Моделирование идентификации профиля кибератак на основе анализа поведения устройств в сети провайдера телекоммуникационных услуг

Intrusion detection system(IDS) is one of the most powerful security devices in order to monitor cyber threats happening on the network. Since IDS raises an extremely large number of alerts (hereafter refered to as 'security events'), security experts are unable to analyze all of them in real time. To make matters worse, most of IDS provide only text-based information for the security events. In order to cope with this limitation, many approaches have been proposed on visualizing the security events. Since the existing visualization approaches focus on only a single organization, in many cases, they are not suitable for a centralized security operation center (CSOC) which is in charging of monitoring many organizations. In this paper, we propose a novel visualization VISualization system for finding out Network based Underneath attacks (VISNU) which can help security experts of the CSOC to analyze the security events more effectively. To this end, the VISNU classifies the security events according to each organization and displays them based on both real time and accumulated information such as the appreance patterns and their history, etc. The experimental results demonstrated that it is very useful for finding out an abnormal activites from the security events and provides better understandings and insights for analyzing them.

One of the major shares of the current security infrastructure is formed by the Intrusion Detection Systems (IDS). The attack launched towards the security systems are increasing in a rapid way. The sophistication of attack methods with more automated tools enables the attackers to gain control over the systems and produce threats to the information assets. The normal way of detecting the attacks is by using tools that produce alerts to the system administrators. But most of the attacks would normally escape from these tools since they are mostly rule-based. So the need for enhanced attack detection methods becomes vital for the security infrastructure. The attack detection methods are normally statistical based or probabilistic based. This paper focuses on attack detection using multiple learning based classifiers such as J48, Naïve Bayes, Random Forest, Random Tree, KStar, RotationForest, RandomSubspace, Ordinal Class Classifier, Data Near BalancedND and Multiclass classifier. Correlation Based Feature Selection (CFS) is also used to select the best features of the kddcup 99 dataset for the attack classes such as DoS, Probe, U2R and R2L. The feature selection enables the classifiers to improve the accuracy of classification. The multiple classifiers are used in four layers for detecting the four types of attack classes. The classification rate of above 99% is obtained. Cost - Benefit analysis is done for the various attack detection methods and the ROC curves are also plotted.

Attack-aware Security Function Management

Improvement of attack detection performance on the internet of things with PSO-search and random forest

— In the modern computer world, use of the internet is increasing day by day. However, the increasing use of the internet creates some security issues. These days, such new type of security attacks occurs every day and it is not easy to detect and prevent those attacks effectively. One common method of attack involves sending large amount of request to site or server and server will be unable to handle such huge requests and site will be offline for many days. This type of attack is called distributed denial of service (DDOS) attack, which act as a major security threat to internet services and most critical attack for cyber security world. Detection and prevention of Distributed Denial of Service Attack (DDoS) becomes a crucial process for the commercial organizations that uses the internet. Different approaches have been adapted to process traffic information collected by monitoring stations (Routers and Servers) to distinguish malicious traffic such as DDoS attack from normal traffic in Intrusion Detection Systems (IDS). In general, Machine learning techniques can be designed and implemented with the intrusion systems to protect the organizations from malicious traffic. Specifically, supervised clustering techniques allow to effectively distinguishing the normal traffic from malicious traffic with good accuracy. In this paper, machine learning algorithms are used to detect DDoS attacks collected from “KDD cup 99 Dataset”, pre- processing and feature selection technique is used on the dataset to enhance the performance of the classifiers and reduce the detection time. The classification algorithms such as C4.5 decision tree and Navie Bayes is applied on the training dataset and the implementation of the algorithm is done using spyder tool. The performance comparison of algorithms is shown using confusion matrix and it is found that C4.5 decision is more efficient in detection of DDOS attack. The proposed method can be used as DDoS defense system.

