Search

Summary: In the ever‐evolving realm of cloud computing, the challenge of intrusion detection has grown increasingly intricate and vital. With the proliferation of cyber‐attacks and the widespread use of virtualized environments, there is a pressing need for network security solutions that are not only innovative and robust but also easily comprehensible. These solutions must possess the ability to effectively detect malicious activities, provide visibility into network operations, adapt to changing requirements, and promptly alert stakeholders to any suspicious behavior. In this study, we introduce a groundbreaking approach known as fuzzy logic‐driven optimized long short‐term memory (LSTM)—FLOLSTM, specifically designed for hypervisor‐based environments. By integrating fuzzy logic with an optimized LSTM neural network, FLOLSTM aims to significantly enhance the detection of attack traffic within hypervisor networks by combining the interpretability and uncertainty management capabilities of fuzzy logic with the temporal pattern recognition prowess of LSTM. The research methodology involves meticulous data collection from hypervisor monitors, followed by rigorous cleaning and preprocessing to enhance data reliability. Subsequently, the preprocessed data is input into the FLOLSTM classifier to identify malicious activities. Furthermore, the performance of the LSTM is fine‐tuned using the waterwheel plant optimization (WPO) algorithm. Experimental evaluations compare the efficiency of the proposed FLOLSTM with existing techniques across various metrics including accuracy, recall, precision, F‐measure, specificity, false‐positive rate (FPR), and false‐negative rate (FNR). Overall, the FLOLSTM model represents a significant advancement in intrusion detection for cloud environments, offering a potent blend of interpretability, accuracy, and efficiency. Its superior performance underscores its capacity to enhance network security and effectively mitigate cyber threats in dynamic and virtualized settings, thereby making a substantial impact on the field of cyber security. [ABSTRACT FROM AUTHOR]

The integration of the Industrial Internet of Things (IIoT) brings about a significant improvement in the efficiency and productivity of industrial processes. The speed and accuracy of various tasks have been greatly enhanced with the utilization of IIoT which allows smoother operations and cost-effective solutions, to protect uninterrupted intrusions and avoid potential threats. This article proposes a novel recurrent federated network-based enhanced local search grasshopper (RFN-ELG) algorithm. Datasets like UNSW-NB15 and MQTT-IoT-IDS2020 datasets are employed to determine the performances of IIoT via two diverse phases, namely the data preprocessing phase as well as attack detection phase. The recurrent neural networks (RNNs) are integrated with federated learning (FL) to overcome the gradient issues during the training process. In addition to this, the hyperparameters of RNN-FL are tuned via a grasshopper optimization algorithm with a local search strategy. Accuracy, precision, recall, F1-score, and false alarm rate (FAR) are the performance metrics taken for attack detection, where accuracy attains the value of 98.1%, precision attains the value of 97.4%, recall attains the value of 96.1%, F1-score attains the value of 97.2%, and FAR attains the value of 96.1%, respectively. Therefore, the proposed RFN-ELG algorithm attains high performance in detecting the attacks in IIoT. [ABSTRACT FROM AUTHOR]

Communication networks are crucial components of the underlying digital infrastructure in any smart city setup. The increasing usage of computer networks brings additional cyber security concerns, and every organization has to implement preventive measures to protect valuable data and business processes. Due to the inherent distributed nature of the city infrastructures as well as the critical nature of its resources and data, any solution to the attack detection calls for distributed, efficient and privacy preserving solutions. In this paper, we extend the evaluation of our federated learning framework for network attacks detection and classification based on random forest. Previously the framework was evaluated only for attack detection using four well-known intrusion detection datasets (KDD, NSL-KDD, UNSW-NB15, and CIC-IDS-2017). In this paper, we extend the evaluation for attack classification. We also evaluate how adding differential privacy into random forest, as an additional protective mechanism, affects the framework performances. The results show that the framework outperforms the average performance of independent random forests on clients for both attack detection and classification. Adding differential privacy penalizes the performance of random forest, as expected, but the use of the proposed framework still brings benefits in comparison to the use of independent local models. The code used in this paper is publicly available, to enable transparency and facilitate reproducibility within the research community. [ABSTRACT FROM AUTHOR]

