Search

This article is a continuation of a number of works devoted to evaluation of probabilistic-temporal characteristics of firewalls when ranging a filtration rule set. This work considers a problem of the decrease in the information flow filtering efficiency. The problem emerged due to the use of a sequential scheme for checking the compliance of packets with the rules, as well as due to heterogeneity and variability of network traffic. The order of rules is non-optimal, and this, in the high-dimensional list, significantly influences the firewall performance and also may cause a considerable time delay and variation in values of packet service time, which is essentially important for the stable functioning of multimedia protocols. One of the ways to prevent decrease in the performance is to range a rule set according to the characteristics of the incoming information flows. In this work, the problems to be solved are: determination and analysis of an average filtering time for the traffic of main transmitting networks; and assessing the effectiveness of ranging the rules. A method for ranging a filtration rule set is proposed, and a queuing system with a complex request service discipline is built. A certain order is used to describe how requests are processed in the system. This order includes the execution of operations with incoming packets and the logical structure of filtration rule set. These are the elements of information flow processing in the firewall. Such level of detailing is not complete, but it is sufficient for creating a model. The QS characteristics are obtained with the help of simulation modelling methods in the Simulink environment of the matrix computing system MATLAB. Based on the analysis of the results obtained, we made conclusions about the possibility of increasing the firewall performance by ranging the filtration rules for those traffic scripts that are close to real ones.

Modern world has become prune to technology and security is turning invasive by the day. Thus, capturing personal information or access to remote devices can prove to be horrendous intrusions. This paper focuses on various classification algorithms such as K-nearest neighbor Classifier, Multi Layer Perceptron Classifier, Long Short-Term Memory Classifier and Support Vector Machine Classifiers on the revised KDD cup 99 dataset. Attacks namely DoS (Denial of Service attacks), R2L (Root to Local attacks), U2R (User to Root attack) and Probe (Probing attacks) were monitored. Getting the model ready, we aim to identify the attack types based on the data coming through. The study also showcases Uni-variate, Bi-variate as well as Multivariate analysis on the same. The models were optimized and accuracy was found through measures like F1-score, precision, and recall. Promising results were found.

Network anomaly detection faces unique challenges from dynamic traffic, including large data volume, few attributes, and human factors that influence it, making it difficult to identify typical behavioral characteristics. To address this, we propose using Sketch-based Profile Evolution (SPE) to detect network traffic anomalies. Firstly, the Traffic Graph (TG) of the network terminal is generated using Sketch to identify abnormal data flow positions. Next, the Convolutional Neural Network and Long Short-Term Memory Network (CNN-LSTM) are used to develop traffic behavior profiles, which are then continuously updated using Evolution to detect behavior pattern changes in real-time data streams. SPE allows for direct processing of raw traffic datasets and continuous detection of constantly updated data streams. In experiments using real network traffic datasets, the SPE algorithm was found to be far more efficient and accurate than PCA and Basic Evolution for outlier detection. It is important to note that the value of φ can affect the results of anomaly detection.

Since one of the main reasons for improvement network lifetime is communications reduction in collecting vital signs and transmit them to the coordinator. In this paper, it is tried to reduce communications through adaption the sampling rate through individual's discovered pattern, activity prediction and watchdog biosensor. The first, the daily behavior pattern of the individual is identified, then the individual's activities are predicted; if the predicted activity exists in the individual's behavioral pattern, all the sensors are activated to read information with maximum sampling rate. Otherwise, the sensors read information with the minimum sampling rate and the watchdog biosensor is activated to sense and send the vital signs with the maximum sampling rate. The simulation results show that the proposed method improves network traffic by 80% and decreases the energy consumption of the network by four times. [ABSTRACT FROM AUTHOR]

