Dynamic Latency Sensitivity Recognition: An Application to Energy Saving

This paper proposes an adaptive on-line intrusion detection model based on incremental rule learning. This model can make self-learning over the ever-emerged new network behavior examples and dynamically modify behavior profile of the model, which overcomes the disadvantage that the traditional static detecting model must relearn over all the old and new examples, even can't relearn because of limited memory size. The experiment results validate the feasibility and effectivity of the presented adaptive intrusion detection model.

This paper proposes anatomy and main functionalities of a distributed framework for supporting adaptive ensemble-based intrusion detection. We start from open issues and limitations of actual state-of-the-art proposals, and we derive a suitable architecture that, based on actual, emerging research trends, finally defines an innovative ensemble-based network intrusion detection system that combines following requirements: distribution, cooperativeness, scalability, multi-scale network traffic analysis, feature selection and extraction. These requirements are recognized by our study as first-class research challenges for next-generation intrusion detection systems.

Aiming at the shortcomings of current intrusion detection, a SOM neural network method based on clustering and network level is proposed in this paper. Through the identification of easy-to-use network intrusion type, the network intrusion data is cleaned and analyzed in a targeted manner and the multi-layer adaptive network intrusion detection clustering model is established. Network intrusion detection clustering result based on this model is compared with result based on other methods. The results show that this model has higher accuracy and equilibrium and the validity and feasibility of the method is further verified.

Characterizing network flows is essential for security operators to enhance their awareness about cyber-threats targeting their networks. The automation of network flow characterization with machine learning has received much attention in recent years. To this aim, raw network flows need to be transformed into structured and exploitable data. In this research work, we propose a method to encode raw network flows into robust latent representations exploitable in downstream tasks. First, raw network flows are transformed into graph-structured objects capturing their topological aspects (packet-wise transitional patterns) and features (used protocols, packets’ flags, etc.). Then, using self-supervised learning techniques like Graph Auto-Encoders and Anonymous Walk Embeddings, each network flow graph is encoded into a latent representation that encapsulates both the structure of the graph and the features of its nodes, while minimizing information loss. This results in semantically-rich and robust representation vectors which can be manipulated by machine learning algorithms to perform downstream network-related tasks. To evaluate our network flow embedding models, we use probing flows captured with two /20 network telescopes and labeled using reports originating from different sources. The experimental results show that the proposed network flow embedding method allows for reliable darknet probing activity classification. Furthermore, a comparison between our self-supervised approach and a fully-supervised graph convolutional network shows that, in situations with limited labeled data, the downstream classification model that uses the derived latent representations as inputs outperforms the fully-supervised graph convolutional network. There are many applications of this research work in cybersecurity, such as network flow clustering, attack detection and prediction, malware detection, vulnerability exploit analysis, and inference of attacker’s intentions.

Component reuse has become a trend in software engineering. However, third-party components have the potential to introduce vulnerabilities into software applications and become the weakest link in the security chain. In this paper, we discuss the limitations of traditional security practices and controls against vulnerable components. As a solution, we present a software design and development approach, combined with a collaborative, cloud-based vulnerability and threat management system. This combination aims at enabling applications to gain “artificial immunity” to third-party components by dynamically identifying and controlling related security risks. It also strives to promote the automatic discovery of, and near real-time information dissemination about emerging threats and zero-day vulnerabilities. At the heart of our solution, we use application-level API sandboxing, as well as adaptive signature-based and anomaly-based API intrusion detection and prevention. The need-to-know, cost-effectiveness, and user acceptance through separation of concerns have been our guiding security engineering principles.

The combination of Machine Learning (ML) with Network Intrusion Detection Systems (NIDS) can be considered a revolutionary step that took place in the sphere of network security especially when implemented in cloud environment. The present research study focuses on the CIML-IDS that the author has personally developed as a machine learning-based IDS for large cloud networks to identify security threats in real-time. CIML-IDS is highly efficient in terms of detecting existing as well as unknown patterns of intrusion using Random Forest, Gradient Boosting, and Deep Neural Networks. But with the cloud deployment, resource utilization and its ability to operate under different loads and across distributed domains is made possible. The design of the proposed CIML-IDS includes feature extraction as a prerequisite for real-time anomalous activity detection, which increases the system's adaptability. Moreover, principles of the secure cloud computing enhance the integrity and the confidentiality of data, States that may act as the drawbacks of the cloud infrastructure. Efficient empirical tests carried out on the benchmark datasets corroborate the high detection rates of CIML-IDS and low false positive observations. The studies summarize the possibility of improving the usage of ML-based NIDS in enhancing the cloud network security and creating a robust defence system against novel threats.

