation of known and unknown threats and achieve generalized detection. Methods: ML Filter, a unique attack detection approach integrates ML-Filter Detection Algorithm and the Statistical Perturbation Bounds Identification Algorithm to determine the given dataset is poisoned or not. DBSCAN algorithm is used to divide the dataset into several smaller subsets and perform algorithmic analysis for detection. The performance of the proposed method is evaluated in terms of True positive rate and significance test accuracy. Findings: The probability distribution differences between original and poisoned datasets vary with change in perturbation size rather than the datasets and ML models use for application. This finding lead to determine the perturbation bounds using statistical pairwise distance metrics and corresponding significance tests computed on the results. ML Filter demonstrates a high detection rate of 99.63% for known attacks and achieves a generalized detection accuracy of 98% for unknown attacks. Novelty: A secured ML architecture and a unique statistical detection approach ML-Filter, effectively detect data poisoning attacks, demonstrating significant advancements in detecting both known and unknown threats in industrial applications utilizing machine learning and deep learning algorithms. Keywords: Privacy and security, Adversarial machine learning, Secured ML Architecture, ML-Filter, Statistical Perturbation Bounds Identification Algorithm

A framework for detecting zero-day exploits in network flows

Zero-day attack detection solutions aim to proactively identify unknown threats targeting valuable assets within a given system. While many Intrusion Detection System (IDS) solutions leverage learning techniques to build novel attack detection systems, they often focus on enhancing accuracy for specific attack types, overlooking the potential for multiple attack scenarios. Therefore, we introduce a novel framework for detecting zero-day attacks that evade current detection systems. Our framework enhances attack identification and qualification through a hybrid learning approach, where supervised learning ensures detection of known attacks and unsupervised learning. It encompasses intrusion detection phases from data collection to new attack class detection by identifying anomalies in real-time network flow data. Unsupervised learning, which involves grouping similar data points into clusters, establishes minimum distances within these clusters. This process triggers cluster division when certain thresholds are reached. Finally, an online supervised learning process validates our approach’s effectiveness in identifying anomalies associated with zero-day attack flows.This approach significantly reduces the False Detection Rate (FDR) without solely focusing on optimizing machine learning (ML) and deep learning (DL) algorithms hyper-parameters. We evaluated our framework on two datasets: one from a real industrial context at IBM and the NSL-KDD dataset. The results demonstrate our framework’s ability to detect anomalies in previously zero-day attack targets. On average, we identified 71 anomalous flows per target, achieving an overall average online learning accuracy of 98.4% for the IBM dataset and 96.6% for the NSL-KDD dataset, thereby validating the detection of these new attack scenarios.

A study of jamming resource allocation based on a hyperheuristic framework

There are massive data and rapidly changing battlefield situations in modern electronic warfare, which is a challenge to jamming resource allocation. It is difficult for the existing optimization algorithms to balance optimization capability and calculation speed at the same time. Above all, this study designs a fuzzy multiattribute evaluation model based on behavioral characteristics. The model comprehensively integrates the characteristics of signal behavior, motion behavior, and external intelligence and can effectively deal with unknown threat signals. Then, this study proposes an improved genetic selection electronic warfare operator (EWO) hyperheuristic (GAEWHH) algorithm. As an emergent optimization algorithm, the HH framework has not previously been applied to the problem of jamming resource allocation. This is a two-level algorithm framework that can isolate problem domains. The high level uses an improved genetic algorithm to search the heuristic space, and four EWOs based on the problem domain are designed for the low level to search the solution space. Combining different EWOs can change the population diversity, evolution direction, and algorithm complexity of the GAEWHH algorithm, which improves the algorithm performance to meet battlefield situation requirements. The experiment shows that for large-scale problems, the GAEWHH algorithm is better than the mainstream evolutionary algorithm in terms of optimization capability and better than Google OR-Tools in terms of calculation speed. In this way, the GAEWHH algorithm achieves a balance between optimization capability and calculation speed.