Bayesian Deep Learning for Probabilistic Risk Assessment and Attack Surface Reduction in CyberPhysical Systems

Anomaly based Intrusion Detection System (IDS) identifies intrusion by training itself to recognize acceptable behavior of the network. It then raises an alarm whenever any anomalous network behaviors outside the boundaries of its training sets are observed. However, anomaly based IDS are usually prone to high false positive rate due to difficulties involved in defining normal and abnormal network traffic patterns. In this paper, we employ two different statistical methods viz. Linear Discriminant Analysis (LDA) and Logistic Regression (LR) to develop new anomaly based IDS models. We then evaluate the performance of these IDS models on the benchmark NSL-KDD data set and analyze their performance against other IDS models based on Naive Bayes, C4.5 and Support Vector Machine (SVM). Experimental results show that the performance (Accuracy and Detection Rate) of both the LDA and the LR based models are at par and in some cases even better than other IDS models. Moreover, unlike the IDS model based on complex method like the SVM, the proposed LDA and LR based IDS models are computationally more efficient, which makes them more suited for deployment in real time network monitoring and intrusion detection analysis.

В статье представлено развитие сигнатурного подхода обнаружения вторжений на основе кластеризации и дерева решений. Также предложен оригинальный способ разработки аномального подхода к обнаружению вторжений, разработана модель функционирования гибридной системы обнаружения вторжений, отличающаяся от известных большей точностью обнаружения, меньшим процентом ложных тревог, приоритезацией сетевых пакетов для анализа, а также решающей основные недостатки аномального и сигнатурного подхода. Introduction: Alongside the development of the Internet, network security has become a crucial requirement. Bugs in software and operating systems result in an increasing number of previously unknown intrusions discovered every day. The harm caused by these intrusions is becoming more and more dangerous. Firewalls can't ensure a complete protection of the network, because they prevent external threats and don't maintain internal attacks. Intrusion detection systems (IDS) solve this problem. The aim of the research is to develop a model of a hybrid intrusion detection system that will use a combination of improved detection methods based on anomalous and signature approach to increase detection accuracy and reduce the level of false alarms. Tasks: development of an improvement for the signature detection method, development of a unique anomaly detection method, development of a unique hybrid model of the intrusion detection system. Methods. To improve the signature detection method, we used machine learning, in particular the C5 algorithm, as well as decision trees. In addition to this, there are presented: storing signature rules with their partial structure in the MongoDB database, the process of clustering rules, building and detecting with the use of a decision tree. There are presented a unique method for detecting anomalies in network traffic with the use of machine learning methods and the theory of finite automata. Besides, there are shown: the detection process with the use of the sliding window technique, machine learning and time automaton; storage of trained models in the MongoDB database, the process of loading anomalies into the signature database with the use of RabbitMQ. Findings. The hybrid IDS with increased detection accuracy and reduced false alarm rate was developed. The developed system was compared with the well-known open-source solutions Snort and Suricata. The signature detection method was improved with machine learning and decision trees, and a unique anomaly detection method that uses machine learning and a time automaton was presented. It allows to detect previously unknown attacks. The practical significance of the work is the partial implementation of the developed system for the Infologistik24 LLC company.

Malware authors are continuously developing crime toolkits. This has led to the situation of zero-day attacks, where malware harm computer systems despite the protection from existing Intrusion Detection Systems (IDSs). We propose an Intelligent Intrusion Detection and Prevention System (IIDPS) approach that combines the Signature based Intrusion Detection system (SIDS), Anomaly based Intrusion Detection System (AIDS) and Response Intrusion Detection System (RIDS). We used a risk assessment approach to determine an appropriate response action against each attack event. We also demonstrated the IIDPS make the detection and prevention of malware more effective.

The Internet of Things (IoT) has been rapidly evolving towards making a greater impact on everyday life to large industrial systems. Unfortunately, this has attracted the attention of cybercriminals who made IoT a target of malicious activities, opening the door to a possible attack to the end nodes. Due to the large number and diverse types of IoT devices, it is a challenging task to protect the IoT infrastructure using a traditional intrusion detection system. To protect IoT devices, a novel ensemble Hybrid Intrusion Detection System (HIDS) is proposed by combining a C5 classifier and One Class Support Vector Machine classifier. HIDS combines the advantages of Signature Intrusion Detection System (SIDS) and Anomaly-based Intrusion Detection System (AIDS). The aim of this framework is to detect both the well-known intrusions and zero-day attacks with high detection accuracy and low false-alarm rates. The proposed HIDS is evaluated using the Bot-IoT dataset, which includes legitimate IoT network traffic and several types of attacks. Experiments show that the proposed hybrid IDS provide higher detection rate and lower false positive rate compared to the SIDS and AIDS techniques.

