Attack characteristic detection for large scale network based on collaborative planning

In the detection process of server network storm attack, the traditional method takes the signal detection algorithm, because the attack number is large, the detection error is big.According to the problem, an improved server network storm attack detection method is proposed based on improved density clustering algorithm, the server network storm attack detection problem is transformed into a multi class classification problem, wrapper features selection model is taken, IDBC network connection record distance calculation method is combined, based on DBSCAN clustering results, the data clustering and attack detection is obtained.Simulation results show that, the improved density clustering algorithm is applied in detection of server network storm attack, it can reduce the detection error, the performance of the detection system is improved.

Analysis and Detection against Network Attacks in the Overlapping Phenomenon of Behavior Attribute

In view of all kinds of network attacks which may affect the network security of the smart grid system, an attack detection algorithm is proposed, feature extraction and training to the data such as server logs is carried out based on Hidden Markov model (HMM) to achieve the network attack detection in smart grid system. By the proposed algorithm, analysis on real data of the smart grid system in one power company is carried out, which can effectively identify common types and numbers of network attack types. Through the proposed smart grid network attack detection algorithm, network security risks in the smart grid system can be found, and the level of network security is improved.

Data-driven software defined network attack detection : State-of-the-art and perspectives

Conventional power network attack detection methods mainly use KKT (Karush Kuhn Tucker) Kuentak condition to filter the characteristics of hyperplane intrusion attacks, which is vulnerable to the effect of missing sample category identification, resulting in poor detection performance indicators. Therefore, a power system network attack detection method based on a convolutional gated recurrent neural network is proposed. That is, the convolutional gated recurrent neural network is used to extract the characteristics of network attack detection in the power system, and a hybrid detection model of network attack in the power system is constructed, thus completing the network attack detection in the power system. The experimental results show that the detection performance indicators of the designed power system network attack detection method are all good, reliable, and have certain application values. It has made certain contributions to improving the security of power system operations and reducing the risk of network intrusion.

Network forensics is addressed to deal with cybercrime. The main purpose of a network forensics system is reconstructing evidences of network attacks. In order to reconstruct evidence, the network attack is firstly identified. Therefore, network attack detection solutions play an important role in network forensics. There are two main types of network attacks: network level and application level. Network level attack detection solutions focus on the information in the headers of network packets. While, application level attack detection solutions investigate the data fragments carried out in the packet payloads. We propose an approach based on Shannon entropy and machine learning techniques to identify executable content for anomaly-based network attack detection in network forensics systems. Experimental results show that the proposed approach provides very high detection rate.

Aiming at a large number of useless signaling messages generated by Session Initiation Protocol (SIP) in IP networks, the problem of SIP flooding attacks caused by normal call requests cannot be established by users, and a SIP flooding attack detection method based on convolutional neural network is proposed. This method uses a window to perform convolution calculation on the input data, and judges whether there is a SIP message flood attack in the network based on the result of the calculation. Experimental results show that the proposed method can effectively detect SIP flooding attacks in IMS networks.

The microgrid central controller (MGCC) integrates the functions of control, monitoring, and communication in microgrid system, and has powerful capabilities of information collection and data processing. However, with the development of microgrid system worldwide, the information security management capabilities of the MGCC are poor, If information / network attacks cannot be actively detected and identified, it will easily reduce the reliability of the microgird system operation. Attackers can use abnormal information or use the MGCC as a springboard to further attack the upper-layer system. Aiming at the above problems, this paper presents an attack detection method based on convolutional neural network, and a detailed design process of attack detection model of the MGCC is proposed. In the attack detection method, the important data streams in the MGCC are used as the input of the convolutional neural network model, then the convolutional neural network model detects or classifies these data streams, finally, intercept the data flow with attack behavior and give a warning prompt, and forward data without attack behaviors normally.