The tremendous use of sensitive and consequential information in the advanced web application confronts the security issues. To defend the web application while it processing the information must requires the security system. The detection of attacks of web is made by the payload or HTTP request-based detection in association with the scholars. Some of the scholars provide secured attack model detection; however, it fails to achieve the optimal detection accuracy. In concern with these issues, we propose an innovative technique for the attack detection the web applications. The proposed attack detection is based on the novel deep CapsuleNet based technique and the process begins with pre-processing steps known as decoding, generalization, tokenization/standardization and vectorization. After the pre-processing steps the information are passed to deep CapsuleNet for extracting the features for attaining the temporal dependencies from the sequential data. The subtle patterns in the information also detected using the proposed work. Simulation is effectuated to demonstrate the effectiveness of the proposed work and compared with other existing works. Our proposed system provides better accuracy in detecting the attacks than the state-of-art works. [ABSTRACT FROM AUTHOR]

This paper focuses on a detection‐based resilient control issue for cyber‐physical systems (CPSs) subject to false data injection (FDI) attacks, where FDI attacks occur in the communication channels from the sensor‐to‐controller and controller‐to‐actuator. Firstly, to reduce the adverse impacts of FDI attacks on estimation performance, an unbiased estimator is constructed by tackling the equality‐constrained optimization problem. Then, an effective attack detection mechanism is devised by introducing a pseudo‐innovation sequence to formulate the detection function, which can successfully detect two‐channel FDI attacks. Based on these detection results, a resilient controller combining linear quadratic Gaussian and H∞$$ {H}_{\infty } $$ controllers is provided to guarantee the mean‐square asymptotic stability of CPSs with H∞$$ {H}_{\infty } $$ performance. Finally, the validity of the proposed resilient control approach is demonstrated by a simulation involving satellite control system. [ABSTRACT FROM AUTHOR]

Wireless Sensor Networks (WSNs) play a vital role in various applications, necessitating robust network security to protect sensitive data. Intrusion Detection Systems (IDSs) are crucial for preserving the integrity, availability, and confidentiality of WSNs by detecting and countering potential attacks. Despite significant research efforts, the existing IDS solutions still suffer from challenges related to detection accuracy and false alarms. To address these challenges, in this paper, we propose a Bayesian optimization-based Deep Learning (DL) model. However, the proposed optimized DL model, while showing promising results in enhancing security, encounters challenges such as data dependency, computational complexity, and the potential for overfitting. In the literature, researchers have employed Reinforcement Learning (RL) to address these issues. However, it also introduces its own concerns, including exploration, reward design, and prolonged training times. Consequently, to address these challenges, this paper proposes an Innovative Integrated RL-based Advanced DL Algorithm (IRADA) for attack detection in WSNs. IRADA leverages the convergence of DL and RL models to achieve superior intrusion detection performance. The performance analysis of IRADA reveals impressive results, including accuracy (99.50%), specificity (99.94%), sensitivity (99.48%), F1-Score (98.26%), Kappa statistics (99.42%), and area under the curve (99.38%). Additionally, we analyze IRADA's robustness against adversarial attacks, ensuring its applicability in real-world security scenarios. [ABSTRACT FROM AUTHOR]

Internet of Things (IoT) is a broad network of actual, physical objects that can exchange data and communicate with other devices and systems over the Internet. Due to the scalability of the internet, the number of IoT users is increasing, and therefore it is vital to ensure the security of user info. Attacks such as DDoS (Distributed Denial of Service) and MitM (Man-in-the-Middle) can seriously interrupt operations and threaten the confidentiality and integrity of sensitive data. In this paper, a novel Iot based Security Assessment for intrusion using Deep Learning (ISAI-DL) technique has been proposed to identify IoT device vulnerabilities such as DDoS and MitM attacks. Initially, the features are extracted from the API documents using Bag of Words (BoW) and Term Frequency-Inverse Document Frequency (TF-IDF) techniques. In proposed ISAI-DL technique, it triggers or activates the vulnerabilities deep within target devices by sending API documents. The vulnerability is detected via the GloVe-CNN-BiLSTM Model; if the attack occurs in an IoT device, the output is classified as either DDoS, MitM, or normal. Evaluation metrics such as accuracy, recall, precision, time efficiency, F1 score, false alarm rate, and detection rate have been used to measure how effective the proposed ISAI-DL technique is. Based on a comparative investigation, the detection rate of the proposed ISAI-DL technique is 17.23%, 18.53%, and 3.24% greater than that of the existing P2ADF, HDA-IDS, and BT-TPF techniques respectively. [ABSTRACT FROM AUTHOR]

