Softwar-defined vehicle network security using blockchain approach.

A typical Software-Defined Vehicular Network (SDVN) is open to various cyberattacks because of its centralized controller-based framework. A cyberattack, such as a Distributed Denial of Service (DDoS) attack, can easily overload the central SDVN controller. Thus, we require a functional DDoS attack recognition system that can differentiate malicious traffic from normal data traffic. The proposed architecture comprises hybrid Classical-Quantum Machine Learning (QML) methods for detecting DDoS threats. In this work, we have considered three different QML methods, such as Classical-Quantum Neural Networks (C-QNN), Classical-Quantum Boltzmann Machines (C-QBM), and Classical-Quantum K-Means Clustering (C-QKM). Emulations were conducted using a custom-built vehicular network with random movements and varying speeds between 0 and 100 kmph. Also, the performance of these QML methods was analyzed for two different datasets. The results obtained show that the hybrid Classical-Quantum Neural Network (C-QNN) method exhibited better performance in comparison with the other two models. The proposed hybrid C-QNN model achieved an accuracy of 99% and 90% for the UNB-CIC-DDoS dataset and Kaggle DDoS dataset, respectively. The hybrid C-QNN model combines PennyLane’s quantum circuits with traditional methods, whereas the Classical-Quantum Boltzmann Machine (C-QBM) leverages quantum probability distributions for identifying anomalies.

In the detection process of server network storm attack, the traditional method takes the signal detection algorithm, because the attack number is large, the detection error is big.According to the problem, an improved server network storm attack detection method is proposed based on improved density clustering algorithm, the server network storm attack detection problem is transformed into a multi class classification problem, wrapper features selection model is taken, IDBC network connection record distance calculation method is combined, based on DBSCAN clustering results, the data clustering and attack detection is obtained.Simulation results show that, the improved density clustering algorithm is applied in detection of server network storm attack, it can reduce the detection error, the performance of the detection system is improved.

The detection of computer network attacks is becoming increasingly important as the complexity of cyber-attacks threatening information systems and infrastructure continues to rise. To address these threats, artificial intelligence techniques have become a primary focus in the development of more effective attack detection systems. One algorithm that has proven reliable in this context is the C4.5 decision tree. This study aims to apply the C4.5 algorithm in network attack detection using a dataset that includes various types of attacks and network activities. The process includes data preprocessing, decision tree model building, and model performance evaluation. The results show that the C4.5 decision tree algorithm is effective in classifying network activities into attacks and normal activities with a satisfactory level of accuracy. The model successfully recognizes attack-related patterns, and further analysis identifies key factors influencing attack detection. This research provides a significant contribution to the development of reliable and efficient attack detection systems in computer networks. By applying the C4.5 decision tree algorithm, it is expected to help enhance information security and protect network infrastructure from increasingly complex cyber threats

The problem of the network security is taken up since eighties (Denning et al., 1987) and is developed up today (Beltilch et al., 2004, Bera, 2010, Dasgupta, 1999, Basile, 2007, Wilson, 1999). A major problem of automatic intrusion detection is that, it is difficult to make a difference between normal and abnormal user behaviour. Intrusion detection system should not only recognise the previously known patterns of attacks, but also react in case of appearance of the new events that violate the network security policy. The distributed nature of the task of the network security monitoring requires applying of the distributed tools for network security maintaining. The most important postulate addressed to the intrusion detection systems is that, such systems should automatically react in case of detecting the security policy breach to prevent the attack execution or to reduce the potential loss in the network systems. Intrusion detection systems should be equipped with the components responsible for the permanent observation of the states of monitored nodes and components that integrate the results of these observations and diagnose the security level of the system (Kolaczek et al., 2005, Nguyen et al., 2006). A comprehensive survey of anomaly detection systems is presented in (Patcha & Park, 2007) and a comparison of different approaches to intrusion detection systems is given in (Bejtlich, 2004). One of the first agent systems for network security monitoring has been proposed in works (Balasubramaniyet et al., 1998, Spafford & Zamboni, 2000). In work (Kolaczek et al., 2005) a framework of an original proposal of the intrusion detection system based on the multi-agent approach was presented. In particular, the architecture of such a system and the task of agents were specified. Proposed ideas were further developed and in work (Nguyen et al., 2006) the problem of anomalies detection on the basis of the nodes traffic analysis was discussed. The proposal of the method for Denial of Service Attack detection was given in (Prusiewicz, 2008a). In this work we propose a novel framework of a multi-agent system for anomaly detection. The originality of our solution consists of applying the social network approach to Man in the Middle Attack (MITM) detection in a network system. Our proposal is based on the social networks discovery and their characteristics measurement to detect anomalies in network traffic. We assume that network communication between nodes constitutes social network of users and their applications, so the appropriate methods of social network formal analysis can be applied. The other important assumption is that values of these social

