Research of Detection Method of Server Network Storm Attack

The detection of computer network attacks is becoming increasingly important as the complexity of cyber-attacks threatening information systems and infrastructure continues to rise. To address these threats, artificial intelligence techniques have become a primary focus in the development of more effective attack detection systems. One algorithm that has proven reliable in this context is the C4.5 decision tree. This study aims to apply the C4.5 algorithm in network attack detection using a dataset that includes various types of attacks and network activities. The process includes data preprocessing, decision tree model building, and model performance evaluation. The results show that the C4.5 decision tree algorithm is effective in classifying network activities into attacks and normal activities with a satisfactory level of accuracy. The model successfully recognizes attack-related patterns, and further analysis identifies key factors influencing attack detection. This research provides a significant contribution to the development of reliable and efficient attack detection systems in computer networks. By applying the C4.5 decision tree algorithm, it is expected to help enhance information security and protect network infrastructure from increasingly complex cyber threats

The complexity of the Internet and the volume of network traffic have dramatically increased in the last few years, making it more challenging to design scalable Network Traffic Monitoring and Analysis (NTMA) systems. Critical NTMA applications such as the detection of network attacks and anomalies require fast mechanisms for on-line analysis of thousands of events per second, as well as efficient techniques for off-line analysis of massive historical data. The high-dimensionality of network data provided by current network monitoring systems opens the door to the massive application of machine learning approaches to improve the detection and classification of network attacks and anomalies, but this higher dimensionality comes with an extra data processing overhead. In this paper we present Big-DAMA, a big data analytics framework (BDAF) for NTMA applications. Big-DAMA is a flexible BDAF, capable to analyze and store big amounts of both structured and unstructured heterogeneous data sources, with both stream and batch processing capabilities. Big-DAMA uses off-the-shelf big data storage and processing engines to offer both stream data processing and batch processing capabilities, decomposing separate engines for stream, batch and query, following a Data Stream Warehouse (DSW) paradigm. Big-DAMA implements several algorithms for anomaly detection and network security using supervised and unsupervised machine learning (ML) models, using off-the-shelf ML libraries. We apply Big-DAMA to the detection of different types of network attacks and anomalies, benchmarking multiple supervised ML models. Evaluations are conducted on top of real network measurements collected at the WIDE backbone network, using the well-known MAWILab dataset for attacks labeling. Big-DAMA can speed up computations by a factor of 10 when compared to a standard Apache Spark cluster, and can be easily deployed in cloud environments, using hardware virtualization technology.

In the process of research on the characteristic detection method for large scale network attacks, due to the use of the current algorithm for large-scale network attack detection, it is unable to describe the attack characteristics of network attacks or detect in low accuracy. Therefore, an attack detection method for large scale network based on cooperative planning is proposed. The method is based on collaborative planning to design the detection characteristic of large scale network attacks, which is transformed into a space search problem. The difference between the parameters of the flow vector and the normal vector of the normal network spatial data is extracted as characteristics, combining Gauss mixture model with the expectation maximization algorithm, to design Lorenz chaotic asynchronous tracking detection algorithm for modeling and detection of network data stream. The experimental simulation shows that the detection method of large scale network attack detection method has high accuracy and high efficiency. Currently, characteristic detection technology for network attack is based on ant colony algorithm, particle algorithm and the fuzzy algorithm for large-scale network. Among them, the commonly characteristic detection method is technology based on the fuzzy algorithm for large scale network attack. However the current algorithms with characteristic detection for network attack could not describe attack characteristics in detail, which lead to low accuracy. In view of the above defect, a method for large scale network attack detection based on cooperative planning is proposed. The method is represented for network attack with characteristic feature, which is transformed into a search problem in the space. To extract difference of parameter vector characteristic of network spatial data flow between to test network and normal network, with Gaussian mixture model and expectation maximization algorithm combined, Lorenz chaotic asynchronous detecting and tracking algorithm is designed to model and test the network data flow. The experimental simulation shows that the detection method for large scale network has high accuracy and efficiency.

Network forensics is addressed to deal with cybercrime. The main purpose of a network forensics system is reconstructing evidences of network attacks. In order to reconstruct evidence, the network attack is firstly identified. Therefore, network attack detection solutions play an important role in network forensics. There are two main types of network attacks: network level and application level. Network level attack detection solutions focus on the information in the headers of network packets. While, application level attack detection solutions investigate the data fragments carried out in the packet payloads. We propose an approach based on Shannon entropy and machine learning techniques to identify executable content for anomaly-based network attack detection in network forensics systems. Experimental results show that the proposed approach provides very high detection rate.