As the informatization of power systems advances, the secure operation of power systems faces various potential network attacks and threats. The false data injection attack (FDIA) is a common attack mode that can lead to abnormal system operations and serious economic losses by injecting abnormal data into terminal links or devices. The current research on FDIA primarily focuses on detecting its existence, but there is relatively little research on the localization of the attacks. To address this challenge, this study proposes a novel FDIA localization method (GA-CNN-LSTM) that combines convolutional neural networks (CNNs), long short-term memory (LSTM), and a genetic algorithm (GA) and can accurately locate the attacked bus or line. This method utilizes a CNN to extract local features and combines LSTM with time series information to extract global features. It integrates a CNN and LSTM to deeply explore complex patterns and dynamic changes in the data, effectively extract FDIA features in the data, and optimize the hyperparameters of the neural network using the GA to ensure an optimal performance of the model. Simulation experiments were conducted on the IEEE 14-bus and 118-bus test systems. The results indicate that the GA-CNN-LSTM method achieved F1 scores for location identification of 99.71% and 99.10%, respectively, demonstrating superior localization performance compared to other methods. [ABSTRACT FROM AUTHOR]

In this paper, we introduce a novel optimization algorithm called the OX optimizer, inspired by oxen animals, which are characterized by their great strength. The OX optimizer is designed to address the challenges posed by complex, high-dimensional optimization problems. The design of the OX optimizer embodies a fundamental symmetry between global and local search processes. This symmetry ensures a balanced and effective exploration of the solution space, highlighting the algorithm's innovative contribution to the field of optimization. The OX optimizer has been evaluated on CEC2022 and CEC2017 IEEE competition benchmark functions. The results demonstrate the OX optimizer's superior performance in terms of convergence speed and solution quality compared to existing state-of-the-art algorithms. The algorithm's robustness and adaptability to various problem landscapes highlight its potential as a powerful tool for solving diverse optimization tasks. Detailed analysis of convergence curves, search history distributions, and sensitivity heatmaps further support these findings. Furthermore, the OX optimizer has been applied to optimize support vector machines (SVMs), emphasizing parameter selection and feature optimization. We tested it on the NSL-KDD dataset to evaluate its efficacy in an intrusion detection system. The results demonstrate that the OX optimizer significantly enhances SVM performance, facilitating effective exploration of the parameter space. [ABSTRACT FROM AUTHOR]

In recent years, the Internet of Things (IoT) has grown rapidly, as has the number of attacks against it. Certain limitations of the paradigm, such as reduced processing capacity and limited main and secondary memory, make it necessary to develop new methods for detecting attacks in real time as it is difficulty to adapt as has the techniques used in other paradigms. In this paper, we propose an architecture capable of generating complex event processing (CEP) rules for real-time attack detection in an automatic and completely unsupervised manner. To this end, CEP technology, which makes it possible to analyze and correlate a large amount of data in real time and can be deployed in IoT environments, is integrated with principal component analysis (PCA), Gaussian mixture models (GMM) and the Mahalanobis distance. This architecture has been tested in two different experiments that simulate real attack scenarios in an IoT network. The results show that the rules generated achieved an F1 score of.9890 in detecting six different IoT attacks in real time. [ABSTRACT FROM AUTHOR]