Intrusion Detection System (IDS) has been a challenging area to be developed in recent years since there are so many kinds of network attacks that are difficult to be classified by system. Moreover, there is always the possibility of the upcoming new attack. Therefore, Intrusion detection system must be improved by new classifiers to obtain the best results not only for classifying attack but also recognizing a new type of attack in an advanced way. These developments will be beneficial for managing security systems in an upcoming era. There are several classifier algorithms for Intrusion Detection System such as Support Vector Machine (SVM) and Fuzzy Kernel C-Means (FKCM). SVM classifier is known as one of the techniques to improve efficiency in attack detection while FKCM is famous because it provides better results to reduce the number of selected data features. Each of classifiers is using kernel trick to improve the classifying matter. In this study, we will compare proposed model which are FKCM with rbf, FKCM with polynomial kernel, SVM with rbf, and SVM with polynomial kernel to find a better result that could increase the accuracy of classifying network attacks. KDD Cup 1999 will be used to evaluate each model. In this study, the use of SVM with polynomial kernel brings the best result with 100 % accuracy can be obtained in 1.9 second.

At present, APT attack detection has become the focus of the network security protection field. APT attacks are one of the most difficult attacks in cyber attacks. The complexity and variability of APT attack behavior greatly increases the difficulty of attack detection. In order to cope with APT attack, some well-known network security companies at home and abroad have developed a commercial APT intrusion detection system. This highly targeted attack can not be identified by the traditional intrusion detection system. Therefore, in order to deal with this new type of cyber attack. The paper proposes a new method to detect APT attack from different organizations. Data mining algorithm is used to analyze every organization’s APT network attack behavior and obtain association rules, so as to customize the design of the Snort rules and apply them to intrusion detection system. Experiments have shown that the evaluation index of the intrusion detection system using the extended Snort rule is significantly better than the traditional Snort intrusion detection system when detecting the same test data. The precision of the extended Snort intrusion detection system is as high as 98.3%, and the false alarm rate is almost 0, which ultimately achieves the purpose of APT detection.

Головною концепцією і предметом дослідження є виявлення різного типу обширних атак в інфраструктурі IoT, огляд представленої моделі, методів та існуючих передових систем виявлення вторгнень. Метою даної роботи є запропонування системи виявлення вторгнень в режимі реального часу, яка буде навчена на наборі з великим обсягом даних, за допомогою нейронної мережі з використанням ансамблевого методу машинного навчання. Предметом дослідження є огляд існуючих методів та моделей виявлення широкомасштабної атаки та запропонування власного рішення системи виявлення вторгнень, яка буде базуватися на методі виявлення аномалій та нейронної мережі. Висновок. Побудована система виявлення вторгнень, яка аналізує інтернет трафік, вилучає ознаки з пакету, обробляє їх та передбачує різні види атак, а також характеризує їх за типом. Загрозу безпеці можна вважати основною критичною проблемою для пристроїв IoT, тому використання таких систем зменшує ризики втрати даних.

Wireless sensor networks (WSNs) are gaining more and more interest in the research community due to their unique characteristics and have a lots of interesting applications. Besides energy consumption security of WSN is being a critical issue nowadays. This is because WSNs are easily effected by various types of attacks and node compromises so they require security mechanisms to defend against them. An intrusion detection system (IDS) is one such solution to the problem. There are many research works focused in the area of signature based anomaly based IDS. Based on these malicious activities there is a need of addressing a new or modified versions of IDS algorithm. The proposed algorithm, abbreviated as AD(anomaly detection) algorithm has dedicated procedures for secure cluster formation, periodic re-clustering, and efficient cluster member monitoring and then the detection of different attacks. The performance of AD algorithm in identifying and detecting intrusions using a rule-based anomaly detection scheme is studied via simulations.

The intrusion detection system (IDS) deals with huge amount of data which contains irrelevant and redundant features causing slow training and testing process, higher resource consumption as well as poor detection rate. To overcome these limitations, we introduce the concept of lightweight IDS. The lightweight IDSs are small, powerful, and flexible enough to be used as permanent elements of the network security infrastructure. In this paper, we propose a novel concept for building lightweight IDS based on two different approaches. The first approach is using a features selection approach by applying fuzzy enhanced support vector decision function (Fuzzy ESVDF) algorithm. This approach is able to improve system efficiency. The second approach is using IDS classification scheme. The IDS classification scheme divides the detection process into four types according to the TCP/IP network model (application layer IDS, transport layer IDS, network layer IDS, and link layer IDS). This IDS classification scheme enhances an organizationpsilas ability to detect most types of attack (improving system accuracy and generality). Also, it improves IDS scalability and extendibility. To design the proposed system, several experiments have been conducted, and they indicate that the proposed lightweight IDS can deliver satisfactory system performance.

