Application of Random Forest Model in Predictive Analysis of Network Security Big Data

The IEEE 802.11 wireless networks are organized either in infrastructure mode or ad-hoc mode. These wireless networks are very common, because of their portability and ease of access. In infrastructure mode of wireless networks, wireless clients have to be aware of the environments due to vulnerability and various types of attacks that can made by wireless intruders. Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA) security protocols are used to protect any wireless infrastructure against wireless intruders. The main problem of wireless network is to maintain the network security. Firewalls are not much capable to secure network from attacks because firewall can only detect the attacks which come from outside of the network. Therefore, Intrusion Detection System (IDS) plays an important role in network security. In general Intrusion Detection System (IDS) is used to detect unauthorized access, malicious access point and various types of wireless attacks in IEEE 802.11 infrastructure mode of wireless networks. Network based Wireless Intrusion Detection system (WIDS) is designed to detect Denial of Service (DOS) attack and Malicious Access Point (Evil Twin Attack) in Wi-Fi networks. Because DOS attack and Evil Twin Attack are the most significant attacks in IEEE 802.11 networks. In this work, a diverse detection algorithm is proposed to detect DOS attack and Evil Twin Attack which is based on number of deauthentication frames and beacon frames and some other fields. In this project, an experimental setup for wireless network infrastructure with one access point (AP) and three or four number of wireless clients are used to design Wireless Intrusion Detection System (WIDS). In that design, one client act as an attacker and another one client act as detector. In this work, Kali Linux based attack software tool is used to register wireless clients to launch attacks on the network. The set of commends are used to configure on the designed infrastructure wireless networks for testing the attacks and solutions

In this paper, we are going to evaluate various wireless network security related issues and how do they affect the quality of service of a wireless network and Mobile AdHoc Networks(MANETs). The time systems are increasingly required Getting educated more and more. Systems are simple Drastically converting the structure into more functional and dynamic. Computer networks have undergone a major move from cable to wireless A recent development has been networks and fast wireless infrastructure. MANET has appeared between many other cellular networks. Why? Why? dynamic topology without any centralization, conventional path MANETs do not comply with protocols and authentication systems. These MANETs are responsive to a lot of people It is not feasible in other networks to attack and participate in disruptive operations. A Wireless Network can be a very vulnerable entity and is always susceptible to various types of attacks and attackers, we are going to discuss a few of these attack and how do they affect the overall network performance, finally we are going to evaluate some of the solutions offered and how they improve the network.

Головною концепцією і предметом дослідження є виявлення різного типу обширних атак в інфраструктурі IoT, огляд представленої моделі, методів та існуючих передових систем виявлення вторгнень. Метою даної роботи є запропонування системи виявлення вторгнень в режимі реального часу, яка буде навчена на наборі з великим обсягом даних, за допомогою нейронної мережі з використанням ансамблевого методу машинного навчання. Предметом дослідження є огляд існуючих методів та моделей виявлення широкомасштабної атаки та запропонування власного рішення системи виявлення вторгнень, яка буде базуватися на методі виявлення аномалій та нейронної мережі. Висновок. Побудована система виявлення вторгнень, яка аналізує інтернет трафік, вилучає ознаки з пакету, обробляє їх та передбачує різні види атак, а також характеризує їх за типом. Загрозу безпеці можна вважати основною критичною проблемою для пристроїв IoT, тому використання таких систем зменшує ризики втрати даних.

