Search

Network data traffic is increasing with expanded networks for various applications, with text, image, audio, and video for inevitable needs. Network traffic pattern identification and analysis of traffic of data content are essential for different needs and different scenarios. Many approaches have been followed, both before and after the introduction of machine and deep learning algorithms as intelligence computation. The network traffic analysis is the process of incarcerating traffic of a network and observing it deeply to predict what the manifestation in traffic of the network is. To enhance the quality of service (QoS) of a network, it is important to estimate the network traffic and analyze its accuracy and precision, as well as the false positive and negative rates, with suitable algorithms. This proposed work is coining a new method using an enhanced deep reinforcement learning (EDRL) algorithm to improve network traffic analysis and prediction. The importance of this proposed work is to contribute towards intelligence-based network traffic prediction and solve network management issues. An experiment was carried out to check the accuracy and precision, as well as the false positive and negative parameters with EDRL. Also, convolutional neural network (CNN) machines and deep learning algorithms have been used to predict the different types of network traffic, which are labeled text-based, video-based, and unencrypted and encrypted data traffic. The EDRL algorithm has outperformed with mean Accuracy (97.20%), mean Precision (97.343%), mean false positive (2.657%) and mean false negative (2.527%) than the CNN algorithm.

The Internet of Things (IoT) features multiple device connectivity and breaks the conventional network connectivity limitations like limited wireless range, scalability specific communication protocol dependency, etc. Multiple devices can be connected in an IoT network without significant infrastructure changes and the devices can communicate with each other through variety of protocols, which could be more beneficial in many organizations, consumers, and governments. However, the rapid development of IoT technology requires a secure network as it must access different devices and communication methods. This diversity and heterogeneity make network intrusions more convenient for intruders. IoT network complexity and security flaws increase when a large volume of data is transferred through a network. Intrusion detection systems (IDS) are used to monitor the network behavior for detecting unusual behaviors or intrusions. Numerous machine learning models are used in IDS for classifying network traffic. However, these methods lag in detection performances due to limited feature handling abilities. Thus, in selecting optimal features that correctly indicate the intrusions in the network, optimization models are used in IDSs. However, due to the limited exploration and exploitation ability of conventional optimization algorithms, this research presents a hybrid optimization algorithm using Salp Swarm Optimization and Bee Foraging (SSA-BF) optimization approaches for optimal feature selection. The optimal features are classified using a multiplicative Long Short-Term Memory (MLSTM) network. To check the robustness of the proposed IDS, accuracy, recall, f1-score, and precision metrics are considered for analysis. Simulation results of the proposed IDS exhibited a maximum accuracy of 95.8%, better than conventional Auto Encoder, Convolutional Neural Network, Gaussian mixture model with Generative adversarial Network, Multi-CNN, and DeepNet-based IDSs. [ABSTRACT FROM AUTHOR]

Summary: Internet data thefts, intrusions and DDoS attacks are some of the big concerns for the network security today. Detection of these anomalies, is gaining tremendous impetus with the development of machine learning and artificial intelligence. Even now researchers are shifting the base from machine learning to the deep neural architectures with auto‐feature selection capabilities. We in this paper propose multiple deep neural network architectures which can select, co‐learn and teach the gradients of the neural network by itself with no human intervention. This is what we call as meta‐learning. The models are configured in both many to one and many to many design architectures. We combine long short‐term memory (LSTM), bi‐directional long short‐term memory (BiLSTM), convolutional neural network (CNN) layers along with attention mechanism to achieve the higher accuracy values among all the available deep learning model architectures. LSTMs overcomes the vanishing and exploding gradient problem of RNN and attention mechanism mimics the human cognitive attention that screens the network flow to obtain the key features for network traffic classification. In addition, we also add multiple convolutional layers to get the key features for network traffic classification. We get the time series analysis of the traffic done for the possibility of a DDoS attack without using any feature selection techniques and without balancing the dataset. The performance analysis is done based on confusion matrix scores, that is, accuracy, false alarm rate (FAR), sensitivity, specificity, false‐positive rate (FPR), F1 score, area under curve (AUC) analysis and loss functions on well‐known public benchmark KDD Cup'99 data set. The results of our experiments reveal that our models outperform existing techniques, showing their superiority in performance. [ABSTRACT FROM AUTHOR]