Currently, Android apps are easily targeted by malicious network traffic because of their constant network access. These threats have the potential to steal vital information and disrupt the commerce, social system, and banking markets. In this paper, we present a malware detection system based on word2vec-based transfer learning and multi-model image representation. The proposed method combines the textual and texture features of network traffic to leverage the advantages of both types. Initially, the transfer learning method is used to extract trained vocab from network traffic. Then, the malware-to-image algorithm visualizes network bytes for visual analysis of data traffic. Next, the texture features are extracted from malware images using a combination of scale-invariant feature transforms (SIFTs) and oriented fast and rotated brief transforms (ORBs). Moreover, a convolutional neural network (CNN) is designed to extract deep features from a set of trained vocab and texture features. Finally, an ensemble model is designed to classify and detect malware based on the combination of textual and texture features. The proposed method is tested using two standard datasets, CIC-AAGM2017 and CICMalDroid 2020, which comprise a total of 10.2K malware and 3.2K benign samples. Furthermore, an explainable AI experiment is performed to interpret the proposed approach. [ABSTRACT FROM AUTHOR]

Data labeling is crucial in various areas, including network security, and a prerequisite for applying statistical-based classification and supervised learning techniques. Therefore, developing labeling methods that ensure good performance is important. We propose a human-guided auto-labeling algorithm involving the self-supervised learning concept, with the purpose of labeling data quickly, accurately, and consistently. It consists of three processes: auto-labeling, validation, and update. A labeling scheme is proposed by considering weighted features in the auto-labeling, while the generalized extreme learning machine (GELM) enabling fast training is applied to validate assigned labels. Two different approaches are considered in the update to label new data to investigate labeling speed and accuracy. We experiment to verify the suitability and accuracy of the algorithm for network traffic, applying the algorithm to five traffic datasets, some including distributed denial of service (DDoS), DoS, BruteForce, and PortScan attacks. Numerical results show the algorithm labels unlabeled datasets quickly, accurately, and consistently and the GELM's learning speed enables labeling data in real-time. It also shows that the performances between auto- and conventional labels are nearly identical on datasets containing only DDoS attacks, which implies the algorithm is quite suitable for such datasets. However, the performance differences between the two labels are not negligible on datasets, including various attacks. Several reasons that require further investigation can be considered, including the selected features and the reliability of conventional labels. Even with this limitation of the current study, the algorithm will provide a criterion for labeling data in real-time occurring in many areas. [ABSTRACT FROM AUTHOR]

Our world today relies heavily on informatics and the internet, as computers and communications networks have increased day by day. In fact, the increase is not limited to portable devices such as smartphones and tablets, but also to home appliances such as: televisions, refrigerators, and controllers. It has made them more vulnerable to electronic attacks. The denial of service (DoS) attack is one of the most common attacks that affect the provision of services and commercial sites over the internet. As a result, we decided in this paper to create a smart model that depends on the swarm algorithms to detect the attack of denial of service in internet networks, because the intelligence algorithms have flexibility, elegance and adaptation to different situations. The particle swarm algorithm and the bee colony algorithm were used to detect the packets that had been exposed to the DoS attack, and a comparison was made between the two algorithms to see which of them can accurately characterize the DoS attack. [ABSTRACT FROM AUTHOR]

In the existing approaches of multifarious knowledge based anomaly detection for network traffic, the priori knowledge labelled by human experts has to be consecutively updated for identification of new anomalies. Because anomalies usually show different patterns from the majority of network activities, it is hard to detect them based on the priori knowledge. Unsupervised anomaly detection using autonomous techniques without any priori knowledge is an effective strategy to overcome this drawback. In this paper, we propose a novel model of Unsupervised Anomaly Detection approach based on Artificial Immune Network (UADAIN) that consists of unsupervised clustering, cluster partition and anomaly detection. Our model uses the aiNet based unsupervised clustering approach to generate cluster centroids from network traffic, and the Cluster Centroids based Partition algorithm (CCP) then coarsely partition cluster centroids in the training phase as the self set (normal rules) and antibody set (anomalous rules). In test phase, to keep consecutive evolution of selves and antibodies, we introduce the Immune Network based Anomaly Detection model (INAD) to automatically learn and evolve the self set and antibody set. To evaluate the effectiveness of UADAIN, we conduct simulation experiments on ISCX 2012 IDS dataset and NSL-KDD dataset. In comparison with two popular anomaly detection approaches based on K-means clustering and aiNet-HC clustering, respectively, the experiment results demonstrate that UADAIN achieves better detection performance in detecting anomalies of network traffic. [ABSTRACT FROM AUTHOR]

