Attack detection and fusion-based security state estimation in multi-sensor networks

In the detection process of server network storm attack, the traditional method takes the signal detection algorithm, because the attack number is large, the detection error is big.According to the problem, an improved server network storm attack detection method is proposed based on improved density clustering algorithm, the server network storm attack detection problem is transformed into a multi class classification problem, wrapper features selection model is taken, IDBC network connection record distance calculation method is combined, based on DBSCAN clustering results, the data clustering and attack detection is obtained.Simulation results show that, the improved density clustering algorithm is applied in detection of server network storm attack, it can reduce the detection error, the performance of the detection system is improved.

<para xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> In this paper, we address the problem of target tracking in a collaborative acoustic sensor network. To cope with the inherent characteristics and constraints of wireless sensor networks, we present a novel target-tracking algorithm with power-aware concerns. The underlying tracking methodology is described as a multiple-sensor tracking/fusion technique based on particle filtering. As discussed in the most recent literature, particle filtering is defined as an emerging Monte Carlo state estimation technique with proven superior performance in many target-tracking applications. More specifically, in our proposed method, each activated sensor transmits the received acoustic intensity and the direction of arrival (DOA) of the target to the sensor fusion center (a dedicated computing and storage platform, such as a microserver). The fusion center uses each received DOA to generate a set of estimations based on the state partition technique, as described later in this paper. In addition, a set of sensor weights is calculated based on the acoustic intensity received by each activated sensor. Next, the weighted sum of the estimates is used to generate the proposal distribution in the particle filter for sensor fusion. This technique renders a more accurate proposal distribution and, hence, yields more precise and robust estimations of the target using fewer samples than those of the traditional bootstrap filter. In addition, since the majority of the signal processing efficiently resides on the fusion center, the computation load at the sensor nodes is limited, which is desirable for power-aware systems. Last, the performance of the new tracking algorithm in various tracking scenarios is thoroughly studied and compared with standard tracking methods. As shown in the theory and demonstrated by our experimental results, the state-partition-based centralized particle filter reliably outperforms the traditional method in all experiments. </para>

The detection of computer network attacks is becoming increasingly important as the complexity of cyber-attacks threatening information systems and infrastructure continues to rise. To address these threats, artificial intelligence techniques have become a primary focus in the development of more effective attack detection systems. One algorithm that has proven reliable in this context is the C4.5 decision tree. This study aims to apply the C4.5 algorithm in network attack detection using a dataset that includes various types of attacks and network activities. The process includes data preprocessing, decision tree model building, and model performance evaluation. The results show that the C4.5 decision tree algorithm is effective in classifying network activities into attacks and normal activities with a satisfactory level of accuracy. The model successfully recognizes attack-related patterns, and further analysis identifies key factors influencing attack detection. This research provides a significant contribution to the development of reliable and efficient attack detection systems in computer networks. By applying the C4.5 decision tree algorithm, it is expected to help enhance information security and protect network infrastructure from increasingly complex cyber threats

The complexity of the Internet and the volume of network traffic have dramatically increased in the last few years, making it more challenging to design scalable Network Traffic Monitoring and Analysis (NTMA) systems. Critical NTMA applications such as the detection of network attacks and anomalies require fast mechanisms for on-line analysis of thousands of events per second, as well as efficient techniques for off-line analysis of massive historical data. The high-dimensionality of network data provided by current network monitoring systems opens the door to the massive application of machine learning approaches to improve the detection and classification of network attacks and anomalies, but this higher dimensionality comes with an extra data processing overhead. In this paper we present Big-DAMA, a big data analytics framework (BDAF) for NTMA applications. Big-DAMA is a flexible BDAF, capable to analyze and store big amounts of both structured and unstructured heterogeneous data sources, with both stream and batch processing capabilities. Big-DAMA uses off-the-shelf big data storage and processing engines to offer both stream data processing and batch processing capabilities, decomposing separate engines for stream, batch and query, following a Data Stream Warehouse (DSW) paradigm. Big-DAMA implements several algorithms for anomaly detection and network security using supervised and unsupervised machine learning (ML) models, using off-the-shelf ML libraries. We apply Big-DAMA to the detection of different types of network attacks and anomalies, benchmarking multiple supervised ML models. Evaluations are conducted on top of real network measurements collected at the WIDE backbone network, using the well-known MAWILab dataset for attacks labeling. Big-DAMA can speed up computations by a factor of 10 when compared to a standard Apache Spark cluster, and can be easily deployed in cloud environments, using hardware virtualization technology.

