Model for Intrusion Detection in Cyber-Physical System to Address Network Simulation

The problem of the network security is taken up since eighties (Denning et al., 1987) and is developed up today (Beltilch et al., 2004, Bera, 2010, Dasgupta, 1999, Basile, 2007, Wilson, 1999). A major problem of automatic intrusion detection is that, it is difficult to make a difference between normal and abnormal user behaviour. Intrusion detection system should not only recognise the previously known patterns of attacks, but also react in case of appearance of the new events that violate the network security policy. The distributed nature of the task of the network security monitoring requires applying of the distributed tools for network security maintaining. The most important postulate addressed to the intrusion detection systems is that, such systems should automatically react in case of detecting the security policy breach to prevent the attack execution or to reduce the potential loss in the network systems. Intrusion detection systems should be equipped with the components responsible for the permanent observation of the states of monitored nodes and components that integrate the results of these observations and diagnose the security level of the system (Kolaczek et al., 2005, Nguyen et al., 2006). A comprehensive survey of anomaly detection systems is presented in (Patcha & Park, 2007) and a comparison of different approaches to intrusion detection systems is given in (Bejtlich, 2004). One of the first agent systems for network security monitoring has been proposed in works (Balasubramaniyet et al., 1998, Spafford & Zamboni, 2000). In work (Kolaczek et al., 2005) a framework of an original proposal of the intrusion detection system based on the multi-agent approach was presented. In particular, the architecture of such a system and the task of agents were specified. Proposed ideas were further developed and in work (Nguyen et al., 2006) the problem of anomalies detection on the basis of the nodes traffic analysis was discussed. The proposal of the method for Denial of Service Attack detection was given in (Prusiewicz, 2008a). In this work we propose a novel framework of a multi-agent system for anomaly detection. The originality of our solution consists of applying the social network approach to Man in the Middle Attack (MITM) detection in a network system. Our proposal is based on the social networks discovery and their characteristics measurement to detect anomalies in network traffic. We assume that network communication between nodes constitutes social network of users and their applications, so the appropriate methods of social network formal analysis can be applied. The other important assumption is that values of these social

The increasing prevalence of cybercrime and cyber-attacks underscores the imperative need for organizations to implement robust network security measures. Nevertheless, current Intrusion Detection Systems (IDS) often rely on single-sensor or multi-sensor in the same type of IDS, including Host-Based IDS (HIDS) or Network-Based IDS (NIDS), which inherently possess limited detection capabilities. To address this limitation, this research combines NIDS and HIDS components into a collaborative-IDS system, thus expanding the scope of intrusion detection and enhancing the efficacy of the established attack mitigation system. However, the integration of NIDS and HIDS introduces formidable challenges, notably the elevated rates of False Positive and False Negative alerts. To surmount these challenges, the researcher employs machine learning techniques in the form of Snort plugins and comparison methods to heighten the precision of attack detection. The obtained results unequivocally illustrate the effectiveness of this approach. Using a Support Vector Machine for static analysis of the NSL-KDD dataset attains an outstanding 99% detection rate for Denial of Service (DoS) attacks and an impressive 98% detection rate for Probe attacks. Furthermore, in dynamic real-time attack simulations, the machine learning plugins exhibit remarkable proficiency in detecting various types of DoS attacks, concurrently offering more comprehensive identification of SYN Flooding DoS attacks compared to the Snort community rules set. These findings signify a significant advancement in intrusion detection, paving the way for more robust and accurate network security systems in an era of escalating cyber threats.