Network management and multimedia data mining techniques have a great interest in analyzing and improving the network traffic process. In recent times, the most complex task in Software Defined Network (SDN) is security, which is based on a centralized, programmable controller. Therefore, monitoring network traffic is significant for identifying and revealing intrusion abnormalities in the SDN environment. Consequently, this paper provides an extensive analysis and investigation of the NSL-KDD dataset using five different clustering algorithms: K-means, Farthest First, Canopy, Density-based algorithm, and Exception-maximization (EM), using the Waikato Environment for Knowledge Analysis (WEKA) software to compare extensively between these five algorithms. Furthermore, this paper presents an SDN-based intrusion detection system using a deep learning (DL) model with the KDD (Knowledge Discovery in Databases) dataset. First, the utilized dataset is clustered into normal and four major attack categories via the clustering process. Then, a deep learning method is projected for building an efficient SDN-based intrusion detection system. The results provide a comprehensive analysis and a flawless reasonable study of different kinds of attacks incorporated in the KDD dataset. Similarly, the outcomes reveal that the proposed deep learning method provides efficient intrusion detection performance compared to existing techniques. For example, the proposed method achieves a detection accuracy of 94.21% for the examined dataset. [ABSTRACT FROM AUTHOR]

Network data traffic is increasing with expanded networks for various applications, with text, image, audio, and video for inevitable needs. Network traffic pattern identification and analysis of traffic of data content are essential for different needs and different scenarios. Many approaches have been followed, both before and after the introduction of machine and deep learning algorithms as intelligence computation. The network traffic analysis is the process of incarcerating traffic of a network and observing it deeply to predict what the manifestation in traffic of the network is. To enhance the quality of service (QoS) of a network, it is important to estimate the network traffic and analyze its accuracy and precision, as well as the false positive and negative rates, with suitable algorithms. This proposed work is coining a new method using an enhanced deep reinforcement learning (EDRL) algorithm to improve network traffic analysis and prediction. The importance of this proposed work is to contribute towards intelligence-based network traffic prediction and solve network management issues. An experiment was carried out to check the accuracy and precision, as well as the false positive and negative parameters with EDRL. Also, convolutional neural network (CNN) machines and deep learning algorithms have been used to predict the different types of network traffic, which are labeled text-based, video-based, and unencrypted and encrypted data traffic. The EDRL algorithm has outperformed with mean Accuracy (97.20%), mean Precision (97.343%), mean false positive (2.657%) and mean false negative (2.527%) than the CNN algorithm. [ABSTRACT FROM AUTHOR]

Cybersecurity is a common Internet of Things security challenge. The lack of security in IoT devices has led to a great number of devices being compromised, with threats from both inside and outside the IoT infrastructure. Attacks on the IoT infrastructure result in device hacking, data theft, financial loss, instability, or even physical damage to devices. This requires the development of new approaches to ensure high-security levels in IoT infrastructure. To solve this problem, we propose a new approach for IoT cyberattack detection based on machine learning algorithms. The core of the method involves network traffic analyses that IoT devices generate during communication. The proposed approach deals with the set of network traffic features that may indicate the presence of cyberattacks in the IoT infrastructure and compromised IoT devices. Based on the obtained features for each IoT device, the feature vectors are formed. To conclude the possible attack presence, machine learning algorithms were employed. We assessed the complexity and time of machine learning algorithm implementation considering multi-vector cyberattacks on IoT infrastructure. Experiments were conducted to approve the method's efficiency. The results demonstrated that the network traffic feature-based approach allows the detection of multi-vector cyberattacks with high efficiency. [ABSTRACT FROM AUTHOR]