The unsupervised detection of network attacks represents an extremely challenging goal. Current methods rely on either very specialized signatures of previously seen attacks, or on expensive and difficult to produce labeled traffic data-sets for profiling and training. In this paper we present a completely unsupervised approach to detect attacks, without relying on signatures, labeled traffic, or training. The method uses robust clustering techniques to detect anomalous traffic flows, sequentially captured in a temporal sliding-window basis. The structure of the anomaly identified by the clustering algorithms is used to automatically construct specific filtering rules that characterize its nature, providing easy-to-interpret information to the network operator. In addition, these rules are combined to create an anomaly signature, which can be directly exported towards standard security devices like IDSs, IPSs, and/or Firewalls. The clustering algorithms are highly adapted for parallel computation, which permits to perform the unsupervised detection and construction of signatures in an on-line basis. We evaluate the performance of this new approach to discover and to build signatures for different network attacks without any previous knowledge, using real traffic traces. Results show that knowledge-independent detection and characterization of network attacks is possible, opening the door to a whole new generation of autonomous security algorithms.

In view of all kinds of network attacks which may affect the network security of the smart grid system, an attack detection algorithm is proposed, feature extraction and training to the data such as server logs is carried out based on Hidden Markov model (HMM) to achieve the network attack detection in smart grid system. By the proposed algorithm, analysis on real data of the smart grid system in one power company is carried out, which can effectively identify common types and numbers of network attack types. Through the proposed smart grid network attack detection algorithm, network security risks in the smart grid system can be found, and the level of network security is improved.

Cross-domain network attack detection enabled by heterogeneous transfer learning

This manifesto is the result of the Perspective Workshop Network Attack Detection and Defense held in Schloss Dagstuhl (Germany) from March 2nd – 6th, 2008. The participants of the workshop represent researchers from Austria, France, Norway, the Switzerland, the United States, and Germany who work actively in the field of intrusion detection and network monitoring. The workshop attendee’s opinion was that intrusion detection and flow analysis, which have been developed as complementary approaches for the detection of network attacks, should more strongly combine event detection and correlation techniques to better meet future challenges in future reactive security. The workshop participants considered various perspectives to envision future network attack detection and defense. The following topics are seen as important in the future: the development of early warning systems, the introduction of situation awareness, the improvement of measurement technology, taxonomy of attacks, the application of intrusion and fraud detection for web services, and anomaly detection. In order to realize those visions the state of the art, the challenges, and research priorities were identified for each topic by working groups. The outcome of the discussion is summarized in working group papers which are published in the workshop proceedings. The papers were compiled by the editors to this manifesto.

Distributed Denial of Service (DDoS) attacks in the cloud environment are not as simple as the same attacks which occur in the traditional physical network environment. Not only one single attack is affecting the cloud environment, where as there are multiple sources to affect the environment. DDoS attacks can be detected using the existing machine learning techniques such as neural classifiers. This paper discusses on the survey carried out on DDoS attacks in the cloud environment. Using Machine learning techniques results to detection of higher false positive rates. Some of the widely used methods are ANN, SVM, kNN, J48, Feature rank and Feature selection methods to detect DDoS attacks in the cloud environment. This paper reviews various studies related to detection of network attacks in network and cloud environments.

The advancements in the field of Information and Communication Technology (ICT) have led to the development of the Internet of Things (IoT), where ordinary things (e.g. smart meters, sensors etc.) can be connected and controlled over the internet. However, an IoT network is vulnerable to many malicious network attacks due to its inherent properties like limited computational abilities, heterogeneity, massive connectivity, etc. This paper presents a feature selection technique, which uses an amalgamation of LASSO regression and correlation based techniques, to find appropriate features for IoT network attack detection. The effectiveness of the proposed mechanism was evaluated on benchmark IoT network datasets using different machine learning techniques. The results revealed that the Gradient Boosting ensemble learning model achieved a maximum attack detection accuracy of 99.98%, and outperformed the other studied models.