Most of the various sectors in today’s life such as bank, transport, voting, health, electricity, etc., are currently digitalized. In our research paper, we have surveyed the voting system and explored the existing drawbacks of the voting system concerning security and malfunction. The demerits in the existing schemes include less data security, vote modification, man in the middle attack, masquerade attack, denial of service attack, impersonation attack, etc. Such attacks can compromise security and allows attackers to modify the results. To resolve the above-mentioned issues as well as the attacks, this research paper proposes a protocol to overcome security-based issues. In the proposed system, a secure online e-voting system is developed for end-to-end users to avoid misappropriation on the vote during the result publication in India or any other country. The proposed E-Voting Cloud System (ECS) system has three phases: The first phase is the registration phase, the second phase is vote polling, and the third phase is result announcements. In the proposed system, the election commission of India can search and verify the vote data through cloud computing. For a detailed description of our proposed protocol, a cube data storage structure and user differentiated system are first implemented. Based on the cube data structure and user differentiated system model, the proposed protocol helps to store voter data in the cloud with the encrypted model and ECS. Finally, the candidate can decrypt the data using their key. The people can verify the result announced by the ECS. The performance analysis clearly shows that our proposed system is highly secure when compared to the existing system. Using the proposed work, secure data transfer can be performed in an efficient way for online e-voting applications.

Zero conf protocols date from 1999. They provide plug and play mechanisms to set up networks without having to conFigure DNS or DHCP servers. Almost every device (PCs, printers, scanners, etc.) nowadays “speaks” one of these protocols, sometimes without its owner being even aware of it. The booming IoT ecosystem, in particular, relies heavily on them. Unfortunately, these protocols offer a number of different ways to run, so called, man in the middle attacks (MITM). Some previous publications have mentioned and have taken advantage of one or another of these design flaws. In this paper, we provide a deep dive into the various issues at hand and show the extent of the problem. We consider that the growing reliance of networks on these protocols represent an underestimated and ill covered threat. We have run a number of experiments (300) to test various implementations and discuss our results. We also propose means to detect these attacks thanks to Zeek (aka Bro). We make the attack code as well as the Zeek scripts available to the research community in a format that makes replication of our results possible by researchers while not easy to use by script kiddies.

Cyber security of distribution power systems is of an increasing and pressing importance due to the fast modernisation of current systems. Cyber attacks on distribution power systems may aim to operate the system inefficiently, steal private smart meter data or cause intentional false tripping of few or all feeders. In this paper, a Man in The Middle (MiTM) attack on a power factor correction unit is implemented and demonstrated to overload a distribution feeder and cause an intentional false tripping of the entire feeder causing regional blackout. Experimental implementation of the attack is carried out in a laboratory-scale setup using commercial power equipment under different loading conditions to demonstrate the effectiveness of this attack.

Vehicular communication draws much interest among researchers due to its prospective applications in traffic safety, ubiquitous connectivity, and infotainment. Vehicular networks are integrated with Fifth-Generation (5G) technology to create a 5G vehicle-to-everything (5G-V2X) communication network to inherit the advanced properties of 5G. 5G-V2X provides comfort, reliability, and security to vehicular users' data. However, one of the serious challenges in the 5G-V2X is Handover (HO) procedure when the vehicle moves from one base station to another. At the time of handover, there are some attacks possible such as impersonation attack, Denial of Service (DoS) attack, Man in the Middle attack, etc. In our work, we examine the possible impersonation attack during HO which leads to DoS. We demonstrate the attack by rogue Femto Access Point (FAP) during HO. A vehicle that becomes an attacker by impersonating one of the legitimate FAPs during HO causes DoS attacks by blocking the communication of nearby vehicles. This may be critical to life. Hence, we proposed an attack detection model for the given scenario which is based on HO Failure Ratio (HFR) and Radio Link Failure (RLF). We proposed the attack model and demonstrated the impact of the attack in 5G-V2X by packet loss rate, throughput, block rate, and HFR. Our attack detection method helps to detect the attack efficiently and is also faster than an existing approach.

Today, intrusion detection system using the neural network is an interested and considerable area for the research community. The computational intelligence systems are defined on the basis of the following parameters: fault tolerance and adaptation; adaptable the requirements of make a better intrusion detection model. In this paper, provide an overview of the research progress using computational intelligence to the problem of intrusion detection. The goal of this paper summarized and compared research contributions of Intrusion detection system using computational intelligence and neural network, define existing research challenges and anticipated solution of machine learning. Research showed that application of machine learning techniques in intrusion detection could achieve high detection rate. Machine learning and classification algorithms help to design "Intrusion Detection Models" which can classify the network traffic into intrusive or normal traffic. This paper discusses some commonly used machine learning techniques in Intrusion Detection System and also reviews some of the existing machine learning IDS proposed by researchers at different times.