Information and communication technologies have become the foundation of modern life due to their numerous advantages. However, their rapid introduction with an insufficient emphasis on security and protection unnecessarily exposes them to potential risks. In the paper, we focus on cybersecurity from the perspective of the growing amount of threats in modern networks. We describe the concept, operation, and purpose of a network telescope, i.e., a system that records unsolicited traffic to dark Internet Protocol addresses. We present the architecture of the system developed at the Faculty of Electrical Engineering, University of Ljubljana, and analyze the data collected in more than ten years of its operation. More than 2 billion events collected from 2011 onwards, exhibit an exponential trend of growth. Only five years ago, a vast majority of incoming packets was targeting ports of popular server management services (e.g., Telnet, SSH), while today the distribution is much more long-tailed and responds quickly to emerging vulnerabilities. We examine the nature of the collected data, describe the possible use cases, and present some data visualizations. [ABSTRACT FROM AUTHOR]

This paper puts forward a network security computing platform which based on the open source big data technology. This network anomaly traffic detection system includes a comprehensive and effective traffic anomaly detection algorithm. The algorithm combines the exponentially weighted moving average algorithm (EWMA) and the anomaly flow interval mapping algorithm two methods. The test experiments contain the physical cluster building parameters, the performance of the system and the DDoS attack verification. It is verified by the Tianjin Education metropolitan area network traffic and the NSFOCUS against denial attack event log service system (NSFOCUS ANTI-DDoS system). In Particular, the network anomaly traffic detection system can accurately identify the occurrence period of anomaly traffic such as the flow direction and the event priority. What' more, it has strong fault tolerance which can achieve error recovery in a short time. All the test experiment results can verify that the system can effectively detect anomaly traffic and real-time monitor the dynamic network. [ABSTRACT FROM AUTHOR]

APT (Advanced Persistent Threat) attack is a dangerous, targeted attack form with clear targets. APT attack campaigns have huge consequences. Therefore, the problem of researching and developing the APT attack detection solution is very urgent and necessary nowadays. On the other hand, no matter how advanced the APT attack, it has clear processes and lifecycles. Taking advantage of this point, security experts recommend that could develop APT attack detection solutions for each of their life cycles and processes. In APT attacks, hackers often use phishing techniques to perform attacks and steal data. If this attack and phishing phase is detected, the entire APT attack campaign will crash. Therefore, it is necessary to research and deploy technology and solutions that could detect early the APT attack when it is in the stages of attacking and stealing data. This paper proposes an APT attack detection framework based on the Network traffic analysis technique using open-source tools and deep learning models. This research focuses on analyzing Network traffic into different components, then finds ways to extract abnormal behaviors on those components, and finally uses deep learning algorithms to classify Network traffic based on the extracted abnormal behaviors. The abnormal behavior analysis process is presented in detail in section 3.1 of the paper. The APT attack detection method based on Network traffic is presented in section 3.2 of this paper. Finally, the experimental process of the proposal is performed in section 4 of the paper. [ABSTRACT FROM AUTHOR]

In Computer network, many applications should be work online, these applications have been discussed in the application layer of the OSI Reference Model, the need for a high-performance network varies according to the applications used in those networks depending on the files that are transmitted through this application, for example, in the e-mail application, most of the transmitted files are a text file and this is a small file that does not need a high-performance network to move through. On the other hand, on the contrary, there is the voice application (VoIP), which needs a high-speed network to transmit it and without audio interruption, because the voice also application needs a high-performance network, unlike what is in the e-mail application. [ABSTRACT FROM AUTHOR]