Intrusion detection systems (IDS) are crucial components in a defense strategy for IoT networks, as such networks have applicability in safety-critical environments such as healthcare, manufacturing, and smart cities, to name but a few. A promising approach is to train IDS models using machine learning (ML) with data from previous attacks. Unfortunately, the models are only as good as the data provided in the training, and often access to realistic attack data is limited. In this paper we focus on Blackhole attacks in low-power and lossy IoT networks. Specifically, we study the impact of Blackhole attack variations on a ML-based IDS. We implemented the variation strategies in the Cooja network simulator, with the objective to create new data sets and to quantity the impact of an attack variation on the network and IDS model performance. Our initial results show that variations of the Blackhole attack have a negative impact on the performance of the IDS, and thus, paves the way forward for further research on how attack variations and corresponding data set complexity can improve the performance of an IDS.

Nowadays, Internet-driven culture securing computer networks in Higher Learning Institutions (HLIs) has become a major responsibility. Intrusion Detection Systems (IDS) are crucial for protecting networks from unauthorized activity and cyber threats. This paper examines the process of improving network security by creating a comprehensive IDS dataset using real traffic from HLIs, highlighting the importance of accurate and representative data in improving the system's ability to identify and mitigate future cyber-attacks. The IDS model was created using a variety of machine learning (ML) techniques. Metrics like accuracy, precision, recall, and F1-score were used to assess the performance of each model. The dataset used for training and testing was real-world network traffic data obtained from the institution's computer network. The results showed that the developed IDS obtained exceptional accuracy rates, with Random Forest, Gradient Boosting, and XGBoost models all achieving an accuracy of around 93%. Precision and recall values were likewise quite high across all algorithms. Furthermore, the study discovered that data quality has a substantial impact on IDS performance. Proper data preparation, feature engineering, and noise removal were found to be helpful in improving model accuracy and reducing false positives. While the IDS models performed well throughout validation and testing, implementing such systems in a production setting necessitates careful thought. As a result, the essay also examined the procedures for testing and deploying the IDS models in a real-world scenario. It underlined the significance of ongoing monitoring and maintenance in order to keep the model effective in identifying intrusions. The research aids in the progress of network security in HLI. Educational institutions can better protect their precious assets and sensitive information from cyberattacks by understanding the impact of data quality on IDS performance and implementing effective deployment techniques

One of the key challenges of the machine learning (ML) based intrusion detection system (IDS) is the expensive computation time which is largely caused by the redundant, incomplete, and unrelated features contain in the IDS datasets. To overcome such challenges and ensure building efficient and more accurate IDS models, many researchers utilize preprocessing techniques such as normalization and feature selection, and a hybrid modeling approach is typically used. In this work, we propose a hybrid IDS modeling approach with an algorithm for feature selection (FS) and another for building the IDS. The FS method is a wrapper-based FS with a decision tree as the feature evaluator. Five selected ML algorithms are individually used in combination with the proposed FS method to build five IDS models using the UNSW-NB15 dataset. As a baseline, five more IDS models are built, in a single modeling approach, using the full features of the datasets. We evaluate the effectiveness of our proposed method by comparing it with the baseline models and also with state-of-the-art works. Our method achieves the best DR of 97.95% and proved to be quite effective in comparison to state-of-the-art works. We, therefore, recommend its usage especially in IDS modeling with the UNSW-NB15 dataset.

The substantial growth of Internet-connected devices within the Internet of Things (IoT) has given rise to significant security challenges. Among the various threats confronting these interconnected devices, Denial of Service (DoS)/Distributed Denial of Service (DDoS) attacks emerge as significant concerns. The attacks, which seek to disrupt IoT services by flooding networks with unnecessary traffic, there is a critical need for robust security measures. Intrusion Detection Systems (IDS) are vital in identifying suspicious activities, yet many existing systems lack real-time capabilities to address evolving attack strategies. This study investigates the vulnerabilities of IoT networks and the pressing need to detect and classify DoS/DDoS attacks in real time. Traditional IDS, while effective in recognizing known attack patterns, fall short in identifying new attack types due to their reliance on historical data. To bridge this gap, this research focuses on developing an enhanced hybrid network intrusion detection and classification system. This study seeks to make contribution to the advancement of resilient security measures within IoT environments. The framework uses the Kth Nearest Neighbor (KNN) algorithm and dense neural networks to efficiently detect and categorize DoS/DDoS attacks in real time. To achieve this, a simulation model implementing the proposed hybrid algorithm will be developed. The framework utilized the MQTT-IoT-IDS2020 dataset, and a comparison was presented with recent approaches found in the literature. The results demonstrated enhanced performance in terms of true positive rate, accuracy, speed of detection.

