Machine Learning for Enhanced Cyber Security

Intrusion detection systems are used to detect attacks in a network. Machine learning (ML) approaches have been widely used to build such Intrusion Detection Systems (IDSs) because they are more accurate when built from a very large and representative dataset. In recent times, one of the benchmark datasets that are used to build ML-based Intrusion Detection models is CICIDS2017 dataset. The dataset is contained in eight groups and was collected from the Canadian Institute on Cyber Security dataset repository. The dataset is available in both PCAP and netflow formats. This study used the netflow records in the CIDIDS2017 dataset as they are found to contain newer attacks,very large and are found useful for traffic analysis. Exploratory Data Analysis (EDA) techniques were used to reveal various characteristics of the dataset. The general objective is to provide more insights on the nature, structure and issues with the dataset so as to identify the best ways for using it to achieve improved ML-based IDS models. Furthermore, some of the open problems that can arise from the use of the dataset in any machine learning-based Intrusion Detection systems are highlighted and possible solutions are briefly discussed. The EDA techniques used revealed important relationships among input variables and the target class. The study concluded that the EDA can better influence the decision of future IDS researches that use the dataset. Thus, improved machine learning-based intrusion detection systems can be built from the dataset once it is well understood and pre-processed.

Smart grids represent the modernization of electrical grids by integrating advanced communication and information technology. However, their interconnected nature and reliance on digital infrastructure make them vulnerable to cyber-attacks. Enhancing cybersecurity in smart grids is paramount to ensure reliability and safety. This paper explores the use of Machine Learning-Based Intrusion Detection Systems (ML-IDS) as a solution to enhance the cybersecurity of smart grids. It examines the current cybersecurity challenges in smart grids, the fundamentals of intrusion detection systems, the integration of machine learning in IDS, and the effectiveness of ML-IDS in mitigating cyber threats.

Investigating the use of moving target defense (MTD) mechanisms in IoT networks is ongoing research, with unfathomable potential to equip IoT devices and networks with the ability to fend off cyber attacks despite the computational deficiencies many IoT ecosystems typically have. The AI community has extensively studied adversarial threats and attacks on machine learning-based systems, emphasizing the need to address the potential compromise of anomaly-based intrusion detection systems (IDS) through adversarial attacks. Another concept that has gained significant attention in the networking community is Game Theory. Protecting any given network is almost a never-ending battle between the attacker and defender, and hence a natural game of competitors can be modelled based on one’s parametric specifications to gain more insight into how attackers might interact with one’s system. The goal of this thesis is to propose a comprehensive, experimentally verifiable game-theoretic model of MTD in IoT networks to secure the IDS against adversarial attacks. Once a game with state transitions based on given actions can be modelled, reinforcement learning is used to develop policies based on various episodes (rounds) of the game, ultimately optimizing network decisions to minimize successful attacks on machine learning-based IDS. The state-of-the-art ToN-IoT dataset was investigated for MTD feasibility to implement the feature-based MTD approach. The overall performance of the proposed MTD-based IDS was compared to a conventional IDS by analyzing the accuracy curve of the MTD-based IDS and the conventional IDS for varying attacker success rates and resource demands. Our approach has proven effective in securing the IDS against adversarial learning.

There are considerable hurdles that must be overcome in order to maintain adequate security against cyber-attacks in cloud settings because of their dynamic and dispersed nature. A proactive method to identifying and mitigating new threats in real time is provided by adaptive intrusion detection systems (IDS) that make use of machine learning (ML). The design and operation of adaptive intrusion detection systems (IDS) that are adapted for cloud platforms are investigated in this study. Particular attention is paid to the utilisation of supervised, unsupervised, and reinforcement learning methods. It investigates the benefits of adaptive intrusion detection systems (IDS) in terms of identifying abnormal behaviours, minimising the number of false positives, and adapting to shifting threat environments. Several important factors, including the selection of features, the quality of the dataset, and the optimisation of the algorithm, are covered. In addition to this, we investigate the possibility of integrating adaptive intrusion detection systems with cloud-native technologies such as serverless computing and containers. Performance measurements and comparative evaluations demonstrate that machine learning-based intrusion detection systems are more effective than older techniques. Additionally, the study addresses issues such as scalability, data privacy, and adversarial assaults, and it proposes viable methods to improve dependability. The adaptive intrusion detection system (IDS) is an essential component of cloud security methods since it enables continuous monitoring and reaction to complex kinds of attacks.