SummaryDetecting anomalies is crucial for maintaining security in Wireless Sensor Networks (WSNs), as they are susceptible to various attacks that compromise nodes and yield inaccurate outcomes. Conventional attack detection approaches face challenges like high false positives, vulnerability to complex attacks, and limited adaptability to changing attacks due to predefined patterns. Additionally, the computational strain on resource‐constrained nodes hampers network efficiency, demanding innovative and resilient security solutions. Therefore, this research work introduces Novel Hybrid Approaches for Privacy‐preserved Multiple Attacks Detection (NHAPMAD) framework in both network attack detection system and host attack detection system. This topology bolsters the network's defense against various types of attacks, thereby ensuring the preservation of sensitive data privacy. Federated learning has been incorporated into the NHAPMAD framework to protect user privacy in WSNs. The introduced framework provides better anomaly detection and reduces false alarms. Additionally, the introduced model protects sensitive data, ensuring the security and integrity of the entire WSN, promoting a stable and dependable operating environment. The introduced method exhibits superior performance across various metrics like overall accuracy (99.6%), F1‐score (99.59%), recall (99.47%), precision (99.63%), detection rate (99.5%), processing time (0.0009 s), etc. compared to traditional approaches, marking a significant advancement in the realm of WSN security.

This paper presents a low-latency network attack detection model based on in-network inference. Rather than employing pre-trained models or resorting to manual management, the proposed model operates in a zero-touch manner, relying exclusively on online learning aided by an IDS deployed within the control plane. Flows are classified as-soon-as-possible, enabling the mitigation with minimal delay, typically requiring only a few packets from each flow to be processed. The attack detection system was implemented using the P4 data plane programming language and was evaluated using two different types of programmable switches: CPU-based eBPF switches and the Intel Tofino hardware switch. The evaluation results demonstrate that the proposed model can achieve highly accurate attack detection, with F1 scores reaching approximately 0.95.

Context: The concern for security in IoT networks is becoming increasingly common, considering the accelerated use of these devices in recent years. Problem: Traditional methods for detecting attacks in IoT networks are ineffective due to device heterogeneity. While learning approaches show promise in threat detection, the computational limitations of IoT devices make it challenging to implement these solutions. Solution: This work proposes a deep learning solution for IoT attack detection, focusing on efficient threat mitigation using the Programming Protocol-independent Packet Processors (P4) language, adaptable feature extraction for algorithm inference, and execution on SBC devices. SI theory: This work is based on General Systems Theory and Machine Learning Theory, emphasizing integrating components in IoT networks and learning for attack detection. Methods: This study uses a case study to evaluate the effectiveness of deep learning algorithms in detecting attacks in IoT networks, adopting a descriptive and quantitative approach with metrics like accuracy and F1 score. Results: In our work, the Long Short Term Memory (LSTM), Convolutional Neural Network (CNN), and Gated Recurrent Unit (GRU) algorithms achieved accuracy rates of 96.9%, 95.6%, and 93.9%, respectively. However, the CNN model was selected for the final implementation due to its superior inference time and resource consumption performance. Contributions and impact in the IS area: This work contributes to Information Systems by integrating deep learning and P4 programming for attack detection and mitigation in IoT networks, enhancing security, and promoting further research in the field.

A digital twin (DT) is an electronic replica of a real-world item. It is built on top of asset-specific data items and is often enhanced using semantic technologies and simulation environments. The DT lays the way for anything from routine monitoring to hands-off administration of a physical entity. With the development of the metaverse concept of DT gains importance. As it helps to manage the physical entity in the metaverse. Therefore, it is beneficial to use DT for the detection and mitigation of different types of cyber attacks. In this context, we use the concept of DT for the identification and detection of DDoS attacks in the IoT network. Our proposed approach uses the concept of support vector machine (SVM) learning technique for the identification and detection of DDoS attacks. In our proposed approach, the DT of physical routers is stored in the metaverse, which makes it secure against any type of physical attack. Our proposed approach detected the malicious packets with an accuracy of 93.25% accuracy.

The problems of realizing attack detection processes in real time justify the use of a set of software and hardware that acts as an attack detection system (ADS) in a corporate computer network. Recently, the traditional individual approach to protecting a corporate network, based on the processing of its network traffic, is increasingly being improved by collective protection methods. In this case, the prevention and counteraction to unauthorized intrusions is based on active reconnaissance, processing large amounts of information stored and circulating on the Internet, creating of industry and national cyber security centers. This article considers the approach to the establishment of ADS, which use Internet resources of social networks, information from DB of international and national defense centers and also prehistory of computer corporative network attacks. It allows making forecasts of the danger state of the external environment relatively to the corporate computer network on the basis of which it is proposed to use the principles of adaptive security management of a computer network. The effective using of adaptive management, reducing the time for detecting threats, increasing productivity and optimizing the load of ADS components requires the selection of operational management procedures and tuning procedures for ADS analyzers that must operate at various computing capacities. This gives an opportunity to justify the functionality of the protection centers of corporate computer networks that can take on the tasks of configuring ADS analyzers of subordinate corporate networks connected by an integration information bus.