Due to the digitization of data and the dynamic requirements of the users, cloud computing is one of the most used technologies in the present scenario. Cloud computing provides a platform to store, process, and share data remotely for heterogeneous users and provides services according to the requests generated by those users. However, its rapid growth has led to one of the major challenges in the environment; the security and privacy of the data. To address the security and privacy concerns, in this paper, our major contribution is a trusted computing framework namely Secure Framework using Behavior and Role Analysis (SFBRA) for cloud data security. The framework utilizes user log monitoring data, pattern recognition algorithms, and role-based access mechanisms to detect malicious and suspicious activities of different users. Our proposed framework provides two levels of security for cloud users. In Level-1, we calculate the trust value of the logged-in users by analyzing the existing log table and pattern of request access. In Level-2, we calculate the trust of the request (storage, processing, sharing) data packet using behavior analysis of the user and a role-based access mechanism and finally detect the malicious activities. The efficacy of our proposed framework is demonstrated through experimentation, where we compare our framework with existing research works. The results show 95% accuracy in potential attack detection and prevention,approximately 8 Mbps throughput, and 0.003% packet drop on average. [ABSTRACT FROM AUTHOR]

With development of blockchain technology, clouding computing and Internet of Things (IoT), blockchain and cloud of things (BCoT) has become development tendency. But the security has become the most development hinder of BCoT. Attack detection model is a crucial part of attack revelation mechanism for BCoT. As a consequence, attack detection model has received more concerned. Due to the great diversity and variation of network attacks aiming to BCoT, tradition attack detection models are not suitable for BCoT. In this paper, we propose a novel attack detection model for BCoT, denoted as cVAE-DML. The novel model is based on contrastive variational autoencoder (cVAE) and deep metric learning (DML). By training the cVAE, the proposed model generates private features for attack traffic information as well as shared features between attack traffic information and normal traffic information. Based on those generated features, the proposed model can generate representative new samples to balance the training dataset. At last, the decoder of cVAE is connected to the deep metric learning network to detect attack aiming to BCoT. The efficiency of cVAE-DML is verified using the CIC-IDS 2017 dataset and CSE-CIC-IDS 2018 dataset. The results show that cVAE-DML can improve attack detection efficiency even under the condition of unbalanced samples. [ABSTRACT FROM AUTHOR]

The field of computer networking is experiencing rapid growth, accompanied by the swift advancement of internet tools. As a result, people are becoming more aware of the importance of network security. One of the primary concerns in ensuring security is the authority over domains, and network owners are striving to establish a common language to exchange security information and respond quickly to emerging threats. Given the increasing prevalence of various types of attacks, network security has become a significant challenge in the realm of computing. To address this, a multi-level distributed approach incorporating vulnerability identification, dimensioning, and countermeasures based on attack graphs has been developed. Implementing reconfigurable virtual systems as countermeasures significantly improves attack detection and mitigates the impact of attacks. Password-based authentication, for instance, can be susceptible to password cracking techniques, social engineering attacks, or data breaches that expose user credentials. Similarly, ensuring privacy during data transmission through encryption helps protect data from unauthorized access, but it does not guarantee the prevention of other types of attacks such as malware infiltration or insider threats. This research explores various techniques to achieve effective attack detection. Multiple research methods have been utilized and evaluated to identify the most suitable approach for network security and attack detection in the context of cloud computing. The analysis and implementation of diverse research studies demonstrate that the based signature intrusion detection method outperforms others in terms of precision, recall, F-measure, accuracy, reliability, and time complexity. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is revolutionizing diverse sectors like business, healthcare, and the military, but its widespread adoption has also led to significant security challenges. IoT networks, in particular, face increasing vulnerabilities due to the rapid proliferation of connected devices within smart infrastructures. Wireless sensor networks (WSNs) comprise software, gateways, and small sensors that wirelessly transmit and receive data. WSNs consist of two types of nodes: generic nodes with sensing capabilities and gateway nodes that manage data routing. These sensor nodes operate under constraints of limited battery power, storage capacity, and processing capabilities, exposing them to various threats, including wormhole attacks. This study focuses on detecting wormhole attacks by analyzing the connectivity details of network nodes. Machine learning (ML) techniques are proposed as effective solutions to address these modern challenges in wormhole attack detection within sensor networks. The base station employs two ML models, a support vector machine (SVM) and a deep neural network (DNN), to classify traffic data and identify malicious nodes in the network. The effectiveness of these algorithms is validated using traffic generated by the NS3.37 simulator and tested against real-world scenarios. Evaluation metrics such as average recall, false positive rates, latency, end-to-end delay, response time, throughput, energy consumption, and CPU utilization are used to assess the performance of the proposed models. Results indicate that the proposed model outperforms existing methods in terms of efficacy and efficiency. [ABSTRACT FROM AUTHOR]