Adversarial machine learning is a recent area of study that explores both adversarial attack strategy and detection systems of adversarial attacks, which are inputs specially crafted to outwit the classification of detection systems or disrupt the training process of detection systems. In this research, we performed two adversarial attack scenarios, we used a Generative Adversarial Network (GAN) to generate synthetic intrusion traffic to test the influence of these attacks on the accuracy of machine learning-based Intrusion Detection Systems(IDSs). We conducted two experiments on adversarial attacks including poisoning and evasion attacks on two different types of machine learning models: Decision Tree and Logistic Regression. The performance of implemented adversarial attack scenarios was evaluated using the CICIDS2017 dataset. Also, it was based on a comparison of the accuracy of machine learning-based IDS before and after attacks. The results show that the proposed evasion attacks reduced the testing accuracy of both network intrusion detection systems models (NIDS). That illustrates our evasion attack scenario negatively affected the accuracy of machine learning-based network intrusion detection systems, whereas the decision tree model was more affected than logistic regression. Furthermore, our poisoning attack scenario disrupted the training process of machine learning-based NIDS, whereas the logistic regression model was more affected than the decision tree.

This study proposes a lightweight machine learning-based intrusion detection system (IDS) designed for smart grid environments. The framework integrates feature extraction using autoencoders, dataset balancing with SMOTE, and multiple machine learning and deep learning classifiers to detect cyberattacks efficiently. Experimental results on the UNSW-NB15 dataset demonstrate high detection accuracy and short training time, highlighting the suitability of lightweight IDS models for deployment at resource-constrained edge access points in smart grids.

Cybersecurity has become a priority concern of the digital society. Many attacks are becoming more sophisticated, requiring strengthening the strategies of identification, analysis, and management of vulnerability to stop threats. Intrusion Detection/Prevention Systems are first security devices to protect systems. This paper presents a survey of several aspects to consider in machine learning-based intrusion detection systems. This survey presents the Intrusion Detection Systems taxonomy, the types of attacks they face, as well as the organizational infrastructure to respond to security incidents. The survey also describes several investigations to detect intrusions using Machine Learning, describing in detail the databases used. Moreover, the most accepted metrics to measure the performance of algorithms are presented. Finally, the challenges are discussed motivating future research.KeywordsIntrusion detection systemsMachine learningCyber security

Optimized machine learning enabled intrusion detection 2 system for internet of medical things

Internet of Things (IoT) security dataset evolution: Challenges and future directions

In the field of information and cybersecurity, one of the most important and critical challenges is the human factor, because no software or technical tool can fully compensate for the lack of awareness of information and cyber risks, appropriate behavior and a responsible attitude to information protection. The introduction of cognitive science theories into the field of cyber security will increase the level of effectiveness of protection strategies. Cognitive modeling contributes to the creation of mathematical models that simulate the processes of human thinking, decision-making and behavior, which brings the transition from reactive protection to a proactive approach. This article is devoted to the study of the implementation of the cognitive approach in security systems. Based on the analysis of scientific literature, the main definitions of cognitive science are highlighted, in particular, the concepts of cognitive modeling, cognitive analysis and synthesis, types of cognitive models, fuzzy cognitive map. The advantages of cognitive theories in various sectors of society are outlined. It has been proven that cognitive modeling can be applied in the field of cybersecurity to understand and predict the behavior of both attackers and protective systems. The following cognitive models in cyber systems are described: symbolic modeling (rule-based modeling) is used to build intrusion detection systems (IDS) that analyze network traffic for known attacks; network modeling (modeling using neural networks) includes anomaly detection systems that analyze typical network behavior; Bayesian models (probabilistic modeling) help predict risks and the probability of a successful attack on a specific system; agent-based modeling is used to simulate cyberattacks and test the resilience of systems. It was determined that the use of hybrid models that combine the above is effective. The challenges of implementing cognitive modeling in the security field are highlighted. These are the difficulties associated with the need for large volumes of qualitative data on the behavior of attackers, the complexity of modeling human behavior, and ethical issues. The results of the study can be used as educational material for students of the specialty F5 Cybersecurity and Information Protection.

Metaheuristic optimization algorithms continue to be essential for solving complex real-world problems, yet existing methods often struggle with balancing exploration and exploitation across diverse problem landscapes. This paper proposes a novel nature-inspired metaheuristic optimization algorithm named the Painted Wolf Optimization (PWO) algorithm. The main inspiration for the PWO algorithm is the group behavior and hunting strategy of painted wolves, also known as African wild dogs in the wild, particularly their unique consensus-based voting rally mechanism, a behavior fundamentally distinct from the social dynamics of grey wolves. In this innovative process, pack members explore different areas to find prey; then, they hold a pre-hunting voting rally based on the alpha member to determine who will begin the hunt and attack the prey. The efficiency of the proposed PWO algorithm is evaluated by a comparison study with other well-known optimization algorithms on 33 test functions, including the Congress on Evolutionary Computation (CEC) 2017 suite and different real-world engineering design cases. Furthermore, the algorithm’s performance is further tested across a spectrum of optimization problems with extensive unknown search spaces. This includes its application within the field of cybersecurity, specifically in the context of training a machine learning-based intrusion detection system (ML-IDS), achieving an accuracy of 0.90 and an F-measure of 0.9290. Statistical analyses using the Wilcoxon signed-rank test (all p<0.05) indicate that the PWO algorithm outperforms existing state-of-the-art algorithms, providing superior solutions in diverse and unpredictable optimization landscapes. This demonstrates its potential as a robust method for tackling complex optimization problems in various fields. The source code for the PWO algorithm is publicly available at https://github.com/saeidsheikhi/Painted-Wolf-Optimization.