The modern digital environment is becoming increasingly interconnected, underscoring the critical need to safeguard network infrastructures. Detecting anomalies in network traffic remains essential as cyber threats continue to evolve. Analyzing trends, patterns, and relationships in network traffic data over time poses challenges. On the other hand, traditional generative neural networks emphasize detecting network attacks but encounter difficulties due to limitations in capturing the temporal and dynamic aspects of network traffic. This paper introduces a new methodology aimed at enhancing the identification of irregularities in network traffic using a Temporal Metric-Driven GRU Embedded Generative Neural Network (TMG-GRU-VAE). This method incorporates Gated Recurrent Units (GRU) into variational autoencoders to effectively train on the temporal characteristics of network traffic in temporal sequential networks. Moreover, we present a Temporal Correlation Index (TCI) score designed for anomaly detection in Network Intrusion Detection Systems (NIDS). This innovative metric offers a sophisticated and dynamic assessment of temporal behavior within network traffic. TCI’s ability to distinguish between normal and anomalous temporal patterns plays a pivotal role in mitigating false positives. Our proposed method greatly improves the detection of small changes in abnormal sequences over time, enhancing accuracy by making anomalies stand out more clearly and reducing false alarms, thereby making the system more reliable. The proposed work, validated using the CIC-IDS-2017 and CIC-IDS-2018 datasets, demonstrates a significant decrease in False Positives (FP) across all models. Notable improvements range from 7.2% to 12.9% for the CIC-IDS-2017 dataset and from 7.1% to 14.1% for the CIC-IDS-2018 dataset. This highlights its significant impact on decreasing false positive rates.

In the realm of network security, distributed denial of service (DDoS) attacks pose a formidable threat, often resulting in operational disruptions and substantial financial losses. Traditional methods for DDoS detection struggle to adapt to the rapidly evolving attack methodologies, leading to compromised detection robustness and accuracy. The urgent need for more sophisticated detection mechanisms is evident. This investigation explores the effectiveness of advanced deep learning and ensemble machine learning models in identifying DDoS threats. A comprehensive approach is employed, leveraging a multitude of base classifiers to construct a robust and precise detection system. Integral to this study is the application of convolutional neural networks (CNNs), a deep learning variant, adept at discerning complex patterns and relationships within network traffic data. These models excel in autonomously extracting pertinent features, thereby enabling efficient detection of intricate DDoS attacks. A critical step in this methodology involves the collection of a comprehensive network traffic dataset, encompassing both normal and DDoS attack scenarios. This dataset undergoes a rigorous preprocessing and enhancement phase to ensure a balanced and representative training set. Subsequently, the augmented data is utilized to train the proposed models. The performance of these models is evaluated using a variety of metrics. Results from the experiments demonstrate that both machine learning and deep learning models significantly surpass existing techniques in DDoS detection. By amalgamating the strengths of various classifiers and neural networks, the method enhances detection precision and resistance to diverse attack variations. Comparative analyses reveal impressive performance metrics, with models such as CNN 1D and Alex Net achieving high levels of accuracy and precision. The outcomes of this study underscore the superiority of deep learning models in identifying both prevalent and novel DDoS attack patterns, thereby highlighting their potential in countering evolving cyber threats. The findings advocate for the enhanced precision and adaptability of the proposed approach in DDoS detection, marking a significant advancement in the field. [ABSTRACT FROM AUTHOR]

Malware detection has recently emerged as a significant challenge on the Internet of Things (IoT) security domain. Due to the increasing complexity and variety of malware, the demand for better malware detection models has grown. To this end, an advanced intelligent IoT malware detection model is proposed based on deep learning and ensemble learning algorithms, called DEMD-IoT (Deep Ensemble Malware Detection for IoT). The DEMD-IoT includes two main parts: I) a stack of three one-dimensional convolutional neural networks with different structures to learn various patterns of IoT network traffic, and II) a meta-learner on top of three pre-trained base-learners, which integrates the outcomes and yields the final prediction result. To find the best meta-learner, different machine learning algorithms are examined. Finally, the Random Forest algorithm was chosen for the second part of the model. The main advantages of the DEMD-IoT are utilizing an ensemble learning approach to achieve higher performance and applying a hyperparameter optimization algorithm to find the best values for hyperparameters of base learners. Furthermore, to overcome the complexity and high time consumption in the preprocessing phase, 1D-CNNs are applied instead of 2D-CNNs, which are widely used in malware detection. The performance of the DEMD-IoT model is evaluated with a set of experiments on the IoT-23 dataset, which contains IoT network traffic. The findings demonstrate that the proposed ensemble method achieves the best outcome with the highest accuracy 99.9%, compared to state-of-the-art machine learning, deep learning, and ensemble models. [ABSTRACT FROM AUTHOR]

With the meteoric rise in anonymous network traffic data, there is a considerable need for effective automation in traffic identification tasks. Though many shallow and deep machine learning network traffic classification solutions have been proposed, they often rely on tabular data, making them unable to detect complex spatial relationships. However, recent advancements in computer processing power have increased the viability of transforming tabular data into images for training deep convolutional neural networks, transforming structured data problems into spatial ones. To identify the most effective methods for representing tabular anonymous network traffic data as images, we compared five deep learning classifiers trained on data from different tabular-to-image algorithms–Image Generator for Tabular Data (IGTD), DeepInsight, vector-of-feature wrapping (normalized and non-normalized), and our newly introduced Binary Image Encoding (BIE) technique in the classification of eight network application types. Furthermore, we examine whether deep residual models trained on tabular-to-image data can outperform the top-performing shallow learner, XGBoost, at classifying anonymous network traffic. We found that ResNet-50, a pre-trained instance of deep residual network, trained on image datasets using IGTD and the novel Binary Image Encoding outperformed XGBoost trained on tabular data. Our ResNet-50 models trained using IGTD and BIE achieved F1-scores of 96.0% and 98.49% respectively, improving on the baseline of 95.1% achieved by XGBoost.

