Search

Network security faces challenges, including reduced true positives, increased false positives, and inadequate anomaly detection efficacy. This paper introduces the DeepRoughNetID (DRNID) approach to address these issues and confront the increasing cyberattack threat in modern communication systems. DRNID presents an innovative framework for network intrusion detection, incorporating kNNImputer, GreedyRoughSelector, DeepVAEEnsembler, and IntrusionNet components. kNNImputer enables adaptable data preprocessing by leveraging instance-based learning, facilitating efficient handling of evolving datasets without necessitating full retraining. GreedyRoughSelector enhances classifier performance through systematic attribute selection, focusing on relevant features while eliminating redundancies. DeepVAEEnsembler leverages Variational Autoencoders (VAEs) to learn underlying data distributions, enabling robust anomaly detection. IntrusionNet utilizes VAEs to classify intrusions, providing a comprehensive solution to network security challenges. By integrating these components, DRNID offers a refined approach that promises significant advancements in network intrusion detection. The experimental results demonstrate the effectiveness of DRNID, with an impressive accuracy of 98.8% achieved through 10-fold cross-validation. DRNID exhibits superior performance compared to existing methods across various datasets, showcasing its robust anomaly detection capabilities. This methodology empowers organizations to proactively prevent security violations and safeguard sensitive data from malicious entities. Beyond its theoretical contributions, our research carries tangible implications for strengthening cybersecurity defenses across diverse sectors, including telecommunications, finance, and healthcare. [ABSTRACT FROM AUTHOR]

Our increasingly connected world continues to face an ever-growing number of network-based attacks. An Intrusion Detection System (IDS) is an essential security technology used for detecting these attacks. Although numerous Machine Learning-based IDSs have been proposed for the detection of malicious network traffic, the majority have difficulty properly detecting and classifying the more uncommon attack types. In this paper, we implement a novel hybrid technique using synthetic data produced by a Generative Adversarial Network (GAN) to use as input for training a Deep Reinforcement Learning (DRL) model. Our GAN model is trained on the NSL-KDD dataset, a publicly available collection of labeled network traffic data specifically designed to support the evaluation and benchmarking of IDSs. Ultimately, our findings demonstrate that training the DRL model on synthetic datasets generated by specific GAN models can result in better performance in correctly classifying minority classes over training on the true imbalanced dataset. [ABSTRACT FROM AUTHOR]

Cloud computing has revolutionized the way IT industries work. Most modern‐day companies rely on cloud services to accomplish their day‐to‐day tasks. From hosting websites to developing platforms and storing resources, cloud computing has tremendous use in the modern information technology industry. Although an emerging technique, it has many security challenges. In structured query language injection attacks, the attacker modifies some parts of the user query to still sensitive user information. This type of attack is challenging to detect and prevent. In this article, we have reviewed 65 research articles that address the issue of its prevention and detection in cloud and Traditional Networks, of which 11 research articles are related to general cloud attacks, and the rest of the 54 research articles are specifically on web security. Our result shows that Random Forest has an accuracy of 99.8% and a Precision rate of 99.9%, and the worst‐performing model is Multi‐Layer Perceptron (MLP) in the SQLIA Model. For recall value, Random Forest performs best while TensorFlow Linear Classifier performs worst. F1 score is best in Random Forest, while MLP is the most diminutive performer. [ABSTRACT FROM AUTHOR]

In order to solve the problem that the existing log anomaly detection methods tend to focus only on the single feature of the quantitative relationship mode or the sequential mode, ignoring the relationship of the log time structure and the interrelation between different features, resulting in a high error detection rate and false positive rate, this paper proposed a log anomaly detection method based on the log time graph attention network. Firstly, this paper constructed a log time graph by designing a joint feature extraction module of log semantics and time structure, which effectively integrated the time structure relationship and semantic information of log. Secondly, it constructed the time relationship graph attention network, and used the graph structure to describe the time structure relationship between logs, which could adaptively learn the importance of different logs and carry out anomaly detection. Finally, it used three public datasets to verify the effectiveness of the model. Extensive experiments results indicate that the proposed method is able to effectively capture the temporal structure relationships in the logs, thereby improving the accuracy of anomaly detection. [ABSTRACT FROM AUTHOR]

The development and utilization of network big data is also accompanied by data theft and destruction, so the monitoring of network security is particularly important. Based on this, the study applies the fuzzy C-mean clustering algorithm to the network security model, however, the algorithm has major defects in discrete data processing and the influence of feature weights. Therefore, the study introduces the concept of local density and optimizes the initial clustering center to solve its sensitive defects as well as empirical limitations; at the same time, the study introduces the adaptive methods of fuzzy indicators and feature weighting, and uses the concepts such as fuzzy center-of-mass distribution to avoid problems such as the model converging too fast and not being able to handle discrete data. Finally, the study does a simulation analysis of the performance of each module, and the comparison of the overall algorithm with the rest of the models. The experimental results show that in the comparison of the overall algorithm, its false detection rate decreases by 8.57% in the IDS Dataset dataset, compared to the particle swarm algorithm. Therefore, the adaptive weighted fuzzy C-Means algorithm based on local density proposed in the study can effectively improve the network intrusion detection performance. [ABSTRACT FROM AUTHOR]

Aiming to address the timely dissemination of news information, this work explores the clever utilization of data mining (DM) technology and deep learning (DL) algorithms to construct an intelligent real-time news image acquisition system to meet the urgency of news dissemination needs. First, this work introduces an intelligent real-time news image acquisition system and provides a detailed analysis of its principles and advantages. Throughout this process, the crucial role of DM technology in news image classification and automation is emphasized, especially in dealing with rapidly evolving news events. Next, the work establishes an intelligent real-time news image acquisition model based on DL algorithms, which integrates the essence of DM technology. Through this fusion, the research objective is to enhance the performance of the news image acquisition system to achieve higher real-time and accuracy, which is vital for the swift delivery of news information. Finally, this work investigates the application of the intelligent news image acquisition system in network communication to ensure its adaptability to various network communication scenarios while maintaining accuracy and real-time capabilities. The research results demonstrate that the application of DM technology in combination with DL algorithms can effectively meet the practical needs of the news industry, enhancing the automation of news image processing and enabling faster information delivery to the audience. Notably, the AlexNet model employed performs exceptionally well, achieving recognition rates of up to 99.6% after data augmentation or equalization processing, with an accuracy of 90.9% and a high specificity of 93.38%. This indicates outstanding overall classification accuracy and negative class accuracy, even when distinguishing between news and non-news scenarios. These results clearly underscore the connection between DM technology and news acquisition and editing practices, and emphasize its potential to improve the efficiency and accuracy of real-time information dissemination. The research's contribution and innovation lie in the fusion of DM technology with DL algorithms to build an intelligent real-time news image acquisition system. This fusion enhances the automation and classification performance of news images, thereby improving the real-time and accuracy of news information. Furthermore, the work strongly emphasizes improving the real-time and accuracy of the news image acquisition system to ensure the swift delivery of information, which is of utmost importance in rapidly changing news events. [ABSTRACT FROM AUTHOR]