Predominant network intrusion detection systems (NIDS) aim to identify malicious traffic patterns based on a handcrafted dataset of rules. Recently, the application of machine learning in NIDS helps alleviate the enormous effort of human observation. Federated learning (FL) is a collaborative learning scheme concerning distributed data. Instead of sharing raw data, it allows a participant to share only a trained local model. Despite the success of existing FL solutions, in NIDS, a network’s traffic data distribution does not always fit into the single global model of FL; some networks have similarities with each other but other networks do not. We propose Segmented-Federated Learning (Segmented-FL), where by employing periodic local model evaluation and network segmentation, we aim to bring similar network environments to the same group. A comparison between FL and our method was conducted against a range of metrics including the weighted precision, recall, and F1 score, using a collected dataset from 20 massively distributed networks within 60 days. By studying the optimized hyperparameters of Segmented-FL and employing three evaluation methods, it shows that Segmented-FL has better performance in all three types of intrusion detection tasks, achieving validation weighted F1 scores of 0.964, 0.803, and 0.912 with Method A, Method B, and Method C respectively. For each method, this scheme shows a gain of 0.1%, 4.0% and 1.1% in performance compared with FL.

The Internet of Things (IoT) has become an integral part of everyday life, and plays a significant role in various sectors by enabling device-to-device communication without human intervention. However, the constant connectivity of these devices to the Internet exposes them to numerous cyberattacks, potentially leading to data breaches, device malfunctions, and unauthorized network access. The diverse range of threats targeting IoT systems highlights the need for robust security solutions, such as machine learning-based intrusion detection systems, which have attracted growing research interest. This study proposes a novel adaptive approach for intrusion detection in IoT environments by combining batch and incremental learning models. Our work overcomes the limitations of traditional machine learning-based intrusion detection methods, emphasizing the potential of incremental learning to develop more effective and resilient solutions. Unlike most existing approaches that rely solely on batch learning and lack adaptability to integrate new data for long-term security, our method offers a more flexible alternative. Specifically, we leverage the predictive power of LightGBM in batch mode to improve the performance of a Passive-Aggressive classifier as a meta-learner in incremental mode. This dual learning approach aims to enhance intrusion detection in two key ways: effectively capturing diverse attack patterns with batch learning and adapting to emerging attack patterns with incremental learning. Experiments conducted on the CICIoT2023 dataset demonstrate that the proposed approach successfully balances performance and adaptability. It maintains accurate detection capabilities across various classification tasks while remaining responsive to evolving attack patterns.

The recent rise in both the frequency and sophistication of cyberattacks in particular, those directed towards distributed and resource constrained, cyber physical environments justifies the need for timely, effective, and adaptive intrusion detection in IoT networks, particularly for lightweight, efficient IoT edge implementations. The work presented in this paper addresses the design of a lightweight, feature efficient intrusion detection system using the XGBoost machine learning algorithm. A classification model was trained on both signal and statistical based subsets of features extracted from a dataset, where the model learned to classify the network traffic data as either benign or malicious. A key aspect of the comparison was to separate the performance of the XGBoost model from the performance of ConvNeXT, which seemed to use an image-based approach to represent the network traffic. Results show that the XGBoost model was both accurate and precise, with higher recall and classification accuracy with less misclassification and ConvNeXT showed poor performance for both classes with class imbalance and a higher false negative rate than XGBoost. Results of this study demonstrate that tabular learning methods such as XGBoost can be effective solutions for both static and realtime intrusion detection for IoT environments in an efficient, applicable manner, with the capacity to be feasibly and scalable as an edge deployment without an overly complex processes to go through to transformation a data model.