Intelligent transportation systems (ITS) are a collection of technologies that can enhance transport networks and public transit and individual decision-making about various elements of travel. ITS technologies comprise cutting-edge wireless, electronic and automated technology intending to improve safety, efficiency and convenience in surface transit. In certain cases, reducing energy usage has proven to be an ITS advantage. In this report, the primary energy advantages of a range of ITS systems established through models, pilot projects/field tests and extensive use are examined and summarized. In worldwide driving, the Internet of Things (IoT) solutions play a vital role. A new age of communication leading to ITS will be the communication between cars via IoT. IoT is a mixture of data and data analysis data storage and processing to manage the traffic system efficiently. Energy management, which is seen as an efficient, innovative approach to highly efficient energy generation plants. It simultaneously takes care of optimizing traditional sources of the IoT based intelligent transport system, helps to automate railways, roads, airways and shipways, which improve customer experience in the process. Following an evaluation of the situation, a proposal named energy management in intelligent transportation (EMIT) improves energy efficiency and economic efficiency in transportation. It improves energy management to reduce economic and ecological waste by decreasing global transport energy consumption. The sustainable development ratio is 85.7%, accidents detection ratio is 85.3%, electric vehicle infrastructure ratio is 83.6%, intelligent vehicle parking system acceptance ratio is 82.15%, and reduction ratio of energy consumption is 91.4%. [ABSTRACT FROM AUTHOR]

Recent development in smart devices has lead us to an explosion in data generation and heterogeneity, which requires new network solutions for better analyzing and understanding traffic. These solutions should be intelligent and scalable in order to handle the huge amount of data automatically. With the progress of high-performance computing (HPC), it becomes feasible easily to deploy machine learning (ML) to solve complex problems and its efficiency has been validated in several domains (e.g., healthcare or computer vision). At the same time, network slicing (NS) has drawn significant attention from both industry and academia as it is essential to address the diversity of service requirements. Therefore, the adoption of ML within NS management is an interesting issue. In this paper, we have focused on analyzing network data with the objective of defining network slices according to traffic flow behaviors. For dimensionality reduction, the feature selection has been applied to select the most relevant features (15 out of 87 features) from a real dataset of more than 3 million instances. Then, a K-means clustering is applied to better understand and distinguish behaviors of traffic. The results demonstrated a good correlation among instances in the same cluster generated by the unsupervised learning. This solution can be further integrated in a real environment using network function virtualization. [ABSTRACT FROM AUTHOR]

Abstract Computer networks target several kinds of attacks every hour and day; they evolved to make significant risks. They pass new attacks and trends; these attacks target every open port available on the network. Several tools are designed for this purpose, such as mapping networks and vulnerabilities scanning. Recently, machine learning (ML) is a widespread technique offered to feed the Intrusion Detection System (IDS) to detect malicious network traffic. The core of ML models’ detection efficiency relies on the dataset’s quality to train the model. This research proposes a detection framework with an ML model for feeding IDS to detect network traffic anomalies. This detection model uses a dataset constructed from malicious and normal traffic. This research’s significant challenges are the extracted features used to train the ML model about various attacks to distinguish whether it is an anomaly or regular traffic. The dataset ISOT-CID network traffic part uses for the training ML model. We added some significant column features, and we approved that feature supports the ML model in the training phase. The ISOT-CID dataset traffic part contains two types of features, the first extracted from network traffic flow, and the others computed in specific interval time. We also presented a novel column feature added to the dataset and approved that it increases the detection quality. This feature is depending on the rambling packet payload length in the traffic flow. Our presented results and experiment produced by this research are significant and encourage other researchers and us to expand the work as future work.

The TCP protocol is a connection-oriented and reliable transport layer communication protocol which is widely used in network communication. With the rapid development and popular application of data center networks, high-throughput, low-latency, and multi-session network data processing has become an immediate need for network devices. If only a traditional software protocol stack is used for processing, it will occupy a large amount of CPU resources and affect network performance. To address the above issues, this paper proposes a double-queue storage structure for a 10G TCP/IP hardware offload engine based on FPGA. Furthermore, a TOE reception transmission delay theoretical analysis model for interaction with the application layer is proposed, so that the TOE can dynamically select the transmission channel based on the interaction results. After board-level verification, the TOE supports 1024 TCP sessions with a reception rate of 9.5 Gbps and a minimum transmission latency of 600 ns. When the TCP packet payload length is 1024 bytes, the latency performance of TOE’s double-queue storage structure improves by at least 55.3% compared to other hardware implementation approaches. When compared with software implementation approaches, the latency performance of TOE is only 3.2% of the software approaches.