The dynamic and evolving nature of mobile networks necessitates a proactive approach to security, one that goes beyond traditional methods and embraces innovative strategies such as anomaly detection and prediction. This study delves into the realm of mobile network security and reliability enhancement through the lens of anomaly detection and prediction, leveraging K-means clustering on call detail records (CDRs). By analyzing CDRs, which encapsulate comprehensive information about call activities, messaging, and data usage, this research aimed to unveil hidden patterns indicative of anomalous behavior within mobile networks and security breaches. We utilized 14 million one-year CDR records. The mobile network used had deployed the latest network generation, 5G, with various sources of network elements. Through a systematic analysis of historical CDR data, this study offers insights into the underlying trends and anomalies prevalent in mobile network traffic. Furthermore, by harnessing the predictive capabilities of the K-means algorithm, the proposed framework facilitates the anticipation of future anomalies based on learned patterns, thereby enhancing proactive security measures. The findings of this research can contribute to the advancement of mobile network security by providing a deeper understanding of anomalous behavior and effective prediction mechanisms. The utilization of K-means clustering on CDR data offers a scalable and efficient approach to anomaly detection, with 96% accuracy, making it well suited for network reliability and security applications in large-scale mobile networks for 5G networks and beyond. [ABSTRACT FROM AUTHOR]

In today's digital landscape, cybercriminals are constantly evolving their tactics, making it challenging for traditional cybersecurity methods to keep up. To address this issue, this study explores the potential of knowledge graph reasoning as a more adaptable and sophisticated approach to identify and counter network attacks. By leveraging graph structures imbued with human‐like thinking, this method enhances the resilience of cybersecurity systems. The study focuses on three critical aspects: data preparation, semantic foundations, and knowledge graph inference techniques. Through an in‐depth analysis of these components, the research aims to reveal how knowledge graph reasoning can improve cyberattack detection and enhance the overall efficacy of cybersecurity measures, including intrusion detection systems. The proposed approach has undergone extensive experimentation to validate its effectiveness compared to existing methods. The results of the experiment have shown a remarkable advancement in accuracy, speed, and recall for recognition, surpassing current methods. This achievement is a notable contribution in the realm of managing big data in cybersecurity. The study establishes a foundation for the automation of network attack detection, ultimately enhancing overall network security. [ABSTRACT FROM AUTHOR]

The distributed denial of service (DDoS) attack is one of the most pernicious threats in cyberspace. Catastrophic failures over the past two decades have resulted in catastrophic and costly disruption of services across all sectors and critical infrastructure. Machine-learning-based approaches have shown promise in developing intrusion detection systems (IDSs) for detecting cyber-attacks, such as DDoS. Herein, we present a solution to detect DDoS attacks through an ensemble-based machine learning approach that combines supervised and unsupervised machine learning ensemble frameworks. This combination produces higher performance in detecting known DDoS attacks using supervised ensemble and for zero-day DDoS attacks using an unsupervised ensemble. The unsupervised ensemble, which employs novelty and outlier detection, is effective in identifying prior unseen attacks. The ensemble framework is tested using three well-known benchmark datasets, NSL-KDD, UNSW-NB15, and CICIDS2017. The results show that ensemble classifiers significantly outperform single-classifier-based approaches. Our model with combined supervised and unsupervised ensemble models correctly detects up to 99.1% of the DDoS attacks, with a negligible rate of false alarms. [ABSTRACT FROM AUTHOR]

Low-rate distributed denial of service attacks, as known as LDDoS attacks, pose the notorious security risks in cloud computing network. They overload the cloud servers and degrade network service quality with the stealthy strategy. Furthermore, this kind of small ratio and pulse-like abnormal traffic leads to a serious data scale problem. As a result, the existing models for detecting minority and adversary LDDoS attacks are insufficient in both detection accuracy and time consumption. This paper proposes a novel multi-scale Convolutional Neural Networks (CNN) and bidirectional Long-short Term Memory (bi-LSTM) arbitration dense network model (called MSCBL-ADN) for learning and detecting LDDoS attack behaviors under the condition of limited dataset and time consumption. The MSCBL-ADN incorporates CNN for preliminary spatial feature extraction and embedding-based bi-LSTM for time relationship extraction. And then, it employs arbitration network to re-weigh feature importance for higher accuracy. At last, it uses 2-block dense connection network to perform final classification. The experimental results conducted on popular ISCX-2016-SlowDos dataset have demonstrated that the proposed MSCBL-ADN model has a significant improvement with high detection accuracy and superior time performance over the state-of-the-art models. [ABSTRACT FROM AUTHOR]

In this paper, a novel blockchain-based multilevel security and authentication application is proposed to address the problem of counterfeiting in the medicine supply chain. In this blockchain-enabled application, multiple computers owned by different supply chain organizations collaborate in a distributed fashion to establish a trustworthy network. By adopting a resource-efficient Hyperledger Fabric framework, the proposed system aims to enhance transparency, integrity, and traceability in the pharmaceutical supply chain. Hyperledger Fabric blockchain also adds network security, privacy preservation, real-time tracking, and reliability features to the proposed system. Moreover, the proposed system also incorporates a blockchain-based QR code watermarking layer for authentication and verification. A validation module is designed that empowers buyers to validate the identity and history of serialized medicinal products, and buyer identity validation ensures that only legitimate buyers can access the products. Simulation outcomes and performance measurements demonstrate the effectiveness of the proposed system, including location traceability, QR code authentication, and verification. The Caliper tool has been used to measure the performance of the proposed system in terms of execution time, throughput, latency, and resource statistics for up to 100,000 transactions and 20 peers. The highest throughput achieved is 417.5 TPS (transactions per second) with 100,000 transactions and eight peers. The QR code authentication performance is tested under various noisy, cropped, and blurred attacks. We presented simulation outcomes of the implemented supply chain as well as chain code algorithms. The results indicate improved scalability, validation mechanisms, throughput, latency, and resource consumption compared to existing schemes. [ABSTRACT FROM AUTHOR]

Preventing attackers from interrupting or totally stopping critical services in cloud systems is a vital and challenging task. Today, machine learning-based algorithms and models are widely used, especially for the intelligent detection of zero-day attacks. Recently, deep learning methods that provide automatic feature extraction are designed to detect attacks automatically. In this study, we constructed a new deep learning model based on transfer learning for detecting and protecting cloud systems from malicious attacks. The developed deep transfer learning-based IDS converts network traffic into 2D preprocessed feature maps.Then the feature maps are processed with the transferred and fine-tuned convolutional layers of the deep learning model before the dense layer for detection and classification of traffic data. The results computed using the NSL-KDD test dataset reveal that the developed models achieve 89.74% multiclass and 92.58% binary classification accuracy. We performed another evaluation using only 20% of the training dataset as test data, and 80% for training. In this case, the model achieved 99.83% and 99.85% multiclass and binary classification accuracy, respectively. [ABSTRACT FROM AUTHOR]