To accurately find malware in a large number of mobile APPs, and determine which family it belongs to is one of the most important challenges in Android malware detection. Existed research focuses on using the extracted features to distinguish Android malicious APPs, and less attention is paid to the category and family classification of Android malware. Meanwhile, feature selection has always been a choose-difficult issue in malware detection with machine learning methods. In this paper, SelAttConvLstm was designed to classify android malware by category and family without manually selecting features. To identify Android malware, we first convert all the network traffic flows into grayscale images according to chronological order through data preprocessing. Second, we design SelAttConvLstm, a deep learning model to detect malicious Android APPs with network flows images. This model can consider both the spatial and temporal features of network flow at the same time. In addition, to improve the performance of the model, self-attention weights are added to focus on different features of the input. Finally, comprehensive experiments are conducted to verify the effectiveness of the detection model. Experimental results showed that our method can not only effectively detect malware, but also classify malware in detail and accurately by category and family. [ABSTRACT FROM AUTHOR]

Nowadays with the exponential rise of traffic over large scale networks, Internet is vulnerable to increased number of cyber attacks. The cyber attacks attempt to steal, alter, or destroy information through unauthorized access to systems. Recently, deep learning techniques have been proposed to detect cyber attacks. The existing deep learning based detection systems perform static detection of attacks failing to capture unknown attacks happening in evolving large network traffic. The unknown attacks could be detected on the fly if a generalizable model is designed for each evolving class of network traffic. This is effectively represented in the proposed Vector Convolutional Deep Autonomous Learning (VCDAL) classifier to detect cyber attacks in the network traffic data streams. The proposed VCDAL classifier extracts the features using vector convolutional neural network, learns the features automatically using incremental learning with distilled cross entropy, and classifies the evolving network traffic using softmax function. The proposed classifier was tested by conducting experiments on benchmark network traffic datasets and it is obvious that the proposed classifier can possibly recognize both known and unknown cyber attacks. Furthermore, it is observed from the comparative analysis that the proposed VCDAL classifier exhibits significant results compared to the existing base classifiers and state-of-the-art deep learning approaches. [ABSTRACT FROM AUTHOR]

Network management and multimedia data mining techniques have a great interest in analyzing and improving the network traffic process. In recent times, the most complex task in Software Defined Network (SDN) is security, which is based on a centralized, programmable controller. Therefore, monitoring network traffic is significant for identifying and revealing intrusion abnormalities in the SDN environment. Consequently, this paper provides an extensive analysis and investigation of the NSL-KDD dataset using five different clustering algorithms: K-means, Farthest First, Canopy, Density-based algorithm, and Exception-maximization (EM), using the Waikato Environment for Knowledge Analysis (WEKA) software to compare extensively between these five algorithms. Furthermore, this paper presents an SDN-based intrusion detection system using a deep learning (DL) model with the KDD (Knowledge Discovery in Databases) dataset. First, the utilized dataset is clustered into normal and four major attack categories via the clustering process. Then, a deep learning method is projected for building an efficient SDN-based intrusion detection system. The results provide a comprehensive analysis and a flawless reasonable study of different kinds of attacks incorporated in the KDD dataset. Similarly, the outcomes reveal that the proposed deep learning method provides efficient intrusion detection performance compared to existing techniques. For example, the proposed method achieves a detection accuracy of 94.21% for the examined dataset. [ABSTRACT FROM AUTHOR]

APT (Advanced Persistent Threat) attack is a dangerous, targeted attack form with clear targets. APT attack campaigns have huge consequences. Therefore, the problem of researching and developing the APT attack detection solution is very urgent and necessary nowadays. On the other hand, no matter how advanced the APT attack, it has clear processes and lifecycles. Taking advantage of this point, security experts recommend that could develop APT attack detection solutions for each of their life cycles and processes. In APT attacks, hackers often use phishing techniques to perform attacks and steal data. If this attack and phishing phase is detected, the entire APT attack campaign will crash. Therefore, it is necessary to research and deploy technology and solutions that could detect early the APT attack when it is in the stages of attacking and stealing data. This paper proposes an APT attack detection framework based on the Network traffic analysis technique using open-source tools and deep learning models. This research focuses on analyzing Network traffic into different components, then finds ways to extract abnormal behaviors on those components, and finally uses deep learning algorithms to classify Network traffic based on the extracted abnormal behaviors. The abnormal behavior analysis process is presented in detail in section 3.1 of the paper. The APT attack detection method based on Network traffic is presented in section 3.2 of this paper. Finally, the experimental process of the proposal is performed in section 4 of the paper. [ABSTRACT FROM AUTHOR]