Investigating the use of moving target defense (MTD) mechanisms in IoT networks is ongoing research, with unfathomable potential to equip IoT devices and networks with the ability to fend off cyber attacks despite the computational deficiencies many IoT ecosystems typically have. The AI community has extensively studied adversarial threats and attacks on machine learning-based systems, emphasizing the need to address the potential compromise of anomaly-based intrusion detection systems (IDS) through adversarial attacks. Another concept that has gained significant attention in the networking community is Game Theory. Protecting any given network is almost a never-ending battle between the attacker and defender, and hence a natural game of competitors can be modelled based on one’s parametric specifications to gain more insight into how attackers might interact with one’s system. The goal of this thesis is to propose a comprehensive, experimentally verifiable game-theoretic model of MTD in IoT networks to secure the IDS against adversarial attacks. Once a game with state transitions based on given actions can be modelled, reinforcement learning is used to develop policies based on various episodes (rounds) of the game, ultimately optimizing network decisions to minimize successful attacks on machine learning-based IDS. The state-of-the-art ToN-IoT dataset was investigated for MTD feasibility to implement the feature-based MTD approach. The overall performance of the proposed MTD-based IDS was compared to a conventional IDS by analyzing the accuracy curve of the MTD-based IDS and the conventional IDS for varying attacker success rates and resource demands. Our approach has proven effective in securing the IDS against adversarial learning.

Network security is one of the important issues that should be handled carefully and security to our data and important information is necessary when communicating with outside world over the internet. We have so many examples of the attacks that have been happened in the past and threatened a huge loss to the world. Over the years, a lot of work is done in this area and many security systems are developed, many security algorithms are implemented which have strong security fundamentals. Also, these systems have proven strong at the time of highly insecurity incidences or attacks. But, the problem is still there in identifying the malicious node entry in the network correctly without any false positives or false negatives, also within quick time before getting any type of access to the network by such malicious nodes which are also called as intruders. We need a system which should be operating faster even in heavy incoming network traffic scenarios, and generating correct identification of the intruders as well as giving easy, faster network access to non intruders or normal connecting nodes by correctly identifying them as normal nodes. In this research work, we are carrying out the implementation of the Intrusion detection System (IDS) model which performs faster as well as classifies the communicating nodes correctly as intruder or normal user. This IDS model is being implemented in two phases, hence a Two Phase Intrusion Detection System, abbreviated and named as TP-IDS model. We are using the machine learning techniques to develop this model, which makes this model a strongly secure IDS model and helping to better identify the known as well as unkown attack. We are using first phase for the identification and second phase for the validation of the first phase results of our model, which provides high accuracy. In first phase of the IDS we are using Support Vector Machine (SVM), k Nearest Neighbor (kNN) and in second phase we are using Decision Tree (DT), Naive Bayes (NB) for first phase validation. Also, the issue of efficiency is handled by underlying data processing infrastructure, which is HADOOP that increases efficiency or speed of the TP-IDS.

The rapid evolution of software-driven functionalities in modern vehicles has led to the availability of advanced driving assistance systems. In tandem with the above developments, the increasing number of sensors in vehicles to support such new features has led to a significant rise in the number of in-vehicle electronic control units (ECUs), network interfaces, and communication protocols. This growing complexity enhances vehicle performance, connectivity, and comfort applications. The increased connectivity to the outside world, however, introduces new securitychallenges. As automotive networks become more interconnected, they are exposed to a wider array of cyber threats that endanger the safety of passengers as well as threaten the loss of their personal and private information. This necessitates the inclusion of robust Intrusion Detection Systems (IDS) in vehicular networks to safeguard vehicle communications. Given the importance of the problem, multiple IDSs have been proposed in the research literature in the past 10 years. However, conventional IDS implementations often impose significant computational overhead, requiring additional ECUs and network elements that can contribute to increased system cost, complexity, and power consumption. In this thesis, the feasibility of consolidating intrusion detection capabilities within critical ECUs is explored to establish an efficient, embedded IDS architecture for modern automotive networks. By integrating IDS functionalities into hybrid ECU architectures, the aim is to mitigate the need for additional hardware peripherals utilised as IDSs while maintaining a robust approach to network security. This thesis focuses on the widely used Controller Area Network (CAN) protocol, which serves as the backbone of in-vehicle communication, enabling real-time and reliabledata exchange among ECUs. To enhance network security, approaches are proposed that integrate quantised machine learning-based IDS models as lightweight, isolated security modules within ECU hardware. This minimises disruptions to standard software tasks while ensuring efficient per-message handling for real-time detection. To evaluate the feasibility of this approach, three key aspects have been investigated: (1) whether IDS models can be lightweight enough for embedded deployment, (2) their generalisability across multiple datasets and unseen attack types, and (3)their ability to support per-message detection at line rates. The proposed IDS models are trained to detect a diverse range of cyber threats, including Denial-of-Service (DoS), Fuzzing, and Spoofing attacks, which pose significant risks to automotive networks. The experimental results demonstrate that the proposed IDSs achieve high detection accuracy across multiple attack vectors while maintaining low per-message processing latency and minimal energy consumption. This ensures compliance with the stringent constraints of real-time automotive environments, making embeddeddeployment of IDSs within a vehicle’s network both practical and efficient. By leveraging the consolidation of IDS capabilities within critical ECUs, my research contributes to the advancement of secure and resilient automotive network architectures, paving the way for enhanced cybersecurity in next-generation vehicles.