In today's internet-driven world, a multitude of attacks occurs daily, propelled by a vast user base. The effective detection of these numerous attacks is a growing area of research, primarily accomplished through intrusion detection systems (IDS). IDS are vital for monitoring network traffic to identify malicious activities, such as Denial of Service, Probe, Remote-to-Local, and User-to-Root attacks. Our research focused on evaluating different auto-encoders for enhancing network intrusion detection. The proposed method sparse deep denoising auto-encoder approach produces the dimensionality reduction used to predict and classify attacks in datasets. With the most records among the datasets by training the auto-encoder on normal network data, this utilized reconstruction error as an indicator of anomalies. We tested our approach using standard datasets like KDDCup99, NSL-KDD, UNSW-NB15, and NMITIDS. Remarkably, our sparse deep denoising auto-encoder achieved an accuracy of over 96% based solely on reconstruction error. The primary aim of this work is to improve intrusion detection by achieving higher detection accuracy compared to existing methods. [ABSTRACT FROM AUTHOR]

The Zero Trust safety architecture emerged as an intriguing approach for overcoming the shortcomings of standard network security solutions. This extensive survey study provides a meticulous explanation of the underlying principles of Zero Trust, as well as an assessment of the many strategies and possibilities for effective implementation. The survey begins by examining the role of authentication and access control within Zero Trust Architectures, and subsequently investigates innovative authentication, as well as access control solutions across different scenarios. It more deeply explores traditional techniques for encryption, micro-segmentation, and security automation, emphasizing their importance in achieving a secure Zero Trust environment. Zero Trust Architecture is explained in brief, along with the Taxonomy of Zero Trust Network Features. This review article provides useful insights into the Zero Trust paradigm, its approaches, problems, and future research objectives for scholars, practitioners, and policymakers. This survey contributes to the growth and implementation of secure network architectures in critical infrastructures by developing a deeper knowledge of Zero Trust. [ABSTRACT FROM AUTHOR]

The complexity of marine information types, data diversity, data collection difficulties and other aspects makes the network security of marine information management more and more prominent, and has become a major issue affecting the stability of the country and society, so it is urgent to establish a marine information management network security system. Traditional network security technology adopts a passive approach and cannot actively detect viruses, trojans, and other hidden objects in the network. Antivirus software would only be used when attacked. If the risk of network attack is too great, the consequences would be unimaginable. This paper designed a marine information management network security system based on artificial intelligence embedded technology, which improved the efficiency of marine information security management. This paper also applied the embedded technology of AI to the network security management, and proposed the k-means clustering algorithm (K-Means) of AI, which can greatly improve the network security. The experimental results in this paper showed that the intrusion detection rates of System 1 and System 2 were 56.3% and 78.3% respectively when the number of viruses was 50 at 30M, and 65.5% and 80.1% respectively when the number of viruses was 50 at 60M. It showed that the intrusion detection rate of System 2 was higher both at 30M and 60M. [ABSTRACT FROM AUTHOR]

This survey paper provides a comprehensive overview of recent research and development in network security that uses graphs and graph-based data representation and analytics. The paper focuses on the graph-based representation of network traffic records and the application of graph-based analytics in intrusion detection and botnet detection. The paper aims to answer several questions related to graph-based approaches in network security, including the types of graphs used to represent network security data, the approaches used to analyze such graphs, the metrics used for detection and monitoring, and the reproducibility of existing works. The paper presents a survey of graph models used to represent, store, and visualize network security data, a survey of the algorithms and approaches used to analyze such data, and an enumeration of the most important graph features used for network security analytics for monitoring and botnet detection. The paper also discusses the challenges and limitations of using graph-based approaches in network security and identifies potential future research directions. Overall, this survey paper provides a valuable resource for researchers and practitioners in the field of network security who are interested in using graph-based approaches for analyzing and detecting malicious activities in networks. [ABSTRACT FROM AUTHOR]

In the rapidly expanding domain of the Internet of Things (IoT), ensuring the implementation of robust security measures such as authentication has become paramount to safeguarding sensitive data and maintaining the integrity of connected devices. Symmetry in the IoT commonly denotes the uniformity or equilibrium in data distribution and processing across devices or nodes in a network. Leveraging symmetric patterns can enhance the robustness and scalability of IoT authentication. This scoping review aims to provide a comprehensive overview of recent developments in authentication techniques within the IoT paradigm. It subsequently presents recent research on various IoT authentication schemes, organized around several key research questions. The objective is to decipher the intricacies associated with authentication in the IoT by employing a multi-criteria classification approach. This involves a comprehensive analysis of existing authentication protocols, delineating their respective advantages and disadvantages, and gaining insights into the associated security concerns. The research questions highlighted in the review aim to probe the present scenario of authentication systems utilized in IoT, with a focus on identifying trends and discerning shifts. This review synthesizes insights from scholarly articles to provide a roadmap for future research in IoT authentication. It functions as a valuable resource for establishing theoretical foundations and provides practical implications applicable to practitioners, policymakers, and researchers alike. By elucidating the intricacies of IoT authentication, this review cultivates a profound understanding of the transformative potential and the multifaceted challenges. It establishes the foundation for resilient security measures essential for the sustainable growth of the Internet of Things. [ABSTRACT FROM AUTHOR]

This paper studies adversarial attacks on network intrusion detection systems (IDSs) based on deep or machine learning algorithms. Adversarial attacks on network IDSs must maintain the functional logic of the attack flow. To prevent the produced adversarial examples from violating the attack behavior, most solutions define some limited modification actions. The result limits the production of adversarial examples, and the produced adversarial examples are not guaranteed to find the attack packets. This paper proposes the concept of flow containers to model packets in a flow. Then, we propose a generative adversarial network framework with dual adversarial training to train the generator to produce adversarial flow containers. Flow containers can correlate attack packets and feature vectors of attack flows. We test the evasion rate of the produced adversarial examples using 12 deep and machine learning algorithms. For experiments on the CTU42 data set, the proposed adversarial examples have the highest evasion rates among all 12 classifiers, with the highest evasion rate as high as 1.00. For experiments on the CIC-IDS2017 data set, the proposed adversarial examples have the highest evasion rate among the five classifiers, and the highest evasion rate is also up to 1.00. [ABSTRACT FROM AUTHOR]

Network attacks, such as botnets stealing sensitive data, constitute a critical concern for administrators in the Internet area. Such attacks can be prevented using a network access control (NAC) scheme. However, existing NAC mechanisms all rely on the user account mechanism provided by the operating system. Herein, we propose a protocol involving a Linux security module for user-based NAC. The module requires neither user accounts nor secure user space; it loads signed rules and keys for a user from a USB security key, securely authenticates the user, and controls network permissions directly from the Linux kernel. Moreover, we present extensions for the protocol, developed using additional authentication methods and devices (such as a smartphone), to prevent man-in-the-middle, replay, and phishing attacks. The protocol can securely authenticate users from kernel space by using USB security keys and a user smartphone despite an insecure user space, is resistant to various attacks, and can guarantee that authorized users obtain their corresponding network privileges. At the same time, the analysis of Linux operating system security enhancement technology is proposed to achieve the goal of trusting machines. Through the use of empirical algorithm analysis, enhanced virtualization technology, and other methods, the risk of hacker intrusion on information platforms is reduced in multiple aspects, and management mechanisms are used to set and use resource permissions. On the other hand, after mastering the key technologies for network blocking development in the core layer of the system, there is also an opportunity to independently build modules for the security core of operating systems in special fields and future 5G/6G SDNs. [ABSTRACT FROM AUTHOR]