A wireless network's increased demand for mobility means that 5G and later wireless networks must anticipate traffic demand in order to prevent disruptions. The network usage is high in day time in the city areas at that same time, the usage of the network is very low in rural regions. At night the network usage in city areas gradually decreases and gradually increases in the rural areas. When the demand for the network increases, the network traffic also increases. An effective time demand network traffic estimate technique based on deep learning is created to address such problems. The original data are gathered, then preprocessed using two strategies such as gaussian weighted average filter and min–max normalization. A sufficient range of raw data is converted using min–max normalization, and a gaussian weighted average filter is used to transform overall data from low to high quality. After that, use agglomerative clustering to split every base station into a number of groups. Using discrete wavelet transform, separate the traffic data into its high and low frequency constituents. Finally, a modified Deep Belief Network is employed to predict the network traffic. The horse herd optimization is utilized for training the neural network and optimizing the classifier's weight. According to the simulation research, the proposed strategy can achieve 97 % accuracy with a 0.03 % Error. As a result, the proposed approach performs better than other existing techniques. Thus, the designed model predicted network traffic effective manner. [ABSTRACT FROM AUTHOR]

Artificial intelligence-assisted security is an important field of research in relation to information security. One of the most important tasks is to distinguish between normal and abnormal network traffic (such as malicious or sudden traffic). Traffic data are usually extremely unbalanced, and this seriously hinders the detection of outliers. Therefore, the identification of outliers in unbalanced datasets has become a key issue. To help solve this challenge, there is increasing interest in focusing on one-class classification methods that train models based on the samples of a single given class. In this paper, long short-term memory (LSTM) is introduced into one-class classification, and one-class LSTM (OC-LSTM) is proposed based on the traditional one-class support vector machine (OC-SVM). In contrast with other hybrid deep learning methods based on auto-encoders, the proposed method is an end-to-end training network that uses a loss function such as the OC-SVM optimization objective for model training. A comprehensive experiment on three large complex network traffic datasets showed that this method is superior to the traditional shallow method and the most advanced deep method. Furthermore, the proposed method can provide an effective reference for anomaly detection research in the field of network security, especially for the application of one-class classification. [ABSTRACT FROM AUTHOR]

Nowadays, early detecting and warning Advanced Persistent Threat (APT) attacks is a major challenge for intrusion monitoring and prevention systems. Current studies and proposals for APT attack detection often focus on combining machine-learning techniques and APT malware behavior analysis techniques based on network traffic. To improve the efficiency of APT attack detection, this paper proposes a new approach based on a combination of deep learning networks and ATTENTION networks. The proposed process for APT attack detection in this study is as follows: Firstly, all data of network traffic is pre-processed, and analyzed by the CNN-LSTM deep learning network, which is a combination of Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM). Then, instead of being used directly for classification, this data is analyzed and evaluated by the ATTENTION network. Finally, the output data of the ATTENTION network is classified to identify APT attacks. The optimization proposal for detecting APT attacks in this study is a novel proposal. It hasn't been proposed and applied by any research. Some scenarios for comparing and evaluating the method proposed in this study with other approaches (implemented in section 4.4) show the superior effectiveness of our proposed approach. The results prove that the proposed method not only has scientific significance but also has practical significance because the model combining deep learning with ATTENTION network has helped improve the efficiency of analyzing and detecting APT malware based on network traffic. [ABSTRACT FROM AUTHOR]

Spy cameras planted in various private places, such as motels, hotels, homestays (i.e., Airbnb), and restrooms, have raised immense privacy concerns. Wi-Fi spy cameras are used extensively by various adversaries because of easy installability, followed by size reduction. To prevent invasions of privacy, most studies have detected wireless cameras based on video traffic analysis and require additional synchronous data from external sensors or stimulus hardware to confirm the user’s motion. Such supplements make the users uncomfortable, requiring extra effort and time for setting. This paper proposes an effective spy camera detection system called DeepDeSpy to detect the recording of a spy camera with no effort from the user. The core idea is using the channel state information (CSI) and the network traffic from the camera to detect whether the wireless camera records the movements of the user. The CSI signal is prone to motion, and detecting motion from an enormous amount of CSI data in real-time is challenging. This was handled by leveraging the convolutional neural network (CNN) and bidirectional long short-term memory (BiLSTM) deep learning methods. Such synergistic CNN and BiLSTM deep learning models enable instant and accurate detection by automatically extracting meaningful features from the sequential raw CSI data. The feasibility of DeepDeSpy was verified by implementing it on both a PC and a smartphone and evaluating it in real-life scenarios (e.g., various room sizes and user physical activities). The average accuracy achieved in different real-life settings was approximately 96%, reaching 98.9% with intensive physical activity in the large-size room. Moreover, the ability to achieve instant detection on a smartphone within only a one-second response time makes it workable for real-time applications.