The complexity of the Internet and the volume of network traffic have dramatically increased in the last few years, making it more challenging to design scalable Network Traffic Monitoring and Analysis (NTMA) systems. Critical NTMA applications such as the detection of network attacks and anomalies require fast mechanisms for on-line analysis of thousands of events per second, as well as efficient techniques for off-line analysis of massive historical data. The high-dimensionality of network data provided by current network monitoring systems opens the door to the massive application of machine learning approaches to improve the detection and classification of network attacks and anomalies, but this higher dimensionality comes with an extra data processing overhead. In this paper we present Big-DAMA, a big data analytics framework (BDAF) for NTMA applications. Big-DAMA is a flexible BDAF, capable to analyze and store big amounts of both structured and unstructured heterogeneous data sources, with both stream and batch processing capabilities. Big-DAMA uses off-the-shelf big data storage and processing engines to offer both stream data processing and batch processing capabilities, decomposing separate engines for stream, batch and query, following a Data Stream Warehouse (DSW) paradigm. Big-DAMA implements several algorithms for anomaly detection and network security using supervised and unsupervised machine learning (ML) models, using off-the-shelf ML libraries. We apply Big-DAMA to the detection of different types of network attacks and anomalies, benchmarking multiple supervised ML models. Evaluations are conducted on top of real network measurements collected at the WIDE backbone network, using the well-known MAWILab dataset for attacks labeling. Big-DAMA can speed up computations by a factor of 10 when compared to a standard Apache Spark cluster, and can be easily deployed in cloud environments, using hardware virtualization technology.

The financial market stress of 2008, triggered by the collapse of Lehman Brothers, underscored the critical need for efficient collateral management in financial transactions. This research focuses on developing and simulating a blockchain platform designed to automate the collateral value adjustment in securities lending transactions, where the key stakeholders include financial institutions, market participants, and regulatory bodies. The platform proposes innovative transaction flows and algorithms to manage collateral automatically, significantly making risk management more effective and reducing administrative costs. The study’s methodology includes 1) designing a blockchain platform for automated collateral management, 2) developing and testing collateral value adjustment algorithms, and 3) conducting case studies with real stock and bond price data to evaluate the platform’s effectiveness. A notable outcome of this research is the reduced credit risk and liquidity compared to traditional procedures, based on the benefit of collateral diversification enabled by the automated algorithms employing multiple tokens as collaterals. This research contributes to the field of transdisciplinary engineering by integrating financial and technological disciplines, particularly in leveraging blockchain technology for financial applications. Furthermore, the study reflects on broader societal impacts, such as improving the efficiency and security of financial transactions, potentially stabilizing market volatility, and offering insights for policy-making in sound and robust settlement systems.

In view of all kinds of network attacks which may affect the network security of the smart grid system, an attack detection algorithm is proposed, feature extraction and training to the data such as server logs is carried out based on Hidden Markov model (HMM) to achieve the network attack detection in smart grid system. By the proposed algorithm, analysis on real data of the smart grid system in one power company is carried out, which can effectively identify common types and numbers of network attack types. Through the proposed smart grid network attack detection algorithm, network security risks in the smart grid system can be found, and the level of network security is improved.

Security is nonnegotiable key point for in-vehicle networking. However, all communication between Electrical Control Unites (ECU) still suffer from security drawbacks like highly processing time or preserving confidentiality, integrity and authenticity. In this paper, we propose an approach to assess the feasibility of a private Blockchain technology to overcome the aforementioned drawbacks. In this approach, we consider in-vehicle networking contains two parts, namely, central (or connected) gateway (cGW) and switches. cGW and switches are Blockchain nodes, wherein Blockchain consensus protocols are what keep all the nodes on a network synchronized with each other. The approach considers any communication type between ECUs as an individual event, which can be a transaction, data entry or application execution. A use case of secure communication between two ECUs is presented as an evaluation mechanism for securing in-vehicle networking using the proposed Blockchain approach.