Modern computer networks' increasing complexity and scale need serious attention towards network anomaly detection. Software‐defined networking (SDN) and graph neural networks (GNN) have emerged as promising approaches for anomaly detection due to their ability to capture dynamic network behavior and learn complex patterns from large‐scale network data. The amalgamation of SDN and GNN for network anomaly detection presents promising opportunities for improving the accuracy and efficiency of network anomaly detection. This paper focuses on various trends, issues, and challenges by integrating GNN on the top of SDN for network anomaly detection. The article highlights the advantages of using SDN for providing fine‐grained control and programmability in network monitoring. At the same time, GNN can model network behavior as a graph and learn representations from graph‐structured data. The authors also discuss the limitations of traditional anomaly detection methods in SDN, such as rule‐based approaches, and the potential of GNN to overcome these limitations by leveraging their ability to capture non‐linear and dynamic patterns in network data. This paper also presents a case study of DoS attack detection using SDN. The result shows that SDN based approach helps to detect attacks with an accuracy of 97% with future research directions. [ABSTRACT FROM AUTHOR]

In recent research, the task of Owner Named Entity Recognition (ONER) in websites has been proposed as a specific and practical application of Multimodal Named Entity Recognition (MNER). The ONER aims to identify the true owner of websites on the Internet, which plays a crucial role in network security. The existing method involves identifying the website owner's name through the text, image, and domain in the content of the website, where the owner information usually appears. However, most of the previous methods simply extracted features from the image and the domain as two independent modalities and did not fully utilize the text information in them. Additionally, these methods do not consider that different modality features are trained on their respective modality space, which makes it difficult to model cross-modal interactions due to different feature spaces. To address these two issues, this paper proposes a Multidimensional Text Guidance and Space Alignment Co-Attention (MTGSAC) model to realize owner named entity recognition in websites. The MTGSAC model can utilize the text information in the image and the domain modalities to guide the text modality for features extraction. Meanwhile, the model designs a features fusion module based on Transformer and co-attention gate mechanism to effectively model cross-modal interactions. Furthermore, to address the problems of insufficient data samples and poor data diversity in the existing ONER dataset, we extended the ONER dataset and proposed the ONER-2.0 dataset. Experimental results on both the ONER and ONER-2.0 datasets show that our model achieves state-of-the-art performance. [ABSTRACT FROM AUTHOR]

Address Resolution Protocol (ARP) is used to resolve a host’s MAC address, given its IP address. ARP is stateless, as there is no authentication when exchanging a MAC address between the hosts. Hacking tactics using ARP spoofing are constantly being abused differently; many previous studies have prevented such attacks. However, prevention requires modification of the underlying network protocol or additional expensive equipment, so applying these methods to the existing network can be challenging. In this paper, we examine the limitations of previous research in preventing ARP spoofing. In addition, we propose a defence mechanism that does not require network protocol changes or expensive equipment. Before sending or receiving a packet to or from any device on the network, our method checks the MAC and IP addresses to ensure they are correct. It protects users from ARP spoofing. The findings demonstrate that the proposed method is secure, efficient, and very efficient against various threat scenarios. It also makes authentication safe and easy and ensures data and users’ privacy, integrity, and anonymity through strong encryption techniques. [ABSTRACT FROM AUTHOR]

The global pandemic lockdowns fostered the digital transition of companies worldwide since most of their employees worked from home using public or private cloud services. Accordingly, these services became the primary targets of the latest generation DDoS threats. While some features of current DDoS attack profiles appeared before the pandemic period, they became significant and reached their current complexity in the recent period. Besides applying novel methods and tools, the attacks’ frequency, extent, and complexity also increased significantly. The combination of various attack vectors opened the way for multivector attacks incorporating a unique blend of L3-L7 attacking profiles. Unifying the hit-and-run method and the multi-vector approach contributed to the remarkable rise in success rate. The current paper has two focal points. First, it discusses the profiles of the latest DDoS attacks discovered in real data center infrastructures. To demonstrate and emphasize the changes in attack profile, we reference attack samples recently collected in various data center networks. Second, it provides a comprehensive survey of the state-of-the-art detection methods related to recent attacks. The paper especially focuses on the accuracy and speed of these, mostly networking-related detection approaches. Furthermore, we define features and quantitative and qualitative requirements to support detection methods handling the latest threat profiles. [ABSTRACT FROM AUTHOR]

In order to improve the effect and accuracy of risk source identification, this paper studied the network security risk source identification model of power CPS system based on fuzzy artificial neural network. The network security risk source index system of power CPS system was constructed, and the dimension of index data was reduced by principal component analysis. Fuzzy theory is used to process the index data after dimension reduction, and the comprehensive membership vector of each index is obtained. The dynamic clustering algorithm is used to determine the number of hidden layer units of radial basis function neural network, and the network security risk source identification model is established. Finally, the quantitative value of risk source identification is output. The experimental results show that the model can effectively reduce the dimension of the network security risk source index data of the power CPS system. The optimal distance threshold of the hidden layer is 4.2, and the optimal number of units is 6. In the final identification results, four severe risk sources and five moderate risk sources were obtained, and the quantitative values of risk source identification of each index were 63, 70, 71, 77, 65, 89 and 96, respectively, indicating that the model can effectively identify network security risk sources of power CPS systems. With the increase of the proportion of communication nodes removed, when there are various types of security vulnerability information, the mean square error value of the model is always lower than the set threshold, indicating that the model has high recognition accuracy. [ABSTRACT FROM AUTHOR]

The research addresses the critical anomaly detection problem in Software-Defined Networking (SDN), a domain where network integrity and security are paramount. Employing the Isolation Forest algorithm, a machine learning model renowned for its efficacy in identifying outliers, the study systematically generates synthetic network traffic data to train and test the model's detection capabilities. The methodology encompasses simulating a range of contamination rates to reflect varying degrees of anomalous activities within the network. Key findings indicate that while the model exhibits potential in anomaly detection, as reflected by the progressive increase in triggered alerts and policy changes, its performance metrics, such as precision, recall, F1-score, and AUC, reveal limitations in its current application. The research contributes to the field by providing a detailed analysis of the Isolation Forest algorithm's performance in an SDN context and laying the groundwork for future enhancements in machine learning-based security measures within these networks. [ABSTRACT FROM AUTHOR]

