Search

Summary: Malware is a constant threat to the safety of the public Internet and private networks. It also affects the security of endpoint devices. An infected endpoint device can take part in aggressive or slow distributed denial of service attacks globally. Polymorphic malware has rendered traditional signature‐based detection ineffective. Hence the efforts to identify malware have been focused on behavioral modeling to identify and classify malware. This behavioral identification paved the way for artificial intelligence (AI) in cybersecurity. AI can detect a zero‐day attack and malware, but it suffers from several false positives. This article presents an extensive analysis of traditional and AI‐based methods for malware detection and related challenges. AI is vulnerable to attacks, such as dataset poisoning and adversarial data input, which can reduce model accuracy and increase false negatives. AI has helped to improve malware detection and reduce manual work through automation of feature extraction and feature selection. It is also beneficial to create models that are less prone to malware variations and capture the malicious behavior holistically. This article explores the transition of malware detection from traditional to AI‐based techniques. Furthermore, it also explains how some conventional approaches are still relevant today in terms of detection speed. [ABSTRACT FROM AUTHOR]

Summary: As time is progressing, the number and the complexity of methods adopted for launching distributed denial of service (DDoS) attacks are changing. Therefore, we propose a methodology for the development of a generalized machine learning (ML)‐based model for the detection of DDoS attacks. After exploring various attributes of the dataset chosen for this study, we propose an integrated feature selection (IFS) method which consists of three stages and integration of two different methods, that is, filter and embedded methods to select features which highly contribute to the detection of various types of DDoS attacks. We use light gradient boosting machine (LGBM) algorithm for training of the model for classification of benign and malicious flows. For ensuring satisfactory performance and generalized behavior of the developed model, we test it by passing records of unseen DDoS attack types. Several performance metrics are employed for the evaluation of the model. By comparing the performance of developed model against state‐of‐the‐art models, we state an improvement of around 20% for almost all the reported metrics. We also show that the performance of the model improves if feature space is reduced by 77%. Furthermore, the generalized behavior of the developed model is justified by demonstrating a trade‐off between high variance and high bias ML models. [ABSTRACT FROM AUTHOR]

Summary: The problem of distributed denial‐of‐service (DDoS) attack detection remains challenging due to new and innovative methods developed by attackers to evade the deployed security systems. In this work, we devise an unsupervised machine learning (ML)‐based approach for the detection of different types of DDoS attacks by augmenting the performance of K‐means clustering algorithm with the aid of a hybrid method for feature selection and extraction. By sequentially combining an integrated feature selection (IFS) algorithm and a deep autoencoder (DAE), we develop the hybrid method for extracting encoded features, which can better separate the clusters of benign and malicious network flows. We formulate the problem of DDoS attack detection as a binary clustering of network flows. Although K‐means clustering is the simplest and widely used algorithm, we investigate its performance for DDoS attack detection before and after applying the proposed hybrid method for feature selection and extraction. Our results show that after employing the proposed hybrid method, the performance of K‐means clustering model improves, and it is comparable to the state‐of‐the‐art supervised ML and deep learning (DL)‐based methods developed for DDoS attack detection. [ABSTRACT FROM AUTHOR]

• TWDM PON wavelengths serving Commercial and Domestic users may have asymmetric traffic load, leading to inefficient utilization of overall bandwidth, thus, degrade upstream link performance. • A machine learning based DWBA scheme is presented that can automatically balance the traffic load on all the wavelengths by an Inter-Wavelength migration of ONUs. • The simulation results show that LB-DWBA scheme successfully reduces the traffic load of highly loaded wavelengths without overloading the lightly loaded wavelengths. The time and wavelength division passive optical network (TWDM PON) provides broadband services to residential, commercial and industrial users at four different wavelengths. Typically, the industrial users are active in day time and inactive in evening while the residential customers are expected to have quite opposite behavior. This disparity will create an imbalance of traffic load on the wavelengths of TWDM PON. Like IEEE PONs, a load proportional wavelength activation approach cannot work for ITU compliant PONs as ITU standard requires all the wavelengths to be active simultaneously. Moreover, the ONUs cannot be assigned bandwidth on two different wavelengths simultaneously and the migration of an ONU from one wavelength to another causes a tuning delay due to a handshaking mechanism between the OLT and the ONU. Therefore, this work proposes an efficient load balancing dynamic wavelength and bandwidth assignment (LB-DWBA) scheme for TWDM PON to maintain a balanced load between the heavily loaded and least loaded ONUs using a regression based machine learning approach. Simulation results show that LB-DWBA scheme not only reduces the traffic load of heavily loaded wavelengths but also minimizes the bandwidth waste from the excess assigned bandwidth assigned to ONUs using type-5 (T5) traffic class. Overall, the LB-DWBA scheme reduces the average upstream delays of type-2 (T2), type-3 (T3) and type-4 (T4) by 18.9%, 24% and 43% respectively. [ABSTRACT FROM AUTHOR]