The increasing use of Internet of Things (IoT) devices has led to a rise in Distributed Denial of Service (DDoS) and Denial of Service (DoS) attacks on these networks. These attacks can have severe consequences, resulting in the unavailability of critical services and financial losses. In this paper, we propose an Intrusion Detection System (IDS) based on a Conditional Tabular Generative Adversarial Network (CTGAN) for detecting DDoS and DoS attacks on IoT networks. Our CGAN-based IDS utilizes a generator network to produce synthetic traffic that mimics legitimate traffic patterns, while the discriminator network learns to differentiate between legitimate and malicious traffic. The syntactic tabular data generated by CTGAN is employed to train multiple shallow machine-learning and deep-learning classifiers, enhancing their detection model performance. The proposed approach is evaluated using the Bot-IoT dataset, measuring detection accuracy, precision, recall, and F1 measure. Our experimental results demonstrate the accurate detection of DDoS and DoS attacks on IoT networks using the proposed approach. Furthermore, the results highlight the significant contribution of CTGAN in improving the performance of detection models in machine learning and deep learning classifiers.

Communication trust is regarded as an effective tool to detect various dangerous cyber attacks, including Man-in-the-Middle (MITM) attacks and acts as a complement to zero trust. There exist some approaches in the literature to calculate inter-node communication trust in Wireless Sensor Networks (WSNs) and IoT networks and leverage it to detect attacks. In WSNs, since promiscuous communication mode is used in calculating inter-node communication trust, it is not suitable for IoT networks. For IoT, the packet forwarding behavior of edge nodes is used in calculating inter-node communication trust, which is limited to detect the MITM attacks effectively unless an edge node is compromised and acts as an MITM attacker. Additionally, these trust calculation mechanisms neither leverage communication channel characteristics nor the communication trust between sensor and edge nodes. Protecting IoT networks from various cyber attacks like MITM attacks requires the instantaneous trust calculation using communication channel characteristics. Since active MITM attacks incur delays, consideration of delay in trust calculation appears to be an effective means in identifying attacks. Neither end-to-end (E2E) delay nor delay due to attacks has been used in communication trust calculation in the existing literature. To bridge this research gap and detect active MITM attacks accurately and spontaneously, in this paper, a new conceptual model, named IPCTCM is introduced for instantaneous trust calculation of an IoT communication channel leveraging delay due to active MITM attacks. Two popular time-series data estimation tools, named Kalman filter and LSTM are used to estimate the expected E2E delay to identify delay due to attacks. Our proposed communication trust calculation model is validated using the data, generated by a testbed implementation in our IoT lab at Federation University Australia. Performance evaluation shows our proposed model achieves an attack detection accuracy of 98.9%, which outperforms an existing intrusion detection method with the improvement of 48.1% accuracy. Furthermore, our trust calculation method has broader applicability in other communication domains as well. • Instantaneous trust calculation for each packet considering real-time E2E delay. • Expected E2E delay estimation using Kalman filter and LSTM to detect attack delay. • Real testbed data generation for experimentation. • 48.1% accuracy improvement in attack detection against an intrusion detection system.

Accurate intrusion detection is necessary to preserve network security. However, developing efficient intrusion detection system is a complex problem due to the nonlinear nature of the intrusion attempts, the unpredictable behaviour of network traffic, and the large number features in the problem space. Hence, selecting the most effective and discriminating feature is highly important. Additionally, eliminating irrelevant features can improve the detection accuracy as well as reduce the learning time of machine learning algorithms. However, feature reduction is an NPhard problem. Therefore, several metaheuristics have been employed to determine the most effective feature subset within reasonable time. In this paper, two intrusion detection models are built based on a modified version of the firefly algorithm to achieve the feature selection task. The first and, the second models have been used for binary and multiclass classification, respectively. The modified firefly algorithm employed a mutation operation to avoid trapping into local optima through enhancing the exploration capabilities of the original firefly. The significance of the selected features is evaluated using a Naïve Bayes classifier over a benchmark standard dataset, which contains different types of attacks. The obtained results revealed the superiority of the modified firefly algorithm against the original firefly algorithm in terms of the classification accuracy and the number of selected features under different scenarios. Additionally, the results assured the superiority of the proposed intrusion detection system against other recently proposed systems in both binary classification and multi-classification scenarios. The proposed system has 96.51% and 96.942% detection accuracy in binary classification and multi-classification, respectively. Moreover, the proposed system reduced the number of attributes from 41 to 9 for binary classification and to 10 for multi-classification.