All facets of society's governance, economics, and culture have been impacted by networking. Network attacks have become more common as a result of the digital revolution, which has also facilitated major changes in worldwide communication and accelerated the development of human society. An unauthorized attempt to access a network with the goal of committing theft or other forms of damage is what we call a network attack. This article focuses on building a chain security model utilising the block chain concept in order to address the issue of inaccurate assessments of forged malicious behavioural methods for identification. It uses the NIK-256 hashing algorithm to identify valid users utilising time-dependent verification. Passwords and recorded times are maintained in a combined chain database, which combines blockchain technology and the Trusted Platform Module (TPM), improving data security and privacy. After that, we schedule users using the Whale optimisation algorithm (WOA), which decreases difficulty, and then a smart contract is developed that grants authorised users access control based on their level of trust and permission. The proposed approach, known as Hyb_chain_TPM, implements countermeasures in accordance with the attack risk level and stores the attack graph in a combined chain database for future attack forecasting. Utilising diverse attack datasets, extensive tests are run to validate this system. Additionally, the outcomes of privacy protection and AI processes are assessed independently and contrasted using a variety of current techniques. [ABSTRACT FROM AUTHOR]

Lateral movement (LM) is a principal, increasingly common, tactic in the arsenal of advanced persistent threat (APT) groups and other less or more powerful threat actors. It concerns techniques that enable a cyberattacker, after establishing a foothold, to maintain ongoing access and penetrate further into a network in quest of prized booty. This is done by moving through the infiltrated network and gaining elevated privileges using an assortment of tools. Concentrating on the MS Windows platform, this work provides the first to our knowledge holistic methodology supported by an abundance of experimental results towards the detection of LM via supervised machine learning (ML) techniques. We specifically detail feature selection, data preprocessing, and feature importance processes, and elaborate on the configuration of the ML models used. A plethora of ML techniques are assessed, including 10 base estimators, one ensemble meta-estimator, and five deep learning models. Vis-à-vis the relevant literature, and by considering a highly unbalanced dataset and a multiclass classification problem, we report superior scores in terms of the F1 and AUC metrics, 99.41% and 99.84%, respectively. Last but not least, as a side contribution, we offer a publicly available, open-source tool, which can convert Windows system monitor logs to turnkey datasets, ready to be fed into ML models. [ABSTRACT FROM AUTHOR]

As cross-border access becomes more frequent, traditional perimeter-based network security models can no longer cope with evolving security requirements. Zero trust is a novel paradigm for cybersecurity based on the core concept of "never trust, always verify". It attempts to protect against security risks related to internal threats by eliminating the demarcations between the internal and external network of traditional network perimeters. Nevertheless, research on the theory and application of zero trust is still in its infancy, and more extensive research is necessary to facilitate a deeper understanding of the paradigm in academia and the industry. In this paper, trust in cybersecurity is discussed, following which the origin, concepts, and principles related to zero trust are elaborated on. The characteristics, strengths, and weaknesses of the existing research are analysed in the context of zero trust achievements and their technical applications in Cloud and IoT environments. Finally, to support the development and application of zero trust in the future, the concept and its current challenges are analysed. [ABSTRACT FROM AUTHOR]

The echo state network is a unique form of recurrent neural network. Due to its feedback mechanism, it exhibits superior nonlinear behavior compared to traditional neural networks and is highly regarded for its simplicity and efficiency in computation. In recent years, as network development has progressed, the security threats faced by networks have increased. To detect and counter these threats, the analysis of network traffic has become a crucial research focus. The echo state network has demonstrated exceptional performance in sequence prediction. In this article, we delve into the impact of echo state networks on time series. We have enhanced the model by increasing the number of layers and adopting a different data input approach. We apply it to predict chaotic systems that appear ostensibly regular but are inherently irregular. Additionally, we utilize it for the classification of sound sequence data. Upon evaluating the model using root mean squared error and micro-F1, we have observed that our model exhibits commendable accuracy and stability. [ABSTRACT FROM AUTHOR]

In the domain of network security, intrusion detection systems (IDSs) play a vital role in data security. While the utilization of the internet amongst consumers is increasing on a daily basis, the significance of security and privacy preservation of system alerts, due to malicious actions, is also increasing. IDS is a widely executed system that protects computer networks from attacks. For the identification of unknown attacks and anomalies, several Machine Learning (ML) approaches such as Neural Networks (NNs) are explored. However, in real-world applications, the classification performances of these approaches are fluctuant with distinct databases. The major reason for this drawback is the presence of some ineffective or redundant features. So, the current study proposes the Network Intrusion Detection System using a Lion Optimization Feature Selection with a Deep Learning (NIDS-LOFSDL) approach to remedy the aforementioned issue. The NIDS-LOFSDL technique follows the concept of FS with a hyperparameter-tuned DL model for the recognition of intrusions. For the purpose of FS, the NIDS-LOFSDL method uses the LOFS technique, which helps in improving the classification results. Furthermore, the attention-based bi-directional long short-term memory (ABiLSTM) system is applied for intrusion detection. In order to enhance the intrusion detection performance of the ABiLSTM algorithm, the gorilla troops optimizer (GTO) is deployed so as to perform hyperparameter tuning. Since trial-and-error manual hyperparameter tuning is a tedious process, the GTO-based hyperparameter tuning process is performed, which demonstrates the novelty of the work. In order to validate the enhanced solution of the NIDS-LOFSDL system in terms of intrusion detection, a comprehensive range of experiments was performed. The simulation values confirm the promising results of the NIDS-LOFSDL system compared to existing DL methodologies, with a maximum accuracy of 96.88% and 96.92% on UNSW-NB15 and AWID datasets, respectively. [ABSTRACT FROM AUTHOR]