This paper focuses on the analysis of an optimal sensing and quantization strategy in a multi-sensor network where each individual sensor sends its quantized log-likelihood information to the fusion center (FC) for non-Bayesian quickest change detection. It is assumed that the sensors are equipped with a battery/energy storage device of finite capacity, capable of harvesting energy from the environment. The FC is assumed to have access to either non-causal or causal channel state information (CSI) and energy state information (ESI) from all the sensors while performing the quickest change detection. The primary observations are assumed to be generated from a sequence of random variables whose probability distribution function changes at an unknown time point. The objective of the detection problem is to minimize the average detection delay of the change point with respect to a lower bound on the rate of false alarm. In this framework, the optimal sensing decision and number of quantization bits for information transmission can be determined with the constraint of limited available energy due to finite battery capacity. This optimization is formulated as a stochastic control problem and is solved using dynamic programming algorithms for both non-causal and causal CSI and ESI scenario. A set of non-linear equations is also derived to determine the optimal quantization thresholds for the sensor log-likelihood ratios, by maximizing an appropriate Kullback-Leibler (KL) divergence measure between the distributions before and after the change. A uniform threshold quantization strategy is also proposed as a simple sub-optimal policy. The simulation results indicate that the optimal quantization is preferable when the number of quantization bits is low as its performance is significantly better compared to its uniform counterpart in terms of average detection delay. For the case of a large number of quantization bits, the performance benefits of using the optimal quantization as compared to its uniform counterpart diminish, as expected.

We consider the problem of estimating the state of a linear time-invariant Gaussian system using N sensors, where a subset of the sensors can potentially be compromised by an adversary. In this case, locating the compromised sensors is of crucial importance for obtaining an accurate state estimate. Inspired by the clustering algorithm in machine learning, we propose a Gaussianmixture-model-based (GMM-based) detection mechanism. It clusters the local state estimate autonomously and provides a belief for each sensor, based on which measurements from different sensors can be fused accordingly. When a subset of the sensors are under the optimal innovation-based deception attacks, we derive the remote estimation error covariance recursions under different detection mechanisms, e.g., distributed χ <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> false-data detector, centralized χ <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> false-data detector, and GMM-based detection algorithm. The performance of the proposed GMM-based detection algorithm is further evaluated through average belief in the same attack scenario. Moreover, we discuss applications of GMM-based detection algorithm on other attack scenarios, e.g., false-data injection attack, replay attack, and €-stealthy attack. Simulation examples are provided to demonstrate the developed results.

This work conceives the robust linear transceivers for the estimation of an unknown vector parameter in a coherent multiple access channel (MAC)-based multiple-input multiple-output (MIMO) multi-sensor network under imperfect channel state information (CSI) at the fusion center (FC). Both the popular stochastic (S-) and norm ball CSI uncertainty (N-CSIU) models are considered for robust design. The proposed techniques are based on two design criterion, the first being, minimizing the mean squared error (MSE) of the estimate at the FC subject to total network power or individual sensor power constraints. Second, minimizing the total power consumption in the network while meeting a predefined level of MSE performance. Furthermore, the framework for precoder and combiner optimization is based on results from majorization theory, which leads to non-iterative closed-form solutions for the transceivers. While the most general scenario with correlated parameters and arbitrary observation SNR is considered to begin with, scenarios with uncorrelated parameters and high observation SNR are also considered as special cases, which makes the analysis comprehensive. Simulation results are presented to demonstrate the efficacy of the proposed schemes.

In the process of research on the characteristic detection method for large scale network attacks, due to the use of the current algorithm for large-scale network attack detection, it is unable to describe the attack characteristics of network attacks or detect in low accuracy. Therefore, an attack detection method for large scale network based on cooperative planning is proposed. The method is based on collaborative planning to design the detection characteristic of large scale network attacks, which is transformed into a space search problem. The difference between the parameters of the flow vector and the normal vector of the normal network spatial data is extracted as characteristics, combining Gauss mixture model with the expectation maximization algorithm, to design Lorenz chaotic asynchronous tracking detection algorithm for modeling and detection of network data stream. The experimental simulation shows that the detection method of large scale network attack detection method has high accuracy and high efficiency. Currently, characteristic detection technology for network attack is based on ant colony algorithm, particle algorithm and the fuzzy algorithm for large-scale network. Among them, the commonly characteristic detection method is technology based on the fuzzy algorithm for large scale network attack. However the current algorithms with characteristic detection for network attack could not describe attack characteristics in detail, which lead to low accuracy. In view of the above defect, a method for large scale network attack detection based on cooperative planning is proposed. The method is represented for network attack with characteristic feature, which is transformed into a search problem in the space. To extract difference of parameter vector characteristic of network spatial data flow between to test network and normal network, with Gaussian mixture model and expectation maximization algorithm combined, Lorenz chaotic asynchronous detecting and tracking algorithm is designed to model and test the network data flow. The experimental simulation shows that the detection method for large scale network has high accuracy and efficiency.

This paper proposes and characterizes a sequential decision aggregation system consisting of agents performing binary sequential hypothesis testing and a fusion center which collects the individual decisions and reaches the global decision according to some threshold rule. Individual decision makers’ behaviors in the system are influenced by other decision makers, through a model for social pressure; our notion of social pressure is proportional to the ratio of individual decision makers who have already made the decisions. For our proposed model, we obtain the following results: First, we derive a recursive expression for the probabilities of making the correct and wrong global decisions as a function of time, system size, and the global decision threshold. The expression is based on the individual decision makers’ decision probabilities and does not rely on the specific individual decision-making policy. Second, we discuss two specific threshold rules: the fastest rule and the majority rule. By means of a mean-field analysis, we relate the asymptotic performance of the fusion center, as the system size tends to infinity, to the individual decision makers’ decision probability sequence. In addition to theoretical analysis, simulation work is conducted to discuss the speed/accuracy tradeoffs for different threshold rules.