Some of the problems of extant cyberattack prediction approaches are low prediction accuracy, high false positive rate, very long training time, and the choice of hyperparameters to overcome overfitting or under fitting the model on the training data. These problems have culminated in the escalation of cyberattacks in recent times and as such significant improvement to the performance of extant models is crucial. Some deep learning architectures such as Recurrent Neural Networks (RNN) have been applied to cyberattack prediction. However, Recurrent Neural Networks (RNN) suffer from the vanishing and exploding gradient problem, and are difficult to train. Also, determining the different states and hyperparameters of the network for optimal prediction performance is difficult. Therefore, this paper proposes a novel approach called AdacDeep that uses an Enhanced Genetic Algorithm (EGA), Deep Autoencoder and a Deep Feedforward Neural Network (DFFNN) with backpropagation learning to accurately predict different attack types. The performance of AdacDeep is evaluated using two well-known datasets, namely, the CICIDS2017 and UNSW_NB15 datasets as the benchmark. The experimental results show that AdacDeep outperforms other state-of-the-art comparative models in terms of prediction accuracy with 0.22–35% improvement, F-Score with 0.1–34.7% improvement and very low false positive rate. [ABSTRACT FROM AUTHOR]

Currently, most organizations have a defense system to protect their digital communication network against cyberattacks. However, these defense systems deal with all network traffic regardless if it is from profit or non-profit websites. This leads to enforcing more security policies, which negatively affects network speed. Since most dangerous cyberattacks are aimed at commercial websites, because they contain more critical data such as credit card numbers, it is better to set up the defense system priorities towards actual attacks that come from profit websites. This study evaluated the effect of textual website metrics in determining the type of website as profit or nonprofit for security purposes. Classifiers were built to predict the type of website as profit or non-profit by applying machine learning techniques on a dataset. The corpus used for this research included profit and non-profit websites. Both traditional and deep machine learning techniques were applied. The results showed that J48 performed best in terms of accuracy according to its outcomes in all cases. The newly built models can be a significant tool for defense systems of organizations, as they will help them to implement the necessary security policies associated with attacks that come from both profit and non-profit websites. This will have a positive impact on the security and efficiency of the network. [ABSTRACT FROM AUTHOR]

Intrusion detection can identify unknown attacks from network traffics and has been an effective means of network security. Nowadays, existing methods for network anomaly detection are usually based on traditional machine learning models, such as KNN, SVM, etc. Although these methods can obtain some outstanding features, they get a relatively low accuracy and rely heavily on manual design of traffic features, which has been obsolete in the age of big data. To solve the problems of low accuracy and feature engineering in intrusion detection, a traffic anomaly detection model BAT is proposed. The BAT model combines BLSTM (Bidirectional Long Short-term memory) and attention mechanism. Attention mechanism is used to screen the network flow vector composed of packet vectors generated by the BLSTM model, which can obtain the key features for network traffic classification. In addition, we adopt multiple convolutional layers to capture the local features of traffic data. As multiple convolutional layers are used to process data samples, we refer BAT model as BAT-MC. The softmax classifier is used for network traffic classification. The proposed end-to-end model does not use any feature engineering skills and can automatically learn the key features of the hierarchy. It can well describe the network traffic behavior and improve the ability of anomaly detection effectively. We test our model on a public benchmark dataset, and the experimental results demonstrate our model has better performance than other comparison methods.

Because of the characteristic of openness and flexibility, Android has become the most popular mobile platform. However, it has also become the most targeted system by mobile malware. It is necessary for the users to have a fast and reliable detection method. In this paper, a two-layer method is proposed to detect malware in Android APPs. The first layer is permission, intent and component information based static malware detection model. It combines the static features with fully connected neural network to detect the malware and test its effectiveness through experiment, the detection rate of the first layer is 95.22%. Then the result (benign APPs from the first layer) is input into the second layer. In the second layer, a new method CACNN which cascades CNN and AutoEncoder, is used to detect malware through network traffic features of APPs. The detection rate of the second layer is 99.3% in binary classification (2-classifier). Moreover, the new two-layer model can also detect malware by its category (4-classifier) and malicious family (40-classifier). The detection rates are 98.2% and 71.48% respectively. The experimental results show that our two-layer method not only can achieve semi-supervise learning, but also can effectively improve the detection rate of malicious Android APPs.