Detecting cyber intrusions in network traffic is a tough task for cybersecurity. Current methods struggle with the complexity of understanding patterns in network data. To solve this, we present the Hybrid Deep Learning Intrusion Detection Model (HD-IDM), a new way that combines GRU and LSTM classifiers. GRU is good at catching quick patterns, while LSTM handles long-term ones. HD-IDM blends these models using weighted averaging, boosting accuracy, especially with complex patterns. We tested HD-IDM on four datasets: CSE-CIC-IDS2017, CSE-CIC-IDS2018, NSL KDD, and CIC-DDoS2019. The HD-IDM classifier achieved remarkable performance metrics on all datasets. It attains an outstanding accuracy of 99.91%, showcasing its consistent precision across the dataset. With an impressive precision of 99.62%, it excels in accurately categorizing positive cases, crucial for minimizing false positives. Additionally, maintaining a high recall of 99.43%, it effectively identifies the majority of actual positive cases while minimizing false negatives. The F1-score of 99.52% emphasizes its robustness, making it the top choice for classification tasks requiring precision and reliability. It is particularly good at ROC and precision/recall curves, discriminating normal and harmful network activities. While HD-IDM is promising, it has limits. It needs labeled data and may struggle with new intrusion methods. Future work should find ways to handle unlabeled data and adapt to emerging threats. Also, making HD-IDM work faster for real-time use and dealing with scalability challenges is key for its broader use in changing network environments. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) refers to the network of interconnected physical devices that are embedded with software, sensors, etc., allowing them to exchange and collect information. Although IoT devices have several advantages and can improve people's efficacy, they also pose a security risk. The malicious actor frequently attempts to find a new way to utilize and exploit specific resources, and an IoT device is an ideal candidate for such exploitation owing to the massive number of active devices. Especially, Distributed Denial of Service (DDoS) attacks include the exploitation of a considerable number of devices like IoT devices, which act as bots and transfer fraudulent requests to the services, thereby obstructing them. There needs to be a robust system of detection based on satisfactory methods for detecting and identifying whether these attacks have occurred or not in a network. The most widely used technique for these purposes is artificial intelligence (AI), which includes the usage of Deep Learning (DL) and Machine Learning (ML) to find cyberattacks. The study presents a Piecewise Harris Hawks Optimizer with an Optimal Deep Learning Classifier (PHHO-ODLC) for a secure IoT environment. The fundamental goal of the PHHO-ODLC algorithm is to detect the existence of DDoS attacks in the IoT platform. The PHHO-ODLC method follows a three-stage process. At the initial stage, the PHHO algorithm can be employed to choose relevant features and thereby enhance the classification performance. Next, an attention-based bidirectional long short-term memory (ABiLSTM) network can be applied to the DDoS attack classification process. Finally, the hyperparameter selection of the ABiLSTM network is carried out by the use of a grey wolf optimizer (GWO). A widespread simulation analysis was performed to exhibit the improved detection accuracy of the PHHO-ODLC technique. The extensive outcomes demonstrated the significance of the PHHO-ODLC technique regarding the DDoS attack detection technique in the IoT platform. [ABSTRACT FROM AUTHOR]

Rapid growth is also being seen in the deployment of optical network equipment and the development of new network services for next-generation networks beyond 5G and 6G. Sybil attacks, wormhole assaults, and single-point failure are just some of the security threats that may affect optical networks. With the introduction of new B5G applications, the conventional setup is no longer enough to meet the need of real-time automatic configuration. A new automated setup approach for the underlying optical transport network is desired by operators. This research proposes a novel method for analysing the security and routing of radio optical networks by bringing together blockchain machine learning and quantum computing. Here, the security of the radio optical network is improved by using cryptanalysis through a federated blockchain model, and the routing is handled by means of sparse Fourier Q-adversarial Boltzmann neural networks. This research tackles a number of issues plaguing optical networks and proposes a strategy for protecting networks from intruders by using quantum-secured blockchain in these environments. Quality of service, data integrity, throughput, latency, packet delivery ratio, and end-to-end delay are all measured experimentally across a range of network security datasets. The proposed method achieved a 72% Quality of Service, 68% Data Integrity, 98% Throughput, 56% Latency, a 96% Packet Delivery Ratio, and a 49% End-to-End Delay. [ABSTRACT FROM AUTHOR]

Internet security is a major concern these days due to the increasing demand for information technology (IT)-based platforms and cloud computing. With its expansion, the Internet has been facing various types of attacks. Viruses, denial of service (DoS) attacks, distributed DoS (DDoS) attacks, code injection attacks, and spoofing are the most common types of attacks in the modern era. Due to the expansion of IT, the volume and severity of network attacks have been increasing lately. DoS and DDoS are the most frequently reported network traffic attacks. Traditional solutions such as intrusion detection systems and firewalls cannot detect complex DDoS and DoS attacks. With the integration of artificial intelligence-based machine learning and deep learning methods, several novel approaches have been presented for DoS and DDoS detection. In particular, deep learning models have played a crucial role in detecting DDoS attacks due to their exceptional performance. This study adopts deep learning models including recurrent neural network (RNN), long short-term memory (LSTM), and gradient recurrent unit (GRU) to detect DDoS attacks on the most recent dataset, CICDDoS2019, and a comparative analysis is conducted with the CICIDS2017 dataset. The comparative analysis contributes to the development of a competent and accurate method for detecting DDoS attacks with reduced execution time and complexity. The experimental results demonstrate that models perform equally well on the CICDDoS2019 dataset with an accuracy score of 0.99, but there is a difference in execution time, with GRU showing less execution time than those of RNN and LSTM. [ABSTRACT FROM AUTHOR]

Intrusion detection systems, also known as IDSs, are widely regarded as one of the most essential components of an organization's network security. This is because IDSs serve as the organization's first line of defense against several cyberattacks and are accountable for accurately detecting any possible network intrusions. Several implementations of IDSs accomplish the detection of potential threats throughout flow-based network traffic analysis. Traditional IDSs frequently struggle to provide accurate real-time intrusion detection while keeping up with the changing landscape of threat. Innovative methods used to improve IDSs' performance in network traffic analysis are urgently needed to overcome these drawbacks. In this study, we introduced a model called a deep neural decision forest (DNDF), which allows the enhancement of classification trees with the power of deep networks to learn data representations. We essentially utilized the CICIDS 2017 dataset for network traffic analysis and extended our experiments to evaluate the DNDF model's performance on two additional datasets: CICIDS 2018 and a custom network traffic dataset. Our findings showed that DNDF, a combination of deep neural networks and decision forests, outperformed reference approaches with a remarkable precision of 99.96% by using the CICIDS 2017 dataset while creating latent representations in deep layers. This success can be attributed to improved feature representation, model optimization, and resilience to noisy and unbalanced input data, emphasizing DNDF's capabilities in intrusion detection and network security solutions. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) has significantly benefited several businesses, but because of the volume and complexity of IoT systems, there are also new security issues. Intrusion detection systems (IDSs) guarantee both the security posture and defense against intrusions of IoT devices. IoT systems have recently utilized machine learning (ML) techniques widely for IDSs. The primary deficiencies in existing IoT security frameworks are their inadequate intrusion detection capabilities, significant latency, and prolonged processing time, leading to undesirable delays. To address these issues, this work proposes a novel range-optimized attention convolutional scattered technique (ROAST-IoT) to protect IoT networks from modern threats and intrusions. This system uses the scattered range feature selection (SRFS) model to choose the most crucial and trustworthy properties from the supplied intrusion data. After that, the attention-based convolutional feed-forward network (ACFN) technique is used to recognize the intrusion class. In addition, the loss function is estimated using the modified dingo optimization (MDO) algorithm to ensure the maximum accuracy of classifier. To evaluate and compare the performance of the proposed ROAST-IoT system, we have utilized popular intrusion datasets such as ToN-IoT, IoT-23, UNSW-NB 15, and Edge-IIoT. The analysis of the results shows that the proposed ROAST technique did better than all existing cutting-edge intrusion detection systems, with an accuracy of 99.15% on the IoT-23 dataset, 99.78% on the ToN-IoT dataset, 99.88% on the UNSW-NB 15 dataset, and 99.45% on the Edge-IIoT dataset. On average, the ROAST-IoT system achieved a high AUC-ROC of 0.998, demonstrating its capacity to distinguish between legitimate data and attack traffic. These results indicate that the ROAST-IoT algorithm effectively and reliably detects intrusion attacks mechanism against cyberattacks on IoT systems. [ABSTRACT FROM AUTHOR]