The detection of computer network attacks is becoming increasingly important as the complexity of cyber-attacks threatening information systems and infrastructure continues to rise. To address these threats, artificial intelligence techniques have become a primary focus in the development of more effective attack detection systems. One algorithm that has proven reliable in this context is the C4.5 decision tree. This study aims to apply the C4.5 algorithm in network attack detection using a dataset that includes various types of attacks and network activities. The process includes data preprocessing, decision tree model building, and model performance evaluation. The results show that the C4.5 decision tree algorithm is effective in classifying network activities into attacks and normal activities with a satisfactory level of accuracy. The model successfully recognizes attack-related patterns, and further analysis identifies key factors influencing attack detection. This research provides a significant contribution to the development of reliable and efficient attack detection systems in computer networks. By applying the C4.5 decision tree algorithm, it is expected to help enhance information security and protect network infrastructure from increasingly complex cyber threats

Considering current network scenario hackers and intruders has become a big threat today. As new technologies are emerging fast, extensive use of these technologies and computers, what plays an important role is security. Most of the computers in network can be easily compromised with attacks. Big issue of concern is increase in new type of attack these days. Security to the sensitive data is very big threat to deal with, it need to consider as high priority issue which should be addressed immediately. Highly efficient Intrusion Detection Systems (IDS) are available now a days which detects various types of attacks on network. But we require the IDS which is intelligent enough to detect and analyze all type of new threats on the network. Maximum accuracy is expected by any of this intelligent intrusion detection system. An Intrusion Detection System can be hardware or software that analyze and monitors all activities of network to detect malicious activities happened inside the network. It also informs and helps administrator to deal with malicious packets, which if enters in network can harm more number of computers connected together. In our work we have implemented an intellectual IDS which helps administrator to analyze real time network traffic. IDS does it by classifying packets entering into the system as normal or malicious. This paper mainly focus on techniques used for feature selection to reduce number of features from KDD-99 dataset. This paper also explains algorithm used for classification i.e., Random Forest which works with forest of trees to classify real time packet as normal or malicious. Random forest makes use of ensembling techniques to give final output which is derived by combining output from number of trees used to create forest. Dataset which is used while performing experiments is KDD-99. This dataset is used to train all trees to get more accuracy with help of random forest. From results achieved we can observe that random forest algorithm gives more accuracy in distributed network with reduced false alarm rate.

Power monitoring network attack detection and defense can only target known types of attacks. This simple defense detection method cannot effectively defend against complex network attacks, so it is necessary to adopt the tracing technology of actively searching for the source of attacks. This paper discusses the electric power monitoring and control network attack, attack tracing method, and genetic algorithm. Based on applications traceability method for electric power monitoring and control network attack behavior of power monitoring data collection network and the genetic algorithm, parameter settings were described. Furthermore, the process of tracing the attack behavior of the power monitoring network based on multi-level data association and genetic algorithm is designed and discussed. The success rate of tracing the attack behavior of the power monitoring network is analyzed by four operators in the genetic algorithm. The experimental data show that the success rate of the four operators in tracing the source of the three kinds of attacks in the power monitoring network is more than 97% on average. Therefore, the method of tracing the attack behavior of the power monitoring network based on the genetic algorithm has high practical value.

Under the premise that big data, smart cities, mobile internet, cloud computing, and the Internet of Things have become the market for information ownership, cyber security threats are becoming more and more serious. Network attacks have begun to shift to the direction of stealing complex network attacks, and it is of great significance to study the prediction methods of stealing complex network attacks. The purpose of this article is to consider the security situational awareness of the theft-type complex network attack monitoring method for research. This paper introduces and divides the stages of the stealing complex network attack in detail, proposes an alarm algorithm based on the aggregation stage of redundant relationships and an algorithm based on the causal probability correlation attack stage, and illustrates the process of extracting attack scenarios. This article proposes and compares three network security situational awareness models and introduces in detail the two model structures of random forest and star. Experimental data shows that before optimization, the detection rates of Naive Bayes, Random Forest, and Neural Network are 75%, 80%, and 65%. After optimization, the detection rates of Naive Bayes, Random Forest and Neural Network are 96%, 90%, and 92%. This is because the original data has been effectively preprocessed after the first stage of situational awareness, so that the neural network model and the naive Bayesian structure model overcome the sensitivity to the shortcomings of the data set, resulting in a higher detection rate.