Advanced persistent threat (APT) attack is a malicious attack type which has intentional and clear targets. This attack technique has become a challenge for information security systems of organizations, governments, and businesses. The approaches of using machine learning or deep learning algorithms to analyze signs and abnormal behaviors of network traffic for detecting and preventing APT attacks have become popular in recent years. However, the APT attack detection approach that uses behavior analysis and evaluation techniques is facing many difficulties due to the lack of typical data of attack campaigns. To handle this situation, recent studies have selected and extracted the APT attack behaviors which based on datasets are built from experimental tools. Consequently, these properties are few and difficult to obtain in practical monitoring systems. Therefore, although the experimental results show good detection, it does not bring high efficiency in practice. For above reasons, in this paper, a new method based on network traffic analysis using a combined deep learning model to detect APT attacks will be proposed. Specifically, individual deep learning networks such as multilayer perceptron (MLP), convolutional neural network (CNN), and long short-term memory (LSTM) will also be sought, built and linked into combined deep learning networks to analyze and detect signs of APT attacks in network traffic. To detect APT attack signals, the combined deep learning models are performed in two main stages including (i) extracting IP features based on flow: In this phase, we will analyze network traffic into networking flows by IP address and then use the combined deep learning models to extract IP features by network flow; (ii) classifying APT attack IPs: Based on IP features extracted in a task (i), the APT attack IPs and normal IPs will be identified and classified. The proposal of a combined deep learning model to detect APT attacks based on network traffic is a new approach, and there is no research proposed and applied yet. In the experimental section, combined deep learning models proved their superior abilities to ensure accuracy on all measurements from 93 to 98%. This is a very good result for APT attack detection based on network traffic. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is a rising infrastructure of 21st century. The classification of traffic over IoT networks is attained significance importance due to rapid growth of users and devices. It is need of the hour to isolate the normal traffic from the malicious traffic and to assign the normal traffic to the proper destination to suffice the QoS requirements of the IoT users. Detection of malicious traffic can be done by continuously monitoring traffic for suspicious links, files, connection created and received, unrecognised protocol/port numbers, and suspicious Destination/Source IP combinations. A proficient classification mechanism in IoT environment should be capable enough to classify the heavy traffic in a fast manner, to deflect the malevolent traffic on time and to transmit the benign traffic to the designated nodes for serving the needs of the users. In this work, adaboost and Xgboost machine learning algorithms and Deep Neural Networks approach are proposed to separate the IoT traffic which eventually enhances the throughput of IoT networks and reduces the congestion over IoT channels. The result of experiment indicates a deep learning algorithm achieves higher accuracy compared to machine learning algorithms. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) and cloud-based collaborative platforms have emerged as new infrastructures over the recent decades. The classification of network traffic in terms of benign and malevolent traffic is indispensable for IoT/cloud-based collaborative platforms for optimally utilizing channel capacity for transmitting benign traffic and blocking malicious traffic. The traffic-classification mechanism should be dynamic and capable enough for classifying network traffic in a quick manner so that malevolent traffic can be identified at earlier stages and benign traffic can be speedily channelized to the destined nodes. In this paper, we present a deep-learning recurrent LSTM RNet-based technique for classifying traffic over IoT/cloud platforms using the Word2Vec approach. Machine-learning techniques (MLTs) have also been employed for comparing the performance of these techniques with the proposed LSTM RNet classification method. In the proposed research work, network traffic is classified into three classes: Tor-Normal, NonTor-Normal, and NonTor-Malicious traffic. The research outcome shows that the proposed LSTM RNet accurately classifies such traffic and also helps reduce network latency as well as enhance data transmission rates and network throughput. [ABSTRACT FROM AUTHOR]

This paper presents an effective and accurate method to analyze the network traffic risk of enterprise public cloud financial system by using deep learning algorithm. To build the analytical model, the collected data is preprocessed to extract relevant features that contribute to risk analysis. The pre-processed data is used to train the deep learning model. The model is designed to learn patterns and relationships in network traffic data. The network traffic risk analysis module is constructed by combining the deep learning model with the system architecture of the enterprise public cloud financial system. Through a trained deep learning model, the module is able to accurately identify abnormal behavior in network traffic and provide corresponding risk assessments. The results show that the proposed system module can accurately identify abnormal behavior in network traffic and provide risk assessment. [ABSTRACT FROM AUTHOR]

Network data traffic is increasing with expanded networks for various applications, with text, image, audio, and video for inevitable needs. Network traffic pattern identification and analysis of traffic of data content are essential for different needs and different scenarios. Many approaches have been followed, both before and after the introduction of machine and deep learning algorithms as intelligence computation. The network traffic analysis is the process of incarcerating traffic of a network and observing it deeply to predict what the manifestation in traffic of the network is. To enhance the quality of service (QoS) of a network, it is important to estimate the network traffic and analyze its accuracy and precision, as well as the false positive and negative rates, with suitable algorithms. This proposed work is coining a new method using an enhanced deep reinforcement learning (EDRL) algorithm to improve network traffic analysis and prediction. The importance of this proposed work is to contribute towards intelligence-based network traffic prediction and solve network management issues. An experiment was carried out to check the accuracy and precision, as well as the false positive and negative parameters with EDRL. Also, convolutional neural network (CNN) machines and deep learning algorithms have been used to predict the different types of network traffic, which are labeled text-based, video-based, and unencrypted and encrypted data traffic. The EDRL algorithm has outperformed with mean Accuracy (97.20%), mean Precision (97.343%), mean false positive (2.657%) and mean false negative (2.527%) than the CNN algorithm.