In reversible image authentication (RIA) methods, it is common to use a reversible hiding method to embed the authentication code (AC) bits into each block of an original image to form a watermarking image. Since the reversible hiding methods have low embedding capacity, the authentication methods based on them have limited attack detection ability. In this paper, we use a dual-image reversible embedding method based on the central folding strategy with some slight improvements to construct an RIA method. Due to the large embedding capacity, low image distortion, no location map to be used, and AC bits generated by using hash function MD5 on block's features, the proposed image authentication method can detect any type of attack with higher accuracy compared to existing methods. Its attack detection ability reaches 100 % for block sizes of 4 × 4 , 3 × 3 , and 99.91 % for a block size of 2 × 2 while maintaining high image quality. [ABSTRACT FROM AUTHOR]

Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network. [ABSTRACT FROM AUTHOR]

This study addresses the critical need for securing corporate networks against anomalies, a pressing concern in ensuring the comprehensive security of these networks. It aims to develop and validate a new machine learning-based methodology for anomaly detection that is adaptable across various corporate network environments, highlighting the method’s potential practical applications. Employing a systematic approach, the research integrates system analysis of anomaly detection methodologies with an analytical review of machine learning techniques tailored for high-security measures and attack prevention in corporate networks. This dual approach ensures a robust framework for identifying and addressing network anomalies efficiently. The methodology demonstrated notable efficacy, with the proposed machine learning-based anomaly detection techniques achieving an efficiency rate upwards of 90% in identifying and categorizing network traffic types. This high level of precision allows for the effective tracking of network anomalies across diverse corporate networks and their respective devices and equipment. The findings underscore the substantial practical value of the developed methodology, offering a promising avenue for enhancing corporate network security. The implementation of this machine learning-based approach not only facilitates the timely detection of anomalies but also significantly contributes to the improvement of machine learning applications within the realm of network security. Future research could further refine these techniques, exploring scalability and real-time data analysis enhancements to bolster their effectiveness across various network configurations. [ABSTRACT FROM AUTHOR]

The risk of intelligent cyber-attacks is increasing as the number of endpoint devices surges and non-face-to-face services expand. As the damage caused by advanced persistent threat (APT), an advanced cyber-attack, increases, companies are researching endpoint detection and response (EDR) or endpoint protection platform. However, because conventional open source-based EDR tools rely on the administrator's preset settings, detecting or responding to APT attacks with new patterns or variant malware requires substantial effort. In this study, fast detection and proactive response (FDPR) is proposed. FDPR complements the limitations of existing single EDR tools by combining google rapid response, an open-source detection-centric tool, an open-source host-based intrusion detection system security (OSSEC), and a response-centric EDR tool. As a result of the experiment, the attack detection performance of FDPR was 97.6%, 3.55 times, and 1.2 times, respectively, compared to the conventional ruleset-based intrusion detection system (R-IDS) and the conventional deep learning-based intrusion detection system (DL-IDS). In addition, compared to R-IDS, the passive response level was improved by 5.76 times, and the active response was enhanced by 11.53%, proving the superiority of the FDPR model. [ABSTRACT FROM AUTHOR]