As the scale and complexity of networks grow rapidly, management, maintenance, and optimization of them are becoming increasingly challenging tasks for network administrators. Software-Defined Networking (SDN) was introduced to facilitate these tasks as it offers logically centralized control, a global view of the network, and software-based traffic analysis, thus, it is widely adopted of SDN to manage large-scale networks. On the other hand, SDN is not immune to cyber attacks. In fact, its centralized architecture makes it more vulnerable to certain types of attacks, such as denial of service. Various attack mitigation strategies are proposed to strengthen the security of SDNs including statistical, threshold-based, and Machine Learning (ML) methods. Among them, Deep Learning (DL)-based models attained the best results as they were able to extract the complex relationship between input parameters and output that could not be achieved with other solutions. Hence, this paper presents a comprehensive survey of the literature on the utilization of different DL algorithms for the security of SDN. We first explain the types of attacks that SDNs are exposed to, then present papers that applied DL to detect and/or mitigate these attacks. We further discuss the public datasets used to train DL models and evaluate their advantages and disadvantages. Finally, we share insights into future research directions to improve the efficiency of DL methods for SDN security. [ABSTRACT FROM AUTHOR]

Cyber-attacks and network intrusion have surfaced as major concerns for modern days applications of the Internet of Things (IoT). The existing intrusion detection and prevention techniques have a wide range of limitations and thus are unable to precisely detect any type of attack or anomaly within the network traffic. Many machine learning-based algorithms have also been presented by the researchers, which lack performance in terms of classification accuracy, or in terms of multi-class classification. This research presents a data-driven approach for intrusion and anomaly detection, where the data is processed and filtered using different algorithms. The quality of the training dataset is improved by using Synthetic Minority Oversampling Technique (SMOTE) algorithm and mutual information. Automated machine learning is also used to detect the algorithm with auto-tuned hyper-parameters that best suit to classify the data. This technique not only saves the computational cost to test the data at run-time but also provides an optimal algorithm without the need to run calculations to tune hyper-parameters, manually. The resultant algorithm solves a multi-class classification problem with an accuracy of 99.7%, outperforming the existing algorithms by a decent margin. [ABSTRACT FROM AUTHOR]

Nowadays, everybody needs to secure his/her activities. Existing levels of cyber-criminals need technology for detecting malicious activity. This work proposes a real-time Hardware IDS implemented on FPGA and an algorithm for classifying features from network traffic through the network interface card (NIC). It minimizes search time for extracting statistical features from connection records stored in connection queues to memory references. Therefore, it can detect most internal and external network attacks. A decision tree classifier is used as an inference engine and gives a high detection rate of 99.93%. [ABSTRACT FROM AUTHOR]

The emergence of robotic technologies has made a significant contribution in industry. Robot Operating System (ROS) is becoming a standard framework for industrial systems uses as a middleware system with many versions. However, the initial design of ROS does not include cyber-security concepts. The intense interest in robot systems, the security concerns and vulnerabilities of these systems have started to attract the attention of attackers. One of these attacks is DoS attack that targeting system availability by slowing down or crashing a service rather than obtaining the information or system. In this study, the impact of DoS attack has been analyzed in various scenarios for both in application and transport layer of the ROS middleware. In the experiments four different volume of DoS attacks are performed in five different experiment scenarios on ROS. To understand the impact of DoS attack, network traffics are monitored using Tshark. The resulting effects measured with some Quality of Service parameters that are delay and packet loss. [ABSTRACT FROM AUTHOR]

Network security is paramount in today's digital landscape, where cyberthreats continue to evolve and pose significant risks. We propose a DPDK-based scanner based on a study on advanced port scanning techniques to improve network visibility and security. The traditional port scanning methods suffer from speed, accuracy, and efficiency limitations, hindering effective threat detection and mitigation. In this paper, we develop and implement advanced techniques such as protocol-specific probes and evasive scan techniques to enhance the visibility and security of networks. We also evaluate network scanning performance and scalability using programmable hardware, including smart NICs and DPDK-based frameworks, along with in-network processing, data parallelization, and hardware acceleration. Additionally, we leverage application-level protocol parsing to accelerate network discovery and mapping, analyzing protocol-specific information. In our experimental evaluation, our proposed DPDK-based scanner demonstrated a significant improvement in target scanning speed, achieving a 2× speedup compared to other scanners in a target scanning environment. Furthermore, our scanner achieved a high accuracy rate of 99.5% in identifying open ports. Notably, our solution also exhibited a lower CPU and memory utilization, with an approximately 40% reduction compared to alternative scanners. These results highlight the effectiveness and efficiency of our proposed scanning techniques in enhancing network visibility and security. The outcomes of this research contribute to the field by providing insights and innovations to improve network security, identify vulnerabilities, and optimize network performance. [ABSTRACT FROM AUTHOR]

Maintaining computer network security has long been an essential component of computer administration. Network security has become essential to companies' safety and steady development in real-time implementation for diverse physical domains employing computers. Establishing a specific physical domain has consistently included a priority job of improving the safety of computer systems management. Study results on the practical implementation of machine intelligence in network security maintenance. Specifically, this paper examines and offers security management techniques for computer network data protection to establish an all-encompassing security shield for networked computers, with the ultimate goal of improving the safety and reliability of the net-worked computers used in commercial settings. Furthermore, the comprehensive research analysis determines an architectural model for machine intelligence-based network security maintenance (MI-NSM), implying an intrusion detection scheme with a novel neural network system. Labelling important properties of objects or data points and searching for commonalities allows the auto-mobile's AI to distinguish between a human, the street, another car, and the sky. The simulation evaluation is performed using the NS2 simulator and observes the security maintenance efficiency over the current security solutions. [ABSTRACT FROM AUTHOR]

As the demand for Internet access increases, malicious traffic on the Internet has soared also. In view of the fact that the existing malicious-traffic-identification methods suffer from low accuracy, this paper proposes a malicious-traffic-identification method based on contrastive learning. The proposed method is able to overcome the shortcomings of traditional methods that rely on labeled samples and is able to learn data feature representations carrying semantic information from unlabeled data, thus improving the model accuracy. In this paper, a new malicious traffic feature extraction model based on a Transformer is proposed. Employing a self-attention mechanism, the proposed feature extraction model can extract the bytes features of malicious traffic by performing calculations on the malicious traffic, thereby realizing the efficient identification of malicious traffic. In addition, a bidirectional GLSTM is introduced to extract the timing features of malicious traffic. The experimental results show that the proposed method is superior to the latest published methods in terms of accuracy and F1 score. [ABSTRACT FROM AUTHOR]