The Session Initiation Protocol (SIP) is a text‐based protocol, which defines the messaging between the SIP entities to establish, maintain, and terminate a multimedia session. Because of the text‐ and transaction‐based nature of the SIP protocol, it encounters various types of malformed message and resource depletion attacks. In this paper, we study the security concerns of the SIP‐based systems, and propose a feature set for it. Engineered features are derived from the SIP header fields in real time detecting the deviation of the input traffic from normal state. These features are built at three levels: packet, transaction, and dialog. The designed features can accurately detect the SIP known attacks. Moreover, because we successfully model the state machine of SIP during its normal behavior, we can also identify the unknown attacks. To study the effectiveness of the engineered feature set, we employ them in a sample one‐class support vector machine classifier. We evaluate the engineered features on three different datasets with various types of attack scenarios including resource depletion and authentication and brute force attacks. The impact of these attack scenarios on the designed features are shown in different test cases to demonstrate the effectiveness of our proposed feature set. Copyright © 2014 John Wiley & Sons, Ltd.

Network security is one of the most important research fields among information security techniques. Most problems of network security are often caused by network attacks. In order to ensure network secure running it is very necessary to analyze and research the procedure of network attacks. In this paper, the formal method is researched and automaton theory is used to describe the procedure of network attacks. The state transform diagrams of some typical network attacks are given. Different state transform diagrams are used to describe models for various network attacks and these models can be combined flexibly so as to describe complicated attack behaviors. This formal method for describing network attacks provides an effective approach for researching the mechanism of network attacks.

The article presents the results of developing an approach to detecting and protecting against network attacks on the corporate infrastructure deployed on the multi-cloud platform. The proposed approach is based on the combination of two technologies: a softwareconfigurable network and virtualization of network functions. The approach for searching for anomalous traffic is to use a hybrid neural network consisting of a self-organizing Kohonen network and a multilayer perceptron. The study of the work of the prototype of the system for detecting attacks, the method of forming a learning sample, and the course of experiments are described. The study showed that using the proposed approach makes it possible to increase the effectiveness of the obfuscation of various types of attacks and at the same time does not reduce the performance of the network

Graph Neural Networks (GNNs) have become a critical tool for learning on structured data, particularly for their ability to capture feature dependencies within multivariate datasets. This study investigates the application of Graph Convolutional Networks (GCNs) to improve classification performance on such data. We constructed a fully connected graph using cosine similarity to compare our GCN approach against standard dimensionality reduction techniques like PCA and t-SNE. In our tests, the GCN model clearly surpassed these baselines in accuracy, precision, recall, and F1-score.But the method has its own trade-offs: dense graphs are computationally costly, there are chances of overfitting on smaller datasets and the resulting embeddings may be uninterpretable. We cannot make such a claim of generality at this point because this review has only limited itself to one multivariate data set. In future endeavour we would wish to compare GCNs to more powerful classifiers, such as Random Forests, Deep Neural Networks, with greater regard to efficiency in training and resistance to noise. To summarize, this paper confirms that GNNs are an ideal option when it comes to multivariate classification, although scalability and interpretability have to be resolved in order to make it applicable in the real-life context.

The critical node detection for sequential attacks based on cascading failure model is an important way for analyzing network vulnerability, which has attracted the attention of many researchers in the field of complex network recently. However, most of the existing cascading critical node detection algorithms focus on designing effective attack strategies leading to the maximal damage to the network (i.e. attack effect), while ignoring the cost of attacks. To this end, we transform the cascading critical node detection for sequential attacks as a bi-objective optimization problem (named BCVNDSeq), where the attack cost and the attack effect are simultaneously optimized. In order to solve the transformed problem, we propose a multiobjective cascading critical node detection algorithm (named MO-BCVNDSeq), which can provide decision makers with a holistic view for analyzing the network vulnerability. In MO-BCVNDSeq, a local search strategy based on sequential matrix is proposed to accelerate the population convergence and an individual repairing strategy is also suggested to further improve the search efficiency. Finally, the experimental results on 6 real-world complex networks demonstrate the effectiveness of the proposed algorithm compared with several representative baselines.