This paper proposes a detection method for countering strategic attacks in zero-boundary trusted networks. In a normal network, malicious nodes are only a minority; therefore, this paper employs a simple game-theoretic approach to suppress the occurrence of malicious events. Firstly, the paper introduces a behavior-based event inference method to detect malicious events, wherein nodes reference the inference results of other nodes to form composite reports. Subsequently, the paper introduces a simple game, allowing malicious nodes to choose not to falsify reports under disadvantaged scenarios, reaching a Bayesian equilibrium with normal nodes, thereby reducing the incidence of malicious events. This method demonstrates significant effectiveness in conventional networks where malicious nodes constitute a minority. [ABSTRACT FROM AUTHOR]

A revolutionary concept of Multi-controller Software-Defined Networking (MC-SDN) is a promising structure for pursuing an evolving complex and expansive large-scale modern network environment. Despite the rich operational flexibility of MC-SDN, it is imperative to protect the network deployment against potential vulnerabilities that lead to misuse and malicious activities on data planes. The security holes in the MC-SDN significantly impact network survivability, and subsequently, the data plane is vulnerable to potential security threats and unintended consequences. Accordingly, this work intends to design a Federated learning-based Security (FedSec) strategy that detects the MC-SDN attack. The FedSec ensures packet routing services among the nodes by maintaining a flow table frequently updated according to the global model knowledge. By executing the FedSec algorithm only on the network-centric nodes selected based on importance measurements, the FedSec reduces the system complexity and enhances attack detection and classification accuracy. Finally, the experimental results illustrate the significance of the proposed FedSec strategy regarding various metrics. [ABSTRACT FROM AUTHOR]

The proliferation of Internet of Things (IoT) devices has revolutionized various domains, but it has also brought forth numerous security challenges. One of the most concerning threats is the emergence of hybrid attacks, which combine multiple attack vectors to exploit vulnerabilities in IoT networks. Existing security mechanisms often struggle to effectively predict and detect these sophisticated hybrid attacks, leading to compromised system integrity and data confidentiality. In this paper, we propose robust learning approach, named HybridRobustNet (HRN), for predicting and detecting hybrid attacks over IoT networks. HRN integrates machine learning algorithms, deep neural networks, and ensemble techniques to achieve enhanced detection accuracy and resilience against evolving hybrid attack patterns. By leveraging a diverse set of features, including network traffic patterns, device behavior, and communication characteristics, HRN effectively captures the complex relationships and dependencies between various attack components. Furthermore, the proposed approach incorporates real-time adaptive learning mechanisms, enabling it to dynamically adapt to new attack strategies and mitigate false positives. To evaluate the effectiveness of HRN, extensive experiments were conducted on a realistic IoT testbed comprising heterogeneous devices and attack scenarios. The results demonstrate that HRN outperforms state-of-the-art approaches in terms of attack detection accuracy, robustness against evasion techniques, and low false positive rates. Additionally, its computational efficiency makes it suitable for deployment in resource-constrained IoT environments. The contributions of this work are twofold. Firstly, it addresses the pressing need for robust detection mechanisms against hybrid attacks, which can have severe consequences for IoT networks. Secondly, it introduces a unique and adaptive learning approach, HRN, which exhibits superior performance and adaptability in the face of emerging attack strategies. The findings presented in this article provide valuable insights into the design of effective security mechanisms for IoT networks and pave the way for future research in the field of hybrid attack detection. [ABSTRACT FROM AUTHOR]

The ever-growing web application landscape, fueled by technological advancements, introduces new vulnerabilities to cyberattacks. Cross-site scripting (XSS) attacks pose a significant threat, exploiting the difficulty of distinguishing between benign and malicious scripts within web applications. Traditional detection methods struggle with high false-positive (FP) and false-negative (FN) rates. This research proposes a novel machine learning (ML)-based approach for robust XSS attack detection. We evaluate various models including Random Forest (RF), Logistic Regression (LR), Support Vector Machines (SVMs), Decision Trees (DTs), Extreme Gradient Boosting (XGBoost), Multi-Layer Perceptron (MLP), Convolutional Neural Networks (CNNs), Artificial Neural Networks (ANNs), and ensemble learning. The models are trained on a real-world dataset categorized into benign and malicious traffic, incorporating feature selection methods like Information Gain (IG) and Analysis of Variance (ANOVA) for optimal performance. Our findings reveal exceptional accuracy, with the RF model achieving 99.78% and ensemble models exceeding 99.64%. These results surpass existing methods, demonstrating the effectiveness of the proposed approach in securing web applications while minimizing FPs and FNs. This research offers a significant contribution to the field of web application security by providing a highly accurate and robust ML-based solution for XSS attack detection. [ABSTRACT FROM AUTHOR]

