Ensemble visualization for cyber situation awareness of network security data

Security related data in cyberspace is multi-source and heterogeneous, so it cannot be effectively used in network security analysis. To solve this problem, a network security ontology model for network node security analysis is proposed. The model reflects the security status of network nodes through three key sub domains: network assets, security information, defense strategy, and modeling concepts and relationships in a hierarchical and structured form. Ontology related language is used for query, and user-defined rules are used to enhance the reasoning ability of ontology, so as to assist network security analysis. Experiments and quality evaluation results show that the ontology model can integrate multi-source data, query and reason the network security status, and has higher quality evaluation than the same type of ontology.

The purpose of this study is to analyze the security of the WiFi network in Mutiara Bunda extraordinary school, in order to determine the level of security, analyze the network speed. and add network security using mikrotik using Firewall and WiFi hotspot features. The research method used is the Signal Scanning method, namely moving activities in a certain area, mapping Access Point for statistical purposes. The author conducts a network security analysis using two stages of testing, the first stage is to do a login test, try to break into WiFi using the Dummper application, then to analyze the signal strength using the InSSIDer and Vistumbler applications, and use the K-Mac application to test the security of the network, The author also draws conclusions, and adds network security, namely the firewall and WiFi hotspot features using Mikrotik, then the author performs the second testing phase, the stages are the same as the first testing phase,and draws conclusions. The advice from the author is for the agency to be able to maintain and always update network security, so that it can run and be maintained properly

Network security is not only related to personal information security, but also to the information security of the whole country. The application of big data technology in network security analysis can not only maximize the data acquisition, storage and analysis capabilities of the network system itself, but also further reduce the storage cost of the network information itself, and provide an important security guarantee for data retrieval and traceability. In this paper, a new idea of network security situational awareness model is proposed, and an effective network security situational awareness model is found from the perspective of network data traffic characteristics. The experimental results show that the machine learning and data mining algorithm in this paper has high accuracy and timeliness in processing large data. This provides a new way of thinking for the research and processing of new problems brought by big data.

It is technically challenging to conduct a security analysis of a dynamic network, due to the lack of methods and techniques to capture different security postures as the network changes. Graphical Security Models (e.g., Attack Graph) are used to assess the security of network systems, but it typically captures a snapshot of a network state to carry out the security analysis. To address this issue, we propose a new Graphical Security Model named Time-independent Hierarchical Attack Representation Model (Ti-HARM) that captures security of multiple network states by taking into account the time duration of each network state and the visibility of network components (e.g., hosts, edges) in each state. By incorporating the changes, we can analyse the security of dynamic networks taking into account all the threats appearing in different network states. Our experimental results show that the Ti-HARM can effectively capture and assess the security of dynamic networks which were not possible using existing graphical security models.

EPIsembleVis: A geo-visual analysis and comparison of the prediction ensembles of multiple COVID-19 models

Based on the B / S network architecture is very widespread, and the distance between the browser and the application server is usually more distant, and therefore ensure that the information transmitted over the remote line is particularly important. Many domestic and foreign academic institutions, enterprises and standardization organizations have recognized some of the research in this area began to build a meaning and importance based on the variety of network and security infrastructure of unified security management system, and. However, due to security reasons, openness and safety management system and other aspects, the research work safety management system is still in the exploratory stage. Through systematic research study found that the direction of research relevant literature and conduct adequate research and analysis of the existing network security detection systems cannot efficiently detect unknown intrusion defects, we propose a detection and analysis of network security architecture uses mode, design mode network security monitoring and analysis system architecture based architecture.

Statistically significant time‐lagged relationship of pre‐monsoon precipitation in Indochina Peninsula (ICP) with large‐scale feature over the Pacific and Indian Oceans, which was recently found in observational datasets by the authors, is investigated with a large‐ensemble (100 ensembles) simulation database called “Database for Policy Decision‐Making for Future Climate Change” (d4PDF). Two different strategies were taken to perform Empirical Orthogonal Function (EOF) analysis on the large‐ensemble dataset, namely statistics of the analysis results for each ensemble member separately and analysis on the 6,000‐year data (100 times 60 years). d4PDF can reproduce well the climatological characteristics of the observed pre‐monsoon precipitation. Significant time‐lagged correlations of several climate indices related to sea surface temperature (SST) with the pre‐monsoon precipitation in ICP as obtained in the observation are confirmed in d4PDF for both strategies of EOF analyses on each ensemble member and on 6,000‐year data. The climate simulation in d4PDF can capture the lag‐to‐lag variations of the time‐lagged correlation patterns very well, though it is weaker. The time‐lagged regressions of SST and zonal wind at 850 hPa upon the first principal component (PC1) time‐series of the EOF analysis of the pre‐monsoon precipitation over ICP are investigated in low latitudes over the Pacific and Indian Oceans. The observed time‐lagged regression features are also confirmed in d4PDF dataset; the significant regression areas expand larger and significant time lags become longer than the observation, especially in the case of 6,000‐year data, due to enough number of samples. Cluster analysis on the regression maps shows that the obtained groups with larger numbers of ensemble members are closer to the observation than the other groups. The randomness of time‐lagged regression feature among the 100 ensemble members is not directly related to the randomness of the SST perturbation introduced in the lower boundary condition for the ensemble simulation of d4PDF.