Intrusion detection (ID) is an important component of infrastructure protection mechanisms. Intrusion detection systems (IDSs) need to be accurate, adaptive, and extensible. Given these requirements and the complexities of today's network environments, we need a more systematic and automated IDS development process rather that the pure knowledge encoding and engineering approaches. This article describes a novel framework, MADAM ID, for Mining Audit Data for Automated Models for Instrusion Detection. This framework uses data mining algorithms to compute activity patterns from system audit data and extracts predictive features from the patterns. It then applies machine learning algorithms to the audit records taht are processed according to the feature definitions to generate intrusion detection rules. Results from the 1998 DARPA Intrusion Detection Evaluation showed that our ID model was one of the best performing of all the participating systems. We also briefly discuss our experience in converting the detection models produced by off-line data mining programs to real-time modules of existing IDSs.

The threat to organisations from network attacks is very real. Current countermeasures to denial of service (DoS) attacks rely on the perimeter model of network security. However, as the case study and analysis in this paper make apparent, the perimeter model, which relies on firewalls and intrusion detection systems, is unable to provide an effective defence against DoS attacks. Therefore, there is a need for a new approach; one that identifies an attack beyond the perimeter. We present such an approach. We achieve early detection of DoS attacks by the identification of traffic signatures which indicate that an attack is underway. As these signatures can be identified 'outside' the perimeter, appropriate measures can be taken to prevent the attack from succeeding. We use examples of DoS attacks and a case study to demonstrate the applicability of our approach.

With the continuous development of computer networks, the security of the network has become increasingly prominent. A major threat to network security is the intrusion of information systems through the network. Intrusion detection of the traditional intrusion detection and alarm technology is not sufficient. Based on neural network technology, this paper studies the intrusion detection and alarm correlation technology. Based on the research on the working principle and workflow of the existing intrusion detection system, a new neural network-based intrusion detection and alarm method is proposed. A neural network-based intrusion detection and alarm system is designed and implemented. Through the experiment of the system prototype, the results show that the intrusion detection and alarm system based on the neural network has a higher detection rate and a lower false alarm rate for intrusion behaviors such as denial of service attack and has higher detection ability for unknown attack behaviors.

Chapter 5 - Intrusion Prevention and Detection Systems

Intrusion detection is a significant technique for detecting various attacks in Wireless Mesh Networks (WMNs). Intrusion Detection Systems (IDS) powered by machine learning algorithms play a vital role in enhancing security by actively monitoring data traffic in real-time. The performance of attack detection in IDS is reduced by the existence of noisy and unwanted features in the network data. Hence, extracting Informative Features (IF) is essential for enhancing the effectiveness of the IDS. The proposed approach optimally selects IF from the network dataset, which facilitates in accurately detecting intrusions. Existing methods lack in efficient feature selection, leading to higher computational complexity and lower detection performance. This research aims to enhance IDS accuracy by leveraging the eXtreme Gradient Boosting (XGBoost) algorithm to classify the intrusions in the mesh network of smart grid and the optimal feature selection carried out with the help of Golden Eagle Optimization Algorithm (GEOA). This novel hybrid IDS model enhances the attack detection in WMNs. The proposed IDS’s performance is improved by using a feature selection method based on the GEOA, and then obtained results are compared against evolutionary algorithms-based features selection method. The proposed model of IDS using XGBoost algorithm is tested on a smart grid dataset, and its performance is compared with existing literature works.