The Industrial Internet of Things (IIoT) plays an important role as its implementation requires scalable and secure methods. IIoT integrates databases, machines, various sensors, and services to improve our lives in many ways, including e-healthcare and smarter cities. Accurately identifying attacks in IIoT is critical to mitigating security risks, and the volume of such attacks is rising to an unprecedented level. As IIoT solutions integrate into larger operational systems, additional planning and development of a new mechanism is required to ensure privacy and security. Many deep learning approaches have been developed to focus on intrusion detection. However, such approaches suffer from low detection accuracy, efficiency, privacy, and high time consumption. To mitigate these issues, this study proposes a novel approach called bi-long short-term memory (Bi-LSTM) in IIoT security for privacy and security in industrial systems. To improve the performance of Bi-LSTM, we use modified coot optimization. Our proposed Bi-LSTM approach effectively detects attacks in the IIoT environment. To assess its performance, we analyze various evaluation measures including precision, sensitivity, Matthews correlation coefficient (MCC), and accuracy. The results of our performance analysis reveal that the proposed optimized Bi-LSTM method achieves a higher performance rate of 98.91% accuracy, 95.86% sensitivity, 95.63% MCC, and 97.52% accuracy than other existing approaches. The existing approaches such as CDW_FedAvg, RNN, COSNN, and RCS-DOFH achieved lower accuracy of 98.52%, 97.83%, 95.17%, and 96.24%, respectively. The findings highlight the potential for improved cybersecurity in the IIoT, emphasizing the importance of effective planning and innovative critical systems. [ABSTRACT FROM AUTHOR]

Nowadays, the Internet of Things (IoT) is considered a globally implemented technology in automated network structures. However, the procedures utilized in IoT devices can have security exposures that may affect the entire system. IoT systems are vulnerable to attacks due to the lack of basic security protocols. An intrusion detection system (IDS) is a fundamental cybersecurity device used to identify any unusual host or network activity. The common approach to designing IDS methods is to use classifiers like detection units. However, classifiers often cause high misclassification and low detection rates due to the presence of inappropriate, noisy, and unnecessary features in the large feature space. To address these issues, this article proposes a novel IoT-based intrusion detection system. The proposed IoT-IDS system comprises data analysis, data preprocessing, feature selection, and attack prediction phases. During preprocessing, unprocessed data are transformed into a simpler and more efficient form to perform further processing. In the feature selection process, unnecessary and inappropriate features are extracted, and a feature subset is generated. To attain optimal features, this paper employs a Pareto-based ensemble technique. The normal and anomaly behaviors of network traffic are determined through a set of extraction rules. Finally, the proposed intrusion detection classifier, named adaptive weighted kernel support vector machine-based circle search (AWSVM-CS) approach, detects and discriminates normal and anomaly features accurately. After attack detection, the network generates a warning alert, which helps the IoT network administrator take further actions to solve the security issue. The efficiency of the proposed approach is investigated in terms of diverse evaluation measures, including accuracy, precision, sensitivity, F1-score, false alarm rate, average accuracy, attack detection rate, and attack accuracy. The experimental analysis reveals that the proposed approach achieves a high attack detection rate of about 93.3% for the UNSW-NB15 dataset and 93% for the KDD99 dataset. Overall, this AWSVM-CS approach provides a robust solution to the security challenges in IoT systems by effectively detecting and preventing potential security breaches. [ABSTRACT FROM AUTHOR]