The security and integrity of a computer system is compromised when an intrusion occurs. It becomes impossible for legitimate users to access different network services when network-based attacks purposely occupy or sabotage network resources and services. Our proposed method is a scalable detection method for network based anomalies. We use Support Vector Machines (SVM) for classification. This paper presents a method for enhancing the training time of SVM, particularly when dealing with large data sets, using hierarchical clustering technique. We use the Dynamically Growing Self-Organizing Tree (DGSOT) algorithm for clustering because it has proved to overcome the problems of traditional hierarchical clustering algorithms (e.g., hierarchical agglomerative clustering). Clustering analysis helps to find the boundary points, which are the most qualified data points to train SVM, between any two classes. We present a new approach of combination of SVM and DGSOT, which begins with an initial training set and expands it gradually using the clustering structure produced by the DGSOT algorithm. We show that our proposed variations contribute significantly in improving the training process of SVM with high percentage of detection accuracy. Keywords: SVM, classification, Intrusion detection, Intrusion detection System, Network Security

The theoretical and practical aspects of an anomaly detection system in DNS queries, which serves as a crucial tool for ensuring the security of internet infrastructure, are examined. Anomalous DNS queries pose a serious threat to network security and stability as they can be an indicator of cyber attacks or malicious activity. One of the most common threats is the use of DNS to carry out DDoS attacks, in particular through the DNS amplification mechanism. An analysis of existing anomaly detection methods, including statistical, signature-based approaches, and machine learning methods, is conducted. The key stages of the proposed system's development are described, including data collection, preprocessing, and analysis, as well as the creation of a normal activity profile for identifying deviations. Innovative methods based on deep learning and time series analysis open new horizons in automated detection of anomalies in DNS traffic. Deep neural networks, such as recurrent neural networks (RNNs) and convolutional neural networks (CNNs), are used to detect complex patterns in large data sets, including the textual and temporal aspects of DNS queries. The primary goal of the study is to demonstrate the effectiveness of a combined approach to DNS traffic analysis, utilizing modern machine learning algorithms such as Isolation Forest, One-Class SVM, and K-means. The proposed system achieves a high level of accuracy (92%) and completeness (90%) in anomaly detection, as confirmed by testing results on the CAIDA Passive DNS Dataset. A description of the modular architecture of the system is presented, which allows for scalability in large networks with high traffic levels. The proposed approach is flexible and adaptive, enabling integration with existing network security and incident response tools.

Anomaly intrusion detection technologies are essential for network and computer security as the threat gets more serious yearly. Ensemble learning techniques are promising machine learning methods in anomaly detection that aim to produce multiple models and combine their output in a specific manner to obtain a perfect attack detection. However, it’s still difficult to choose an appropriate ensemble method for a particular dataset. This research is conducted on entry-disciplinary concept in which the knowledge is transferred between network security and machine learning. Thus, the problematic of anomaly detection in network traffic is considered, and two novel ensemble methods for anomaly detection is presented. In both methods, the decision rule (henceforth, Rule-set) which is extracted from two different families of classifiers Naïve Bayes and decision tree J48 will be used as an ensemble constitute classifiers. In the first method, a set of Rule Evaluation Metrics (henceforth, REMs) extracted from Rule-sets will be used for combining classifiers and solving rules conflict whenever occurred. While in the second method the paper presents a novel stacking approach as follows: a cover property of Rule-sets will be utilized to re-encode training instances and produce metadata set that is used for training a meta-level classifier which produces the ultimate result. The evaluation of the proposed methods will be conducted on CICIDS2017 dataset in a term of detection rate, execution time, false alarm rate, accuracy, and other interesting measures. The experimental results show attests their superiority of accuracy that reaches 99.8630% and 99.8642% for first and second methods respectively and lower execution time for both methods especially for the second proposed method, which is (0.25 s).