A botnet is a group of hijacked devices that conduct various cyberattacks, which is one of the most dangerous threats on the internet. Individuals or organizations can effectively detect botnets by analyzing abnormal behaviors in network traffic. Existing works focus on extracting the deterministic behavioral features, which highly rely on statistical features and existing botnet interaction structures, resulting in unsatisfactory detection accuracy, especially for unknown botnet traffic. The botnet detection method based on the original traffic bytes has more advantages in this regard, especially the use of mining payload information in the traffic to enhance the identification of abnormal botnet behavior is the focus of this study. In this paper, we propose a dual-mode botnet detection scheme, which takes the original traffic bytes as the object, one is to encode the implicit semantic relationship between the traffic bytes through a multi-layer Transformer encoder, and the other is the network traffic Image representation, the spatial relationship of traffic bytes is captured by a deep neural network, and then botnet detection is achieved by maximizing the mutual information between the two. We conduct comprehensive experiments with both known botnets and unknown botnets to evaluate our scheme. Experimental results show that for known botnets, our approach achieves 99.84% and 91.92% detection accuracy with CTU-13 and ISCX-2014 datasets, respectively, which is 3.04% and 2.54% more accurate compared with the state-of-art (DL). For unknown datasets, our scheme is 10.19% more accurate than the existing traffic representation. • We extract the implicit semantic relationship of raw traffic for botnet detection. • We propose a dual-modal botnet detection method (Bot-DM) based on raw traffic. • We conduct extensive experiments to validate the superiority of the proposed methods. • We compare the detection performance of unknown botnets in different traffic modes. [ABSTRACT FROM AUTHOR]

A wireless network's increased demand for mobility means that 5G and later wireless networks must anticipate traffic demand in order to prevent disruptions. The network usage is high in day time in the city areas at that same time, the usage of the network is very low in rural regions. At night the network usage in city areas gradually decreases and gradually increases in the rural areas. When the demand for the network increases, the network traffic also increases. An effective time demand network traffic estimate technique based on deep learning is created to address such problems. The original data are gathered, then preprocessed using two strategies such as gaussian weighted average filter and min–max normalization. A sufficient range of raw data is converted using min–max normalization, and a gaussian weighted average filter is used to transform overall data from low to high quality. After that, use agglomerative clustering to split every base station into a number of groups. Using discrete wavelet transform, separate the traffic data into its high and low frequency constituents. Finally, a modified Deep Belief Network is employed to predict the network traffic. The horse herd optimization is utilized for training the neural network and optimizing the classifier's weight. According to the simulation research, the proposed strategy can achieve 97 % accuracy with a 0.03 % Error. As a result, the proposed approach performs better than other existing techniques. Thus, the designed model predicted network traffic effective manner. [ABSTRACT FROM AUTHOR]

Artificial intelligence-assisted security is an important field of research in relation to information security. One of the most important tasks is to distinguish between normal and abnormal network traffic (such as malicious or sudden traffic). Traffic data are usually extremely unbalanced, and this seriously hinders the detection of outliers. Therefore, the identification of outliers in unbalanced datasets has become a key issue. To help solve this challenge, there is increasing interest in focusing on one-class classification methods that train models based on the samples of a single given class. In this paper, long short-term memory (LSTM) is introduced into one-class classification, and one-class LSTM (OC-LSTM) is proposed based on the traditional one-class support vector machine (OC-SVM). In contrast with other hybrid deep learning methods based on auto-encoders, the proposed method is an end-to-end training network that uses a loss function such as the OC-SVM optimization objective for model training. A comprehensive experiment on three large complex network traffic datasets showed that this method is superior to the traditional shallow method and the most advanced deep method. Furthermore, the proposed method can provide an effective reference for anomaly detection research in the field of network security, especially for the application of one-class classification. [ABSTRACT FROM AUTHOR]