The traditional Expectation-Maximization (EM) training of Gaussian Mixture Model (GMM) is essentially a batch mode procedure which requires the multiple data samples with the sufficient size to update the model parameters. This severely limits the deployment and adaptation of GMM in many real-time online systems since the newly observed data samples are expected to be incorporated into the system upon available via retraining the model. This paper presents a new online incremental EM training procedure of GMM, which aims to perform the EM training incrementally and so can adapt GMM online sample by sample. The proposed method is extended on two kinds of EM algorithms for GMM, namely, Split-and-Merge EM and the traditional EM. Experiments on both the synthetic data and a speech processing task show the advantages and efficiency of the new method.

Network Security Intrusion Detection Methods Combining Optimization Algorithms and Neural Networks

During recent years, there has been widespread adoption of the Internet and swift digitization within various sectors, including smart homes. These also led to the rapid growth of the Internet of Things (IoT), which is expected to proliferate further, where 50 billion IoT devices are estimated to be connected to the Internet by 2030. However, the growth in connected IoT devices to the Internet has not been without challenges. IoT devices are known to have various vulnerabilities that could be exploited by attackers, thus hindering security of devices and users. Recently, the use of Mirai malware by attackers gained significant attention as it has the capability to transform IoT connected devices into remotely controlled bots, which can be utilized as part of a botnet in large-scale network attacks. Taking cognizance of the importance to secure against this type of malware, this study presents a taxonomy review on the techniques that can potentially be used to detect Mirai malware along with countermeasures for securing against such malware.

Cross-domain network attack detection enabled by heterogeneous transfer learning

The high proportion abnormal data in photovoltaic power generation output has the characteristics of overlapping and multi Gaussian distribution. How to accurately remove the high proportion abnormal data in photovoltaic power generation output is a key issue in achieving accurate prediction of photovoltaic power. The article analyzes the characteristics of high proportion abnormal data in photovoltaic power generation output, and studies a detection method for high proportion abnormal data in photovoltaic power generation output based on Gaussian mixture model. We have established an algorithm model for the Gaussian mixture model, using the Expectation Maximization (EM) algorithm to estimate the parameters of the Gaussian mixture model, and using the algorithm model to detect and eliminate high proportion abnormal data in photovoltaic power generation output. Actual case analysis and comparative experiments show that the method proposed in the article can accurately detect high proportion abnormal data from multiple classifications, making it more suitable for detecting high proportion abnormal data in photovoltaic power generation output compared to traditional abnormal data detection methods.

This manifesto is the result of the Perspective Workshop Network Attack Detection and Defense held in Schloss Dagstuhl (Germany) from March 2nd – 6th, 2008. The participants of the workshop represent researchers from Austria, France, Norway, the Switzerland, the United States, and Germany who work actively in the field of intrusion detection and network monitoring. The workshop attendee’s opinion was that intrusion detection and flow analysis, which have been developed as complementary approaches for the detection of network attacks, should more strongly combine event detection and correlation techniques to better meet future challenges in future reactive security. The workshop participants considered various perspectives to envision future network attack detection and defense. The following topics are seen as important in the future: the development of early warning systems, the introduction of situation awareness, the improvement of measurement technology, taxonomy of attacks, the application of intrusion and fraud detection for web services, and anomaly detection. In order to realize those visions the state of the art, the challenges, and research priorities were identified for each topic by working groups. The outcome of the discussion is summarized in working group papers which are published in the workshop proceedings. The papers were compiled by the editors to this manifesto.

In the process of the detection method of network attacks in campus network, with current algorithm, there are defects such as high demand for data and low detection rate for model. Therefore, a network attack detection method based on improved Hidden Markov Model algorithm is proposed. Structure and characteristics of the campus network is firstly analyzed. Based on the hidden Markov model, the learning of the normal school network behavior sample is then established. On this basis, the information entropy of information theory is introduced to measure the degree of dispersion of source IP addresses. According to the change of the initial stage of Hurst index and entropy threshold is adaptive set to detect the attacks so as to complete attack behavior detection. The experimental results show that the detection method based on the improved hidden Markov model has high accuracy and robustness.