This study is based on the problems that are often encountered in the research location, namely how to secure the inlislite server by designing network security using Packet Filter Firewall of IPtables. The purpose of this study is to optimize the data security of the inlislite system in the Library and Archives Service of Bengkulu Province. The method used is the Network Development Life Cycle (NDLC) method, a cycle of network design stages that can guide a network design, which depends on the size of the project to be implemented and the purpose of the project. By testing a Denial of Service (DoS) attack against inlislite using hping3 on linux, the inlislite website can no longer be accessed. Therefore, the author designed a new system to secure the inlislite server from unwanted attacks using the IPTables firewall filter then it can become a firewall that will ward off Distributed Denial of Service and Denial of Service attacks on inlislite servers. From the results of research and testing that has been carried out, the IPTables firewall is very good for securing servers in the Library and Archives Service of Bengkulu Province and applying more rules to clients in terms of internet use.

This book constitutes the refereed proceedings of the 18th Nordic Conference on Secure IT Systems, NordSec 2013, held in Ilulissat, Greenland, in October 2013. The 18 revised regular papers together with 3 short papers and one invited talk were carefully reviewed and selected from 35 submissions. The papers are organized in topical sections on formal analysis of security protocols, cyber-physical systems, security policies, information flow, security experiences, Web security, and network security

This study evaluates the current state of wireless network security in the CBD of Nuku'alofa. Wireless Networks have grown significantly since their introduction. Security protocols supplied with the wireless equipment have reached a level of strong and robust security. However, security remains a problem; this study aims to answer two questions. What is the status of wireless network growth and security in Tonga? and what can be done to improve wireless network security in Tonga. The war-drive results of Nuku'alofa produced comprehensive data which clearly shows the number of networks, both company and home networks. An exploratory research approach is employed to guide the design of the study. The results show that there is a significant growth in terms of WLAN usage since the implementation of the fiber optic network. However, this study concludes that WLAN security in Nuku'alofa is still in its early stages.

Wireless Local Area Network (WLAN) is an alternative in overcoming cabling problems in a local network. Often wireless network security that is installed still uses vendor default settings such as SSID, IP Address, remote management, DHCP enabled, frequency channels, without encryption, even user or password for wireless administration. How does a strong WLAN security system work? The most common security system applied to wireless networks at this time is starting from securing access points by applying the MAC Filtering concept, using WPA / WPA2-PSK security keys, and RADIUS server authentication. To see the quality of wireless LAN network security, how do you analyze the test of the existing security system in the network. The method that can be used in evaluating wireless networks is by testing the system by simulating forms of attacks on wireless networks with the Penetration Testing method. By carrying out 4 stages of research using the penetration testing method (i) the planning stage, (ii) the discovery stage, (iii) the attack stage and (iv) the report stage, from the attack stage (Cracking The Encryption, Bypassing MAC Address, Attacking The Infrastructure and MITM ) using Kali Linux got the results of four types of attacks carried out, only one of which was failed, namely the cracking attack type of the encryption on the RADIUS server due to using captive portal authentication

Predicting the location and intensity of precipitation still remains a main issue in numerical weather prediction (NWP). Resolution is a very important component of precipitation forecasts in NWP. Compared with a lower resolution model, a higher resolution model can predict small scale (i.e., storm scale) precipitation and depict convection structures more precisely. In addition, an ensemble technique can be used to improve the precipitation forecast because it can estimate uncertainties associated with forecasts. Therefore, NWP using both a higher resolution model and ensemble technique is expected to represent inherent uncertainties of convective scale motion better and lead to improved forecasts. In this study, the limited area ensemble prediction system for the convective-scale (i.e., high resolution) operational Unified Model (UM) in Korea Meteorological Administration (KMA) was developed and evaluated for the ensemble forecasts during August 2012. The model domain covers the limited area over the Korean Peninsula. The high resolution limited area ensemble prediction system developed showed good skill in predicting precipitation, wind, and temperature at the surface as well as meteorological variables at 500 and 850 hPa. To investigate which combination of horizontal resolution and ensemble member is most skillful, the system was run with three different horizontal resolutions (1.5, 2, and 3 km) and ensemble members (8, 12, and 16), and the forecasts from the experiments were evaluated. To assess the quantitative precipitation forecast (QPF) skill of the system, the precipitation forecasts for two heavy rainfall cases during the study period were analyzed using the Fractions Skill Score (FSS) and Probability Matching (PM) method. The PM method was effective in representing the intensity of precipitation and the FSS was effective in verifying the precipitation forecast for the high resolution limited area ensemble prediction system in KMA.