We investigate the impact of Byzantine attacks in distributed detection under binary hypothesis testing. It is assumed that a fraction of the transmitted sensor measurements are compromised by the injected data from a Byzantine attacker, whose purpose is to confuse the decision maker at the fusion center. From the perspective of a Byzantine attacker, under the injection energy constraint, an optimization problem is formulated to maximize the asymptotic missed detection error probability, which is based on the Kullback-Leibler divergence. The properties of the optimal attack strategy are analyzed by convex optimization and parametric optimization methods. Based on the derived theoretic results, a coordinate descent algorithm is proposed to search the optimal attack solution. Simulation examples are provided to illustrate the effectiveness of the obtained attack strategy.

We consider the problem of soft decision fusion in a bandwidth-constrained wireless sensor network (WSN). The WSN is tasked with the detection of an intruder transmitting an unknown signal over a fading channel. A binary hypothesis testing is performed using the soft decision of the sensor nodes (SNs). Using the likelihood ratio test, the optimal soft fusion rule at the fusion center (FC) has been shown to be the weighted distance from the soft decision mean under the null hypothesis. But as the optimal rule requires a-priori knowledge that is difficult to attain in practice, suboptimal fusion rules are proposed that are realizable in practice. We show how the effect of quantizing the test statistic can be mitigated by increasing the number of SN samples, i.e., bandwidth can be traded off against increased latency. The optimal power and bit allocation for the WSN is also derived. Simulation results show that SNs with good channels are allocated more bits, while SNs with poor channels are censored.

Wireless sensor networks are prone to node misbehavior arising from tampering by an adversary (Byzantine attack), or due to other factors such as node failure resulting from hardware or software degradation. In this paper, we consider the problem of decentralized detection in wireless sensor networks in the presence of one or more classes of misbehaving nodes. Binary hypothesis testing is considered where the honest nodes transmit their binary decisions to the fusion center (FC), while the misbehaving nodes transmit fictitious messages. The goal of the FC is to identify the misbehaving nodes and to detect the state of nature. We identify each class of nodes with an operating point (false alarm and detection probabilities) on the receiver operating characteristic (ROC) curve. Maximum likelihood estimation of the nodes' operating points is then formulated and solved using the expectation maximization (EM) algorithm with the nodes' identities as latent variables. The solution from the EM algorithm is then used to classify the nodes and to solve the decentralized hypothesis testing problem. Numerical results compared with those from the reputation-based schemes show a significant improvement in both classification of the nodes and hypothesis testing results. We also discuss an inherent ambiguity in the node classification problem which can be resolved if the honest nodes are in majority.

The increasing use of intrusion detection systems and a relatively high false alarm rate can lead to a huge volume of alerts. This makes it very difficult for security administrators to analyze and detect network attacks. Our solution for this problem is to make the alerts machine understandable. We propose a novel way to convert the raw alerts into machine understandable uniform streams, correlate the streams, and extract the attack scenario knowledge. The modified case grammar principal-subordinate consequence tagging case grammar and the 2-atom alert semantic network are used to generate the attack scenario classes. Alert mutual information is also applied to calculate the alert semantic context window size. Based on the alert context, the attack scenario instances are extracted and the attack scenario descriptions are forwarded to the security administrator.

Attacks detection is an important issue in collaborative spectrum sensing (CSS) system of cognitive radio networks. Many approaches are proposed to cope with the malicious behaviour of attackers. In existing works, spectrum sensing data (SSD) received by the fusion centre is generally assumed to be integrated. However, in practical scenarios, the received SSD may be incomplete due to the imperfect reporting channel or specific CSS schemes. The performance of existing attacks detection approaches may degrade especially when the probability of missing data is large. To alleviate this challenge, the authors focus on pre‐processing of incomplete SSD and propose a practical imputation algorithm, which is derived from the maximum a posteriori probability criterion, to fill in the missing values. Simulation results indicate that the proposed algorithm restores the characteristics of the SSD, and mitigate the impacts of missing value on existing attacks detection algorithm effectively.

In smart grid systems, distribution networks and smart meters are more exposed to the public and therefore are at higher risk. Smart meters are the critical elements of smart grid system. Smart meters provide information such as energy usage, utilization pattern, user details to control centers at real time. Smart meters are more exposed to cyber-attacks due to heavy usage of communication devices and communication infrastructure in smart grid system. Researchers across the globe are working on the cyber security of smart meters and have proposed various models and algorithms for network observability, attack detection and prevention. This paper provides a review and analysis of the simulation results of recently proposed consumer attack model and grid sensor placement algorithm for detecting the attacks.