Traffic management is a critical task in software-defined IoT networks (SDN-IoTs) to efficiently manage network resources and ensure Quality of Service (QoS) for end-users. However, traditional traffic management approaches based on queuing theory or static policies may not be effective due to the dynamic and unpredictable nature of network traffic. In this paper, we propose a novel approach that leverages Graph Neural Networks (GNNs) and multi-arm bandit algorithms to dynamically optimize traffic management policies based on real-time network traffic patterns. Specifically, our approach uses a GNN model to learn and predict network traffic patterns and a multi-arm bandit algorithm to optimize traffic management policies based on these predictions. We evaluate the proposed approach on three different datasets, including a simulated corporate network (KDD Cup 1999), a collection of network traffic traces (CAIDA), and a simulated network environment with both normal and malicious traffic (NSL-KDD). The results demonstrate that our approach outperforms other state-of-the-art traffic management methods, achieving higher throughput, lower packet loss, and lower delay, while effectively detecting anomalous traffic patterns. The proposed approach offers a promising solution to traffic management in SDNs, enabling efficient resource management and QoS assurance. [ABSTRACT FROM AUTHOR]

In real-time and mission-critical applications of wireless sensor networks (WSNs), such as military, the location of monitored objects must only be informed by sensor nodes to the base station, remaining anonymous to the rest of the network. However, preserving source location privacy is a challenging task due to the open nature of WSNs. Several methods have been proposed to address this issue, including anonymity-based, obfuscation-based, and policy-based methods. Anonymity-based methods are unsuitable for protecting position privacy, obfuscation-based methods are unable to protect identity, and policy-based methods are appropriate for all location privacy categories but challenging for end-users to understand and manage. These methods take into account different assumptions about attackers, energy consumption, and other factors in WSNs such as transmission delay and fixed battery and memory. Prior research has focused on one or more aspects of WSNs while ignoring others. In this work, we propose a Dynamic Routing Approach For enhancing Source Location Privacy in WSNs (SLP-DRA) to preserve source location privacy by dynamically selecting a path and injecting fake messages into the network. The dynamic selection of a route for transmitting real messages from the source sensor node to the base station, in the presence of fake packets, successfully confuses the attacker about the exact location of the monitored object in the network. The simulated results are compared using commonly used performance metrics of WSNs such as energy usage, transmission delay, security, and network lifetime. The comparative results show that SLP-DRA enhances the security level in preserving source location privacy compared to other techniques without compromising network lifetime, transmission delay, or energy consumption. We validate that SLP-DRA is robust against commonly used attacks, such as hop-by-hop and backtracking attacks, in finding the source location in WSNs. [ABSTRACT FROM AUTHOR]

Artificial intelligence has been developed to be able to solve difficult problems that involve huge amounts of data and that require rapid decision-making in most branches of science and business. Machine learning is one of the most prominent areas of artificial intelligence, which has been used heavily in the last two decades in the field of network security, especially in Intrusion Detection Systems (IDS). Pattern recognition is a machine learning method applied in medical applications, image processing, and video processing. In this article, two layers' IDS is proposed. The first layer classifies the network connection according to the used service. Then, a minimum number of features that optimize the detection accuracy of malicious activities on that service are identified. Using those features, the second layer classifies each network connection as an attack or normal activity based on the pattern recognition method. In the training phase, two multivariate normal statistical models are created: the normal behavior model and the attack behavior model. In the testing and running phases, a maximum likelihood estimation function is used to classify a network connection into attack or normal activity using the two multivariate normal statistical models. The experimental results prove that the proposed IDS has superiority over related IDSs for network intrusion detection. Using only four features, it successfully achieves DR of 97.5%, 0.001 FAR, MCC 95.7%, and 99.8% overall accuracy. [ABSTRACT FROM AUTHOR]

The network traffic has observed astounding expansion and is set to explode in the next few years. Security attacks are becoming more and more synchronized as attackers are involved in using new orchestrated techniques that are capable of initiating attacks such as zero-day vector and slow loris. These attacks are surpassing the current network analytic solutions employed in the infrastructure of the network. Machine learning (ML) based approaches are successfully quelling modern-day attacks by analyzing the patterns in the encrypted network traffic. Detection strategies based on labelled datasets that are a combination of synthesized attacks and modern normal attacks became the need of the hour. In this study, three benchmark datasets; UNSWNB15, NSL- KDD, and BoT-Internet of things are a combination of modern-day orchestrated security attacks. The datasets are processed and feature selection is performed using information gain and correlation coefficient (Pearson). Once the features are identified they are subjected to the following classifiers; stacking of light gradient boosting machine (LGBM) and random forest, stochastic gradient descent, Gaussian Naive Bayes (GNB), support vector machine (SVM), bagging + reduced error pruning, K nearest neighbour and AdaBoost. Thus it has been observed that stacking of LGBM and random forest has given the highest predictions for all three datasets. [ABSTRACT FROM AUTHOR]

Wireless sensor networks are considered as the foundation of the Internet of Things. Inherent problems in wireless sensor networks such as power consumption, lack of flexibility, and disability in development and programming have led to serious challenges in these networks. Software-defined networking (SDN) is flexible with development and programming capabilities that decouple the control and data planes. The combination of wireless sensor networks and software-defined networks has created the idea of software-defined wireless sensor networks (SDWSNs). Security is considered as one of the most fundamental issues in any network. Due to their combinatorial nature, the software-defined wireless sensor networks faced a variety of security challenges for both wireless sensor networks and software-defined networks. This paper proposes a novel architecture with an unsupervised intrusion detection algorithm using a hierarchical approach to improve the security of integrated software-defined wireless sensor networks. In the proposed architecture, the sensors are not fully dependent on the SDWSN controller; instead, they run the appropriate intrusion detection algorithm module locally at the layer. The data analysis results in different zones, produced by clustering based on entropy and cumulative point similarity as criteria, are sent to the SDWSN controller, and decisions are made after the final check of data normality or abnormality. To examine the effectiveness of the proposed architecture and algorithm, the sensors were simulated on Cooja, WSN-DS and NSL-KDD standardized datasets. The results show that the proposed method is able to detect the abnormal traffic up to 97%. [ABSTRACT FROM AUTHOR]

High‐frequency systems (HF) are still used in many communication applications, especially at long distances, due to their robustness. Data can be sent for hundreds of kilometres at a low power cost with only one drawback, low bitrate. To increase the bitrate, several methods were reported using the single‐tone modulation with 24 kHz bandwidth, but still not practical in real‐time applications because, the 24 kHz is unavailable due to the instability of the ionosphere layer. Here, a structured method built on the non‐orthogonal multiple access technique (NOMA) is proposed to increase the bit rate per HF narrowband channel. To increase the data rate, two parts of the data are divided and sent to one user over two different power levels. Since the ionosphere conditions prohibit the use of single‐tone channels most of the time, spread narrowband channels are used instead. The NOMA technique is used on the receiver's side to recognize the two parts of data. The results show a significant improvement (up to 45%) using NOMA in narrowband 3 kHz channels. The bit rate at the receiver has increased up to 200 kb/s concerning, while the maximum bit rate recorded by conventional methods used in previous studies is 138 kb/s. Combined with multichannel algorithms such as HF XL, the total increase in bit rate can be considerable. The system is built on the SDR platform and tested in multiple channels, weather, and power conditions in real‐time experiments to validate its reliability. [ABSTRACT FROM AUTHOR]