An intrusion detection system (IDS) attempts to identify attacks by comparing collected data to predefined signatures known to be malicious (signature-based IDS) or to a model of legal behaviour (anomaly-based IDS). Anomaly-based approaches have the advantage of being able to detect previously unknown attacks, but they suffer from the difficulty of building robust models of acceptable behaviour which may result in a large number of false alarms. Two reasons for the large number of false alarms, caused by incorrect classification of events in current systems, one is the simplistic aggregation of model outputs inthe decision phase. The other reason is the lack of integration of additional information into the decision process. To mitigate these shortcomings, this paper proposes a two stratum Bayesian networks based anomaly detection and decision model for intrusion detection system. Bayesian networks improve the aggregation of outputs, such as empirical data and allow one to seamlessly incorporate additional information. Experimental results clearly demonstrate the efficiency of our approach to improve the accuracy of the intrusion detection and decision process in an anomaly based IDS.

IDS (Intrusion Detection System) plays a vital role in network security in that it monitors system activities to identity unauthorized use, misuse or abuse of computer and network system. For the simulation of IDS a model has been constructed based on the DEVS (Discrete EVent system Specification) formalism. With this model we can simulate whether the intrusion detection, which is a core function of IDS, is effectively done under various different conditions. As intrusions become more sophisticated, it is beyond the scope of any one IDS to deal with them. Thus we placed multiple IDS agents in the network where the information helpful for detecting the intrusions is shared among these agents to cope effectively with attackers. Each agent cooperates through the BBA (Black Board Architecture) for detecting intrusions. If an agent detects intrusions, it transfers attacker's information to a Firewall. Using this mechanism attacker's packets detected by IDS can be prevented from damaging the network.

With the rapid development of computer network and applications, attacks are becoming more and more complicated and elusive. The traditional intrusion detection systems have been unable to meet new security requirements. This paper proposes a collaborative intrusion detection model based on multi-agents. In this model, four kinds of agents are defined, which are organized in a hierarchical structure. The basic agents in every host or at the entrances of subnets are responsible for performing the simple detection and response tasks. The complicated collaboration task is executed by some separate coordination agents, which are responsible for synthetically analyzing the suspicious behavior that the lower-level agents are unable to identify. Coordination agents are also able to assign the task to the lower-level associated agents. Based on the hierarchical structure, the formal description of the model is given. By adaptive policies and dynamic association among some elements, this model provides dynamic adaptability to the changing environment and attacks. In addition, this paper also proposes the concept of coordination domain which facilitates the management of collaborative detection. The model lays a theoretical foundation for constructing dynamically adaptive intrusion detection system.

We present a model and architecture that enhance anomaly based intrusion detection system(IDS) with threat-awareness capability. Anomaly based network IDS, profile network traffic to arrive base-line based on which it identifies anomalous events. However, due to dynamic changes in the threat level of a network, only a subset of these identified events are relevant to the network at any given instance. Hence, we introduce the notion of Threat-Awareness for anomaly based network IDS that periodically learns the changing threats in a network and enhance the capability of traditional anomaly based IDS to obtain network specific useful alarms. In this paper, we present a Threat-Aware Anomaly-Based IDS model for obtaining network-specific useful alarms. We also present our architecture and discuss its internal functions. Finally, we present our experiments based on various threat scenarios and the results obtained proves the efficiency of our model.