Review on intrusion detection using feature selection with machine learning techniques

The IEEE 802.11 wireless networks are organized either in infrastructure mode or ad-hoc mode. These wireless networks are very common, because of their portability and ease of access. In infrastructure mode of wireless networks, wireless clients have to be aware of the environments due to vulnerability and various types of attacks that can made by wireless intruders. Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) security protocols are used to protect any wireless infrastructure against wireless intruders. The main problem of wireless network is to maintain the network security. Firewalls are not much capable to secure network from attacks because firewall can only detect the attacks which come from outside of the network. Therefore, Intrusion Detection System (IDS) plays an important role in network security. In general Intrusion Detection System (IDS) is used to detect unauthorized access, malicious access point and various types of wireless attacks in IEEE 802.11 infrastructure mode of wireless networks. Network based Wireless Intrusion Detection system (WIDS) is designed to detect Denial of Service (DOS) attack and Malicious Access Point (Evil Twin Attack) in Wi-Fi networks. Because DOS attack and Evil Twin Attack are the most significant attacks in IEEE 802.11 networks. In this work, a diverse detection algorithm is proposed to detect DOS attack and Evil Twin Attack which is based on number of deauthentication frames and beacon frames and some other fields. In this project, an experimental setup for wireless network infrastructure with one access point (AP) and three or four number of wireless clients are used to design Wireless Intrusion Detection System (WIDS). In that design, one client act as an attacker and another one client act as detector. In this work, Kali Linux based attack software tool is used to register wireless clients to launch attacks on the network. The set of commends are used to configure on the designed infrastructure wireless networks for testing the attacks and solutions

With the fast development of 5G networks, the need to ensure that these networks are secured against cyber threats, which are advanced and constantly evolving, is of immense importance. In this paper, an intrusion detection system based on deep learning using a hybrid Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) architecture is introduced to meet the security requirements of 5G wireless networks. The model also showed high accuracy, precision, and recall when training and testing on various publicly available datasets (CICIDS 2017 and NSL-KDD) by identifying different types of attacks, namely Distributed Denial of Service (DDoS), SQL Injection, and Advanced Persistent Threats (APT). Findings reveal that the CNN-LSTM model performs better compared to standard machine learning models such as Support Vector Machines (SVM) and Decision Tree, scoring high with regard to detection abilities and optimizing computing requirements. The model is an effective intrusion detection method in real-time despite training time and latency issues, it is a very useful solution to the fast-developing intrusion detection scenario involving the dynamic 5G network. The study offers an insight into the possibility of deep learning methods in boosting cybersecurity in 5G networks and lays the foundation for newer advances in network security systems. Keywords: 5G Networks, Intrusion Detection System (Ids), Deep Learning, Cnn, Lstm, Hybrid Model, Cybersecurity, Real-Time Detection, Network Security, Machine Learning, Ddos, Apt, Attack Detection.

Cloud computing has gained an extreme importance nowadays. Every organization is getting attracted toward the Cloud computing due to its attractive features like cost saving, adaptability, etc. Although it offers the attractive features but still Cloud threats need great consideration. The insider threat is critically challenging in the Cloud-based environments. In order to mitigate from insider attacks in Clouds, the use of Intrusion detection system (IDS) is quite challenging. Every type of IDS has different methods of attack detection. So, single IDS cannot guarantee the protection from all types of attacks. Thus, in this paper, we have studied the various types of IDS and their features which made them either suitable or unsuitable for cloud computing. Also on the basis of review, required features for the Cloud-based IDS are identified.

Security aspects in IPv6 networks – implementation and testing