In the context of cloud computing, network attackers usually exhibit complex, dynamic, and diverse behavior characteristics. Existing research methods, such as Bayesian attack graphs, lack evidence correlation and real-time reflection of the network attack events, and high computational complexity for attack analysis. To solve these problems, this study proposes a Dynamic Uncertain Causal Attack Graph (DUCAG) model and a Causal Chain-based Risk Probability Calculation (CCRP) algorithm. The DUCAG model is constructed to represent the uncertain underlying causalities among network attack events, and the CCRP algorithm aims at dynamically updating the causality weights among different network attack events and attacker hypotheses based on alarm information and causal chain reasoning process. By causality simplification and causality reasoning methods, the CCRP efficiently predicts the attacker behaviors and potential attack likelihood under uncertain time-varying attack situations, and is robust to the incompleteness and redundancy in alarm information. Four experiments under different attack scenarios demonstrate that, the DUCAG model can effectively characterize and predict the complex and uncertain attack causalities, in a manner of high time efficiency. The proposed method has application significance on cloud computing platforms by dynamically evaluating network security status, predicting the future behaviors of attackers, and assisting in adjusting network defense strategies.

Growing pollution levels and traffic congestion in major cities are becoming delicate issues that could be eased by more efficient public transportation systems. To reduce emissions, electric powered vehicles are in use in many cities. Depending on the number of commuters and on the available infrastructure, different types of electric vehicles (battery electric buses, trolley buses, trams, metro, light rail) can be applied. Although these mass transit vehicles enable large reductions in terms of emissions, their energy efficiency could be significantly improved. This improvement can be reached by the hybridization of their drive train with the inclusion of an energy storage system (ESS) for energy recovery purposes [1], [2]. Recent studies have shown that up to 40% of the energy supplied to electrical rail guided current, and power losses, a model of the tram, network, and substations power flow has been developed in a Matlab/ Simulink environment. Results obtained in energy savings at substation level vary from 24iquest27.6% under the same driving profile and auxiliaries load, while at the endof- life (EoL) of supercapacitors, the range varies from 18.1 - 25.1%, depending on the super capacitor module used and the vehicle load.

An efficient heuristic for selecting active nodes in wireless sensor networks

In healthcare and medical applications, the energy consumption of biosensor nodes affects the collection of biomedical data packets, which are sensed and measured from the human body and then transmitted toward the sink node. Nodes that are near to the sink node consume more energy as all biomedical packets are aggregated through these nodes when communicated to the sink node. Each biosensor node in a wireless body sensor network (WBSN) such as electrocardiogram (ECG), should provide accurate biomedical data due to the paramount importance of patient information. We propose a technique to minimize energy consumed by biosensor nodes in the bottleneck zone for WBSNs, which applies the coordinated duty cycle algorithm (CDCA) to all nodes in the bottleneck zone. Superframe order selection in CDCA is based on real traffic and the priority of the nodes in the WBSN. Furthermore, we use a special case of network coding, called random linear network coding (RLNC), to encode the biomedical packets to improve reliability through calculating the probability of successful reception at the sink node. It can be concluded that CDCA outperforms other algorithms in terms of energy saving as it achieves energy savings for most biosensor nodes in WBSNs. RLNC employs relay nodes to achieve the required level of reliability in WBSNs and to guarantee that the biomedical data is delivered correctly to the sink node.

The article comprises issues of analytical modeling of attacks in wireless sensor networks. A proposed attack model specifies possible types of unauthorized influences at the network level aimed at compromising network nodes, data transmitted over the network, and information services provided by the wireless sensor network. A developed graph-based analytical model of a wireless sensor network aims at detecting network layer attacks by processing actual events received from network nodes and deciding whether the network is running under an attack. The correctness of the models is confirmed by their testing by using an example of a scenario for detecting a wormhole attack aimed at disrupting routing processes in a wireless sensor network.

In the Internet of Things (IoT) technology, there are several issues to overcome, including network security. New attacks have been developed to target vulnerabilities in IoT devices, and the Internet of Things on a huge scale will exacerbate present network threats. Machine learning is becoming increasingly used in applications such as traffic classification and intrusion detection. This paper offers a technique for detecting network fault severity and identifying Internet of Things (IoT) devices based on several attributes. By pushing information to the network area, the proposed framework captures different features from each network flow in order to identify the source of traffic and the type of traffic generated is used to detect different network attacks. Different machine learning algorithms are tested to find the better suited algorithm that deliver best results. The following are some of the examples: Random Forest (RF) algorithm, decision tree, SVM, etc. After completing the experimentation, it was found that the random forest classifier and decision tree are the best performing ML algorithms to classify the network severity with an accuracy of about 96.98% and GNB is found as the least performing machine learning model with an accuracy of about 54.41%.