Summary: Network has become an indispensable part of public life. To improve network utilization, network performance, network quality, and enhance network security, precise prediction of network traffic is an indispensable method and basis for solving the above problems. In order to accurately predict the network traffic, a novel combination prediction model for network traffic is proposed. In this model, local mean decomposition (LMD), bidirectional long short‐term memory (BiLSTM), and Bayesian optimization algorithm are combined. First, the LMD method decomposes the network traffic time series to obtain several product function (PF) components and a residual by LMD. Then, each PF component and residual is predicted with BiLSTM model. Meanwhile, the Bayesian optimization algorithm is introduced to optimize the hyperparameters of BiLSTM. Finally, the predicted value of each PF component and residual is linearly superimposed to obtain the final predicted value. Through the study of two groups of actual network traffic datasets and compared with a variety of state‐of‐the‐art prediction models, the proposed model has a preferable prediction results by comparison of the results. [ABSTRACT FROM AUTHOR]

Communication networks grow exponentially in this globalization era; thus, the network traffic modelling and prediction plays a crucial role in network management and security warning. Solely, the multi-step network traffic prediction may involve greater errors hence worsening prediction performance. To overcome this problem, an optimized echo state network model with selective error compensation is proposed. In the optimized echo state network-based multi-step prediction model, an improved fruit–fly optimization algorithm based on cloud model (named LVCMFOA) is used to select optimum values of four key parameters of the model. The proposed LVCMFOA algorithm uses the levy-flight function to redefine the generation of the fruit–fly population, which can randomly change the search radius and help getting out of a possible local optimal solution and prevent local optimum. To reduce the calculation time but improve the prediction accuracy simultaneously, a sophisticated selective error compensation strategy employing the variable sliding window technology is proposed so as to avoid the error accumulation problem in the multi-step prediction. The effectiveness of the proposed method is verified by applying it to Henon mapping chaotic series, Mackey–Glass chaotic series and two public network traffic data sets all known in the literature. [ABSTRACT FROM AUTHOR]

Android Operating system (OS) has grown into the most predominant smartphone platform due to its flexibility and open source characteristics. Because of its openness, it has become prone to numerous attackers and malware designers who are constantly trying to elicit confidential information by articulating a plethora of attacks through these designed malwares. Detection of these malwares to protect the smartphone is the core function of the smartphone security analysis. This paper proposes a novel traffic-based framework that exploits the network traffic features to detect these malwares. Here, a unified feature (UF) is created by graph-based cross-diffusion of generated order and sparse matrices corresponding to the network traffic features. Generated unified feature is then given to three classifiers to get corresponding classifier scores. The robustness of the suggested framework when evaluated on the standard datasets outperforms contemporary techniques to achieve an average accuracy of 98.74 per cent. [ABSTRACT FROM AUTHOR]

Nowadays, early detecting and warning Advanced Persistent Threat (APT) attacks is a major challenge for intrusion monitoring and prevention systems. Current studies and proposals for APT attack detection often focus on combining machine-learning techniques and APT malware behavior analysis techniques based on network traffic. To improve the efficiency of APT attack detection, this paper proposes a new approach based on a combination of deep learning networks and ATTENTION networks. The proposed process for APT attack detection in this study is as follows: Firstly, all data of network traffic is pre-processed, and analyzed by the CNN-LSTM deep learning network, which is a combination of Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM). Then, instead of being used directly for classification, this data is analyzed and evaluated by the ATTENTION network. Finally, the output data of the ATTENTION network is classified to identify APT attacks. The optimization proposal for detecting APT attacks in this study is a novel proposal. It hasn't been proposed and applied by any research. Some scenarios for comparing and evaluating the method proposed in this study with other approaches (implemented in section 4.4) show the superior effectiveness of our proposed approach. The results prove that the proposed method not only has scientific significance but also has practical significance because the model combining deep learning with ATTENTION network has helped improve the efficiency of analyzing and detecting APT malware based on network traffic. [ABSTRACT FROM AUTHOR]