Scalable Blockchain Architecture using off-chain IPFS for Marks Card Validation

Currently, the internet serves as the predominant means of communication and is utilized by a vast number of individuals worldwide. Simultaneously, the commercial aspect of the internet is contributing to a rise in susceptibility to cybercrimes, leading to a significant surge in the occurrence of distributed Denial of Service (DDoS) assaults over the last decade. DoS/DDoS assaults primarily target network resources such as network bandwidth, CPU time, memory consumption, web servers, and network switches. Network security is an essential and crucial problem in the modern interconnected society. Numerous studies have been undertaken by multiple researchers thus far in order to identify this attack. However, there is still room for improvement in past investigations. This paper presents a novel approach for detecting and simulating DoS/DDoS attacks in modern networking environments, introducing a new paradigm. It is done in a controlled environment. The primary focus of this work is to simulate an attacker's perspective of a DoS/DDoS attack by repeatedly sending huge SYN flood packets to a specific target or network server using the hping3 tool. On the server side, the proposed attacker detector script continuously monitors incoming network connections on the network server using the netstat command. It identifies potential DoS/DDoS attacks by analyzing the connection count and comparing connections count with an assumed threshold. This experiment results in 61% CPU usage and 7.1% memory consumption while a DDoS attack triggers on the target server. Additionally, the proposed script performs statistical analysis and displays warning messages on the console when suspicious activity is detected on the network server. Wireshark is also utilized in this work to detect anomalous network traffic patterns in order to identify distributed denial-ofservice (DDoS) attacks that are targeting a network server. Additionally, it offers the capability to block the IP address of the attacker if the configuration allows for it. This proposed approach efficiently identifies DDoS activity in real-time network traffic, further helping to improve network security.

All along changing connectivity requirements and new technologies have increased the complexity and dynamism of distributed system, thus presenting tough challenges for the network management and the network security. As a result new ways for monitoring and managing of security events are required. We present a novel idea how to exploit the software defined networking (SDN) and the real-time network anomaly detection to an efficient whole that offers for an operator both, a view of the security state of the network and the ability to immediately react to the changed situation. We use the man-in-the-middle attack detection as an example.

Virtual network embedding (VNE) refers to the process of mapping virtual networks onto physical networks, which can improve the utilization and flexibility of network resources. However, due to the complexity of VNE problems and the requirement for network security, how to efficiently complete VNE and ensure network security is important. In this article, we analyze the characteristics of the cloud–edge–terminal collaborative vehicular network and design a resource allocation mechanism based on VNEVNE, abbreviated as DRLS-VNE. First, we establish a multidimensional heterogeneous network model and design a five-layer neural network as the deep reinforcement learning (DRL) agent. The DRL agent can adaptively extract network feature attributes, thereby improving the performance of DRLS-VNE. Second, we introduce a dynamic trust evaluation mechanism, which can evaluate the trustworthiness of each node in the virtual network in real time and set embedding constraints based on the evaluation results. Finally, we conduct experiments to verify the practicality and effectiveness of DRLS-VNE. The experimental results show that our solution can significantly enhance the performance of the VNE solution.

Attack Traffic Classification (ATC) technique is an essential tool for Industrial Control System (ICS) network security, which can be widely used in active defense, situational awareness, attack source traceback and so on. At present, the state-of-the-art ATC methods are usually based on traffic statistical features and machine learning techniques, including supervised classification methods and unsupervised clustering methods. However, it is difficult for these methods to overcome the problems of lack of attack samples and high real-time requirement in ATC in Supervisory Control and Data Acquisition (SCADA) networks. In order to address the above problems, we propose a self-growing ATC model based on a new density-based heuristic clustering method, which can continuously and automatically detect and distinguish different kinds of unknown attack traffic generated by various attack tools against SCADA networks in real time. An effective representation method of SCADA network traffic is proposed to further improve the performance of ATC. In addition, a large number of experiments are conducted on a compound dataset consisting of the SCADA network dataset, the attack tool dataset and the ICS honeypot dataset, to evaluate the proposed method. The experimental results show that the proposed method outperforms existing state-of-the-art ATC methods in the crucial situation of only normal SCADA network traffic.

Internet of Things (IoT) has created huge vibes in the technology arena. It has been pivotal in providing cutting-edge solutions in diversified fields. Few applications include smart homes, smart cities, medical, transport and logistics. IoT provides real-time data exchange through wired or wireless networks with no standards being developed to regulate the flow of information within system. As such, the security and access control in the IoT has become an issue of prominence. Now days, researchers understood the potentiality of the Blockchain (BC) in context with the security and authentication. More specifically the decentralized nature of BC makes it apt for integration with the IoT networks. In this paper, we propose a model that makes use of the blockchain concept to bridle the security and authentication problems in the IoT network. We consider various factors that effect this integration of blockchain and IoT. Our investigations conclude that this hybrid model is powerful and can provide significant transformations in building novel applications across distributed platforms.

Nowadays, networks are exposed to a set of risks and threats that can potentially cause damage and losses for companies. The security of networks must be assessed in order to measure the effectiveness of the protective measures that have been implemented. However, the impact of the dynamic behavior of these systems on the attacker's strategy is rarely considered. In this paper, we propose an attack graph-based solution that consider the evolution of system properties such as network topology changes, vulnerability discovery and patching, as well as attack detection and wiping of some system components. The topology of the attack graph evolves over time considering the evolution of the system state. Several simulations of the attacker infiltration in the system are performed by following the attack paths present in the attack graph in order to assess the security of the system. The proposed solution has been tested on a use case where a user is in remote work. By considering the changes in the network topology, new attack paths can be identified.