Abstract With development of blockchain technology, clouding computing and Internet of Things (IoT), blockchain and cloud of things (BCoT) has become development tendency. But the security has become the most development hinder of BCoT. Attack detection model is a crucial part of attack revelation mechanism for BCoT. As a consequence, attack detection model has received more concerned. Due to the great diversity and variation of network attacks aiming to BCoT, tradition attack detection models are not suitable for BCoT. In this paper, we propose a novel attack detection model for BCoT, denoted as cVAE-DML. The novel model is based on contrastive variational autoencoder (cVAE) and deep metric learning (DML). By training the cVAE, the proposed model generates private features for attack traffic information as well as shared features between attack traffic information and normal traffic information. Based on those generated features, the proposed model can generate representative new samples to balance the training dataset. At last, the decoder of cVAE is connected to the deep metric learning network to detect attack aiming to BCoT. The efficiency of cVAE-DML is verified using the CIC-IDS 2017 dataset and CSE-CIC-IDS 2018 dataset. The results show that cVAE-DML can improve attack detection efficiency even under the condition of unbalanced samples.

Abstract Due to the large computational overhead, underutilization of features, and high bandwidth consumption in traditional SDN environments for DDoS attack detection and mitigation methods, this paper proposes a two-stage detection and mitigation method for DDoS attacks in SDN based on multi-dimensional characteristics. Firstly, an analysis of the traffic statistics from the SDN switch ports is performed, which aids in conducting a coarse-grained detection of DDoS attacks within the network. Subsequently, a Multi-Dimensional Deep Convolutional Classifier (MDDCC) is constructed using wavelet decomposition and convolutional neural networks to extract multi-dimensional characteristics from the traffic data passing through suspicious switches. Based on these extracted multi-dimensional characteristics, a simple classifier can be employed to accurately detect attack samples. Finally, by integrating graph theory with restrictive strategies, the source of attacks in SDN networks can be effectively traced and isolated. The experimental results indicate that the proposed method, which utilizes a minimal amount of statistical information, can quickly and accurately detect attacks within the SDN network. It demonstrates superior accuracy and generalization capabilities compared to traditional detection methods, especially when tested on both simulated and public datasets. Furthermore, by isolating the affected nodes, the method effectively mitigates the impact of the attacks, ensuring the normal transmission of legitimate traffic during network attacks. This approach not only enhances the detection capabilities but also provides a robust mechanism for containing the spread of cyber threats, thereby safeguarding the integrity and performance of the network.

The Industrial Internet of Things (IIoT) is a paradigm that enables the integration of cyber-physical systems in critical infrastructures, such as power grids, water distribution networks, and transportation systems. IIoT devices, such as sensors, actuators, and controllers, can provide various benefits, such as performance optimization, efficiency improvement, and remote management. However, these devices also pose new security risks and challenges, as they can be targeted by malicious actors to disrupt the normal operation of the infrastructures they are connected to or to cause physical damage or harm. Therefore, it is essential to develop effective and intelligent solutions to detect and prevent attacks on IIoT devices and to ensure the security and resilience of critical infrastructures. In this paper, we present a comprehensive analysis of the types and impacts of attacks on IIoT devices based on a literature review and a data analysis of real-world incidents. We classify the attacks into four categories: denial-of-service, data manipulation, device hijacking, and physical tampering. We also discuss the potential consequences of these attacks on the safety, reliability, and availability of critical infrastructures. We then propose an expert system that can detect and prevent attacks on IIoT devices using artificial intelligence techniques, such as rule-based reasoning, anomaly detection, and reinforcement learning. We describe the architecture and implementation of our system, which consists of three main components: a data collector, a data analyzer, and a data actuator. We also present a table that summarizes the main features and capabilities of our system compared to existing solutions. We evaluate the performance and effectiveness of our system on a testbed consisting of programmable logic controllers (PLCs) and IIoT protocols, such as Modbus and MQTT. We simulate various attacks on IIoT devices and measure the accuracy, latency, and overhead of our system. Our results show that our system can successfully detect and mitigate different types of attacks on IIoT devices with high accuracy and low latency and overhead. We also demonstrate that our system can enhance the security and resilience of critical infrastructures by preventing or minimizing the impacts of attacks on IIoT devices. [ABSTRACT FROM AUTHOR]