This dynamism of cyber threats in Industry4.0 and Industry Internet of Things (IIoT) setting makes any static machine learning-based Intrusion Detection Systems (IDS) ineffective in the face of concept drift. As a solution to it, we introduce HYRIDE-RL, a hybrid adaptive IDS, which incorporates Deep Reinforcement Learning (DRL) with an anomaly detector to perform autonomous real time adaptation. Developed as a Markov Decision Process (MDP), a Deep Q-Network (DQN) adaptively modulates the sensitivity of detection based on network statistics and performance feedback. Some of the innovations are a multi-faceted state representation, replay-buffer reset enabling catastrophic forgetting and guided reward shaping to achieve faster recovery. The experiment involving the CICIDS 2017 dataset proves that the difference is not extremely large, but it does exist and the two classes in question are not very different. Model collapse $\mathbf{9 1 . 2} \boldsymbol{\%}$ to $\mathbf{2 . 5} \boldsymbol{\%}$ accuracy, HYRIDE-RL in practice recovers $88.6 \%$ accuracy of 0.917 AUC, reducing recovery. Time by $53 \%$. These results prove its capability in non-stationary and dynamic IIoT.

ResNet50-1D-CNN: A new lightweight resNet50-One-dimensional convolution neural network transfer learning-based approach for improved intrusion detection in cyber-physical systems

Today, the implementation of measures for cybersecurity of information and communication systems and critical infrastructure of the state, countering and responding to computer incidents and cyber influences - remains one of the major tasks in the field of information security and cybersecurity of the state. Defining the directions of Ukraine᾿s foreign policy in the field of cybersecurity, the Strategy establishes that Ukraine will intensify its participation and partnership in international processes of standardization and certification in the field of cybersecurity, increase its “presence” in international, regional and other standardization bodies and institutes and certification of this area in the geopolitical sense. Based on the need for scientific substantiation of the institutional framework for the development of cybersecurity, special attention should be paid to the development of standards in the field of new IT technologies (including artificial intelligence, cloud databases, quantum computing and communications) and basic Internet architecture. The review of the problem field of research shows that in general the Internet should be comprehensive and open, the technologies supported and used in it should be focused on the person, his basic freedoms, guarantee neutrality to his privacy, ensure his privacy in cyberspace, and any restrictions should be carried out only in accordance with laws and regulations (standards). Ukraine᾿s position is that the use of certain technological processes should be legal and safe, in accordance with existing ethical standards. Current laws and regulations of the state, current national standards, including those developed and implemented, have been formulated taking into account promising areas of development of mechanisms for institutional support of cyber security and based on Euro-Atlantic experience. This allowed them to be implemented quite effectively in the regulatory framework of Ukraine. Nevertheless, during the analysis and generalization of theoretical approaches to the essence and content of some definitions, experts came to the appropriate legal conflict, namely that national standards contain requirements in partially similar areas of Ukrainian society, only with other names, such as: “information security”, “information technology security”, and “cybersecurity”. Thus, the author considers in detail the theoretical and practical significance of the draft Law of Ukraine “On Amendments to Some Laws of Ukraine on Standardization in the Areas of Cryptographic and Technical Protection of Information, Cyber Security, Counteraction to Technical Intelligence” at the initiative of MPs Fedienko O.P., Klochko A. and others, registration number 6568 of “28” January 2022 (first reading). Therefore, based on the implemented Cyber Security Strategy, which entered into force on 28.08.2021 and it is obvious that in the process of achieving its goals requires a systematic approach, the issue of legislation and standardization in cyber security and defining a specific subject of standardization in this area is extremely important.

Intrusion detection systems are mainly prevalent proclivity within our culture today. Interference exposure systems function as countermeasures to identify web-based protection threats. This is a computer or software program that monitors unauthorized network activity and sends alerts to administrators. Intrusion detection systems scan for known threat signatures and anomalies in normal behaviour. This article also analyzed different types of infringement finding systems and modus operandi, focusing on support-vector-machines; Machine-learning; fuzzy-logic; and supervised-learning. For the KDD dataset, we compared different strategies based on their accuracy. Authors pointed out that using support vector machine and machine learning together improves accuracy.