Network robustness against attacks is one of the most fundamental researches in network science as it is closely associated with the reliability and functionality of various networking paradigms. However, despite the study on intrinsic topological vulnerabilities to node removals, little is known on the network robustness when network defense mechanisms are implemented, especially for networked engineering systems equipped with detection capabilities. In this paper, a sequential defense mechanism is first proposed in complex networks for attack inference and vulnerability assessment, where the data fusion center sequentially infers the presence of an attack based on the binary attack status reported from the nodes in the network. The network robustness is evaluated in terms of the ability to identify the attack prior to network disruption under two major attack schemes, i.e., random and intentional attacks. We provide a parametric plug-in model for performance evaluation on the proposed mechanism and validate its effectiveness and reliability via canonical complex network models and real-world large-scale network topology. The results show that the sequential defense mechanism greatly improves the network robustness and mitigates the possibility of network disruption by acquiring limited attack status information from a small subset of nodes in the network.

Detecting and identifying intrusions in a network is a challenging research area in the network security domain. Intrusion detection plays an essential role in computer network security since long. An Intrusion Detection System (IDS) is mainly used to detect an unauthorized access to a computer system or network. Moreover, it is capable to detect all types of malicious and harmful attacks in a network. The drawbacks of existing IDS are it can detect only the known attacks and it produces a large number of false alarms due to the unpredictable behavior of users and networks. It also requires extensive training sets in order to characterize the normal behavior of the nodes. In order to overcome these issues, an integration of Hidden Markov Model (HMM)–Relevance Vector Machine (RVM) algorithm namely, Probabilistic Relevance Classification (PRC) is proposed to detect intrusions in Supervisory Control and Data Acquisition (SCADA) network. Here, the power system attack dataset is used to detect the attacks in an SCADA network. In the preprocessing stage, the given data is preprocessed to segregate the relays as R1, R2, R3n and R4. Each relay contains the date, timestamp, control panel log report, relay log report, snort log report, marker, fault location, and load condition information. Then, the Boyer–Moore (BM) technique is employed to perform the string matching operation. After that, the PRC technique is implemented to classify the attack as known or unknown. The novelty of this paper is it manually trains the data and features for unknown attacks. The main intention of this work is to reduce the set of features, amount of database, and to increase the detection rate. The experimental results evaluate the performance in terms of False Acceptance Rate (FAR), False Rejection Rate (FRR), Genuine Acceptance Rate (GA), sensitivity, specificity, accuracy, error rate, and recall.

Most existing graph neural networks (GNNs) are proposed without considering the selection bias in data, i.e., the inconsistent distribution between the training set with the test set. In reality, the test data are not even available during the training process, making selection bias agnostic. Training GNNs with biased selected nodes leads to significant parameter estimation bias and greatly impacts the generalization ability on test nodes. In this article, we first present an experimental investigation, which clearly shows that the selection bias drastically hinders the generalization ability of GNNs, and theoretically proves that the selection bias will cause the biased estimation on GNN parameters. Then to remove the bias in GNN estimation, we propose a novel debiased GNNs (DGNN) with a differentiated decorrelation regularizer. The differentiated decorrelation regularizer estimates a sample weight for each labeled node such that the spurious correlation of learned embeddings could be eliminated. We analyze the regularizer in causal view and it motivates us to differentiate the weights of the variables based on their contribution to the confounding bias. Then, these sample weights are used for reweighting GNNs to eliminate the estimation bias, and thus, help to improve the stability of prediction on unknown test nodes. Comprehensive experiments are conducted on several challenging graph datasets with two kinds of label selection biases. The results well verify that our proposed model outperforms the state-of-the-art methods and DGNN is a flexible framework to enhance existing GNNs.