In this paper, we propose a broad learning system based on the sparrow search algorithm. Firstly, in order to avoid the complicated manual parameter tuning process and obtain the best combination of hyperparameters, the sparrow search algorithm is used to optimize the shrinkage coefficient (r) and regularization coefficient (λ) in the broad learning system to improve the prediction accuracy of the model. Second, using the broad learning system to build a network interface flow forecasting model. The flow values in the time period [ T − 11 , T ] are used as the characteristic values of the traffic at the moment T + 1 . The hyperparameters outputted in the previous step are fed into the network to train the broad learning system network traffic prediction model. Finally, to verify the model performance, this paper trains the prediction model on two public network flow datasets and real traffic data of an enterprise cloud platform switch interface and compares the proposed model with the broad learning system, long short-term memory, and other methods. The experiments show that the prediction accuracy of this method is higher than other methods, and the moving average reaches 97%, 98%, and 99% on each dataset, respectively. [ABSTRACT FROM AUTHOR]

As the internet and communication areas evolve, from Wireless Sensor Networks (WSN) to the Internet of Things (IoT), network intrusions, and assaults become more common. For wireless sensor networks, this research study provides a progressive intrusion detection approach based on machine learning techniques. Wireless network traffic intrusions should be identified, studied, and removed from the network as quickly as possible. The purpose of an Intrusion Detection System (IDS) is to identify and prevent different intrusion attempts in the network and to provide users with a positive and secure connection. Machine learning and related approaches have recently evolved to identify network attacks. The major goal of the proposed study is to use network traffic to identify network intrusions in a smart and efficient manner. The proposed method for detecting network intrusion does not need any extra hardware. In order to protect the network against intrusion, the provided approach is used to guarantee the network's confidentiality and integrity. With other current approaches, the result achieves a greater detection rate. [ABSTRACT FROM AUTHOR]

It is easy for ant colony algorithm to fall into local optimum and poor accuracy in network traffic prediction. An improved ant colony optimization GPR prediction algorithm based on LMD is proposesd. Firstly,according to the complexity of network traffic,local mean decomposition(LMD) is used to decompose the network traffic into multiple related subsequences. Secondly,Gaussian process regression(GPR) is applied to model and analyze the network traffic subsequences. Ant colony algorithm is used to optimize the super parameters. Thirdly,by introducing the line of sight angle parameter to control the line of sight of ants in search,the local search ability of ants is improved. Fourthly,the step size of ant colony algorithm is updated by Levy flight to improve the global search. Experimental results show that the improved ant colony algorithm finds a better value. Compared with the original GPR algorithm,the improved ant colony optimization GPR algorithm after LMD decomposition can predict network traffic,better serve the trend of network traffic and improve the prediction effect,in a maintaining network security role. [ABSTRACT FROM AUTHOR]

Based on the analysis of the self-similarity of network traffic, a network anomaly detection technology is proposed by combining with the fuzzy logic so as to explore the fractal characteristics of network traffic. The concepts of network traffic and network security are introduced. Then, a network traffic model of network traffic is proposed based on the fractal theory and wavelet analysis. Finally, a distributed denial of service (DDoS) that attacks the monitoring and intensity judgment method is put forward based on the fuzzy logic theory. The results show that the autocorrelation function of the multifractal wavelet model constructed based on the local Hurst exponent (LHE) can reach a mean square error (MSE) of 4. 7 6 2 × 1 0 − 4 , which proves that the network traffic model proposed can reduce the impact of the non-stationary characteristics of the network traffic on the modeling accuracy. The network security detection method proposed can monitor the DDoS attacks and can accurately judge the attack intensity in real time. The research in this study provides an important reference for the scientific operation of the network. [ABSTRACT FROM AUTHOR]

The analysis of network victimization is of great significance to the prevention and control of telecom fraud.By studying the network traffic generated by the interaction between users and websites, a victimization identification model of telecom fraud crime based on network behavior flow analysis was proposed, the association rules between different behavior characteristics were analyzed, the behavior sequence features were reconstructed, and the victimization of network behavior sequence with random forest algorithm was evaluated.Based on the network behavior data set of public security organs, the experiment proves that the model can effectively improve the recognition accuracy of network behavior victimization.