In order to study the application of deep learning in the design of network traffic anomaly detection device, aiming at two common problems in the field of network anomaly detection: characteristic dependence and high false positive rate, the convolutional neural network (CNN) is combined with recurrent neural network (RNN) to propose the network anomaly detection method based on hierarchical spatiotemporal feature learning (HAST-NAD) based on deep learning. It automatically learns the traffic characteristics and improves the network traffic anomaly detection efficiency. First, the CNN is used to learn the spatial feature algorithm of data, and long-short term memory of RNN is used to learn the temporal feature algorithm of data. Then the two original data sets DARPA1998 and ISCX2012 are preprocessed. The accuracy, detection rate, and false positive rate of normal traffic and Dos, Probe, U2R, and R2L attack traffic are compared in DARPA1998 data set. The accuracy, detection rate, and false positive rate of normal traffic and Brute force SSH, DDoS, HttpDoS, and buffering attack traffic are compared in ISCX2012 data set. Finally, it is compared with other network traffic anomaly detection methods. The results show that when the network flow length is 800, the model shows good performance on the DARPA1998 data set (accuracy, detection rate and false positive rate are 98.68%, 97.78%, and 0.07%, respectively). When the network flow length is 600, the model performs better on the ISCX2012 dataset (accuracy, detection rate and false positive rate are 99.69%, 96.91%, and 0.22%, respectively). At the same time, when the packet length is 100 and the number of packets is 6, the model shows high precision, high detection rate, and low false positive rate on ISCX2012 data set. In the same data set, the temporal feature algorithm has better performance and lower false positive rate than the spatial feature algorithm. Compared with other network traffic anomaly detection methods, HAST-NAD has better comprehensive test results. In conclusion, the combination of CNN and RNN can better realize abnormal detection of network traffic, which has practical application and theoretical value. [ABSTRACT FROM AUTHOR]

Advanced Persistent Threat (APT) attacks are a form of malicious, intentionally and clearly targeted attack. This attack technique is growing in both the number of recorded attacks and the extent of its dangers to organizations, businesses and governments. Therefore, the task of detecting and warning APT attacks in the real system is very necessary today. One of the most effective approaches to APT attack detection is to apply machine learning or deep learning to analyze network traffic. There have been a number of studies and recommendations to analyze network traffic into network flows and then combine with some classification or clustering methods to look for signs of APT attacks. In particular, recent studies often apply machine learning algorithms to spot the present of APT attacks based on network flow. In this paper, a new method based on deep learning to detect APT attacks using network flow is proposed. Accordingly, in our research, network traffic is analyzed into IP-based network flows, then the IP information is reconstructed from flow, and finally deep learning models are used to extract features for detecting APT attack IPs from other IPs. Additionally, a combined deep learning model using Bidirectional Long Short-Term Memory (BiLSTM) and Graph Convolutional Networks (GCN) is introduced. The new detection model is evaluated and compared with some traditional machine learning models, i.e. Multi-layer perceptron (MLP) and single GCN models, in the experiments. Experimental results show that BiLSTM-GCN model has the best performance in all evaluation scores. This not only shows that deep learning application on flow network analysis to detect APT attacks is a good decision but also suggests a new direction for network intrusion detection techniques based on deep learning. [ABSTRACT FROM AUTHOR]

Traditional network traffic analysis methods fall short in addressing the requirements of complex network environments. Therefore, the introduction of advanced technologies, such as deep learning, is necessary to enhance the accuracy and efficiency of network traffic analysis. This paper designs a risk analysis method of enterprise cloud financial system network traffic based on deep learning to improve the level and effect of network security assurance. A deep learning based traffic analysis framework has been constructed, which includes several main steps such as data preprocessing, feature extraction, model training, and result evaluation. The test results on the experimental data set show that this method can identify network attacks and abnormal traffic more quickly and accurately than the traditional network traffic analysis methods, and has better practicability and application prospects. [ABSTRACT FROM AUTHOR]

The recent development of smart devices has lead to an explosion in data generation and heterogeneity. Hence, current networks should evolve to become more intelligent, efficient, and most importantly, scalable in order to deal with the evolution of network traffic. In recent years, network softwarization has drawn significant attention from both industry and academia, as it is essential for the flexible control of networks. At the same time, machine learning (ML) and especially deep learning (DL) methods have also been deployed to solve complex problems without explicit programming. These methods can model and learn network traffic behavior using training data/environments. The research community has advocated the application of ML/DL in softwarized environments for network traffic management, including traffic classification, prediction, and anomaly detection. In this paper, we survey the state of the art on these topics. We start by presenting a comprehensive background beginning from conventional ML algorithms and DL and follow this with a focus on different dimensionality reduction techniques. Afterward, we present the study of ML/DL applications in sofwarized environments. Finally, we highlight the issues and challenges that should be considered. [ABSTRACT FROM AUTHOR]

User activity analysis (UAA) is a promising technology for network management and network security via network traffic. Recently, deep learning (DL) has been applied into network traffic analysis for outstanding performance. These previously proposed network traffic analysis methods generally requires huge amounts of data from network users. In detail, the common methods are to collect these traffic data collected from users into cloud server for processing and analysis, which generally have great performance and are denoted as centralized methods. However, one of the biggest drawbacks of these methods is the risk of data privacy disclosure. Thus, we proposed a federated learning-based UAA method (which is named as FedeUAA) for reducing the risk of data leakage in mobile wireless networks. FedeUAA method has no requirement to upload data to cloud server, while it directly trains the DL models in local devices, and only needs to upload the knowledge (model weight or model gradient) rather than data. Simulation results demonstrated that the FedeUAA method can effectively reduce the risk of data privacy disclosure with slight performance loss. [ABSTRACT FROM AUTHOR]

Information and communication technologies have essential impacts on people's life. The real time convenience of the internet greatly facilitates the information transmission and knowledge exchange of users. However, network intruders utilize some communication holes to complete malicious attacks. Some traditional machine learning (ML) methods based on business features and deep learning (DL) methods extracting features automatically are used to identify these malicious behaviors. However, these approaches tend to use only one type of data source, which can result in the loss of some features that can not be mined in the data. In order to address this problem and to improve the precision of malicious behavior detection, this paper proposed a one-dimensional (1D) convolution-based fusion model of packet capture files and business feature data for malicious network behavior detection. Fusion models improve the malicious behavior detection results compared with single ones in some available network traffic and Internet of things (IOT) datasets. The experiments also indicate that early data fusion, feature fusion and decision fusion are all effective in the model. Moreover, this paper also discusses the adaptability of one-dimensional convolution and two-dimensional (2D) convolution to network traffic data. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) devices in Smart Home Network (SHN) are highly vulnerable to complex botnet attacks. In this paper, we investigate the effectiveness of Recurrent Neural Network (RNN) to correctly classify network traffic samples in the minority classes of highly imbalanced network traffic data. Multiple layers of RNN are stacked to learn the hierarchical representations of highly imbalanced network traffic data with different levels of abstraction. We evaluate the performance of Stacked RNN (SRNN) model with Bot-IoT dataset. Results show that SRNN outperformed RNN in all classification scenarios. Specifically, SRNN model learned the discriminating features of highly imbalanced network traffic samples in the training set with better representations than RNN model. Also, SRNN model is more robust and it demonstrated better capability to effectively handle over-fitting problem than RNN model. Furthermore, SRNN model achieved better generalization ability in detecting network traffic samples of the minority classes. [Display omitted] • Multiple RNN are stacked to detect botnet attacks in smart homes. • Performance of RNN and SRNN is evaluated with Bot-IoT dataset. • Binary and multi-class classification scenarios are considered. • SRNN outperformed RNN and state-of-the-art models in all scenarios. [ABSTRACT FROM AUTHOR]

• Small samples from DDoS data set are used to obtain fast and effective results. • Model with feature extraction and classification is chosen to better accuracy. • DDoS attacks in network are detected and classified using deep neural network. • Performance of proposed models is evaluated on current DDoS attacks dataset. As a result of the increase in the services provided over the internet, it is seen that the network infrastructure is more exposed to cyber attacks. The most widely used of these attacks are Distributed Denial of Service (DDoS) attacks that easily disrupt services. The most important factor in the fight against DDoS attacks is the early detection and separation of network traffic. In this study, it is suggested to use the deep neural network (DNN) as a deep learning model that detects DDoS attacks on the sample of packets captured from network traffic. DNN model can work quickly and with high accuracy even in small samples because it contains feature extraction and classification processes in its structure and has layers that update itself as it is trained. As a result of the experiments carried out on the CICDDoS2019 dataset containing the current DDoS attack types created in 2019, it was observed that the attacks on network traffic were detected with 99.99% success and the attack types were classified with an accuracy rate of 94.57%. The high accuracy values obtained show that the deep learning model can be used effectively in combating DDoS attacks. [ABSTRACT FROM AUTHOR]

Cyber attackers exploit a network of compromised computing devices, known as a botnet, to attack Internet-of-Things (IoT) networks. Recent research works have recommended the use of Deep Recurrent Neural Network (DRNN) for botnet attack detection in IoT networks. However, for high feature dimensionality in the training data, high network bandwidth and a large memory space will be needed to transmit and store the data, respectively in IoT back-end server or cloud platform for Deep Learning (DL). Furthermore, given highly imbalanced network traffic data, the DRNN model produces low classification performance in minority classes. In this paper, we exploit the joint advantages of Long Short-Term Memory Autoencoder (LAE), Synthetic Minority Oversampling Technique (SMOTE), and DRNN to develop a memory-efficient DL method, named LS-DRNN. The effectiveness of this method is evaluated with the Bot-IoT dataset. Results show that the LAE method reduced the dimensionality of network traffic features in the training set from 37 to 10, and this consequently reduced the memory space required for data storage by 86.49 % . SMOTE method helped the LS-DRNN model to achieve high classification performance in minority classes, and the overall detection rate increased by 10.94 % . Furthermore, the LS-DRNN model outperformed state-of-the-art models. [ABSTRACT FROM AUTHOR]