SPARK and SAD: Leading-edge deep learning frameworks for robust and effective intrusion detection in SCADA systems

In this paper we study the influence of key-scheduling algorithms on the strength of blockciphers. We show that the key-scheduling algorithms of many blockciphers inherit obvious relationships between keys, and use these key relations to attack the blockciphers. Two new types of attacks are described: New chosen plaintext reductions of the complexity of exhaustive search attacks (and the faster variants based on complementation properties), and new low-complexity chosen key attacks. These attacks are independent of the number of rounds of the cryptosystems and of the details of the F-function and may have very small complexities. These attacks show that the key-scheduling algorithm should be carefully designed and that its structure should not be too simple. These attacks are applicable to both variants of LOKI and to Lucifer. DES is not vulnerable to the related keys attacks since the shift pattern in the key-scheduling algorithm is not the same in all the rounds.

Improvement of attack detection performance on the internet of things with PSO-search and random forest

Intrusion Detection Systems (IDS) is one of the important aspects of cyber security that can detect the anomalies in the network traffic. IDS are a part of Second defense line of a system that can be deployed along with other security measures such as access control, authentication mechanisms and encryption techniques to secure the systems against cyber-attacks. However, IDS suffers from the problem of handling large volume of data and in detecting zero-day attacks (new types of attacks) in a real-time traffic environment. To overcome this problem, an intelligent Deep Learning approach for Intrusion Detection is proposed based on Convolutional Neural Network (CNN-IDS). Initially, the model is trained and tested under a new real-time traffic dataset, CSE-CIC-IDS 2018 dataset. Then, the performance of CNN-IDS model is studied based on three important performance metrics namely, accuracy / training time, detection rate and false alarm rate. Finally, the experimental results are compared with those of various Deep Discriminative models including Recurrent Neural network (RNN), Deep Neural Network (DNN) etc., proposed for IDS under the same dataset. The Comparative results show that the proposed CNN-IDS model is very much suitable for modelling a classification model both in terms of binary and multi-class classification with higher detection rate, accuracy, and lower false alarm rate. The CNN-IDS model improves the accuracy of intrusion detection and provides a new research method for intrusion detection.

Malware Detection and Analysis play a primary role in information access points such as workstations, servers, cloud storage, and mobile devices. Securing information from malware is a challenging task, and existing anti-malware applications suffer from detecting new types of attacks. In recent years, machine learning-based malware detection techniques have been applied for effective malware detection and analysis for existing and new types of malware with few drawbacks such as misclassification and increased complexity. To overcome this, the chapter focuses on adopting deep learning (DL) models to build an anti-malware application via modern Artificial Intelligence (AI) techniques. Quantum Machine Learning (QML) is a research area that explores the interplay of ideas from quantum computing and machine learning. The proposed framework is built with various DeepNet Models to improve predicted accuracy, which can carry out universal quantum computations. QML performs the information processing with quantum computers relies on substantially different laws of physics called quantum theory. Initially, executable files will be converted to binary files and forwarded to DeepNet Models to multi-classify the novel variants of malware. A comprehensive survey is carried out on the implementation of ML/DL models for malware detection and analysis by considering various factors.

The internet and computer networks are exposed to an increasing number of security threats. With new types of attacks appearing continuously, developing flexible and adaptive security oriented approaches is a severe challenge. In this context, intrusion detection technique is a valuable technology to protect target systems and networks against malicious activities. But this system doesn't provide the required accuracy. Thus to meet this requirement, this paper proposes an intrusion detection system as a model based on Proximal Support Vector Machines (PSVMs) implemented with various combination of basic kernel functions. PSVM is a light and simple modification of support vector machine. We have implemented PSVM for binary classification of intrusion detection data. For experimental training and testing NSL- KDD dataset is preprocessed using Principle Component Analysis technique. Using proposed classification model, we have achieved up to 79% classification accuracy.

Intrusion detection system has been a powerful weapon to protect networks from attacks and has gained more and more attention. Data mining has been proven as an important method to detect intrusions. It has been the recent research focus and trend to apply data mining techniques in intrusion detection system for discovering new types of attacks, but it is still in its infancy. This paper reviews the new development of association rules mining technologies for intrusion detection in wired as well as wireless networks. The challenges and advanced developments of technologies to use association rule mining for intrusion detection are discussed.

Deep learning (DL) has exhibited its exceptional performance in fields like intrusion detection. Various augmentation methods have been proposed to improve data quality and eventually to enhance the performance of DL models. However, the classic augmentation methods cannot be applied to those DL models which exploit the system-call sequences to detect intrusion. Previously, the seq2seq model has been explored to augment system-call sequences. Following this work, we propose a gated convolutional neural network (GCNN) model to thoroughly extract the potential information of augmented sequences. Also, in order to enhance the model’s robustness, we adopt adversarial training to reduce the impact of adversarial examples on the model. Adversarial examples used in adversarial training are generated by the proposed adversarial sequence generation algorithm. The experimental results on different verified models show that GCNN model can better obtain the potential information of the augmented data and achieve the best performance. Furthermore, GCNN with adversarial training can enhance robustness significantly.

Objective: To design a deep transfer learning framework for modeling fluence map predictions for stereotactic body radiation therapy (SBRT) of adrenal cancer and similar sites that usually have a small number of cases. Approach: We developed a transfer learning framework for adrenal SBRT planning that leverages knowledge in a pancreas SBRT planning model. Treatment plans from the two sites had different dose prescriptions and beam settings but both prioritized gastrointestinal sparing. A base framework was first trained with 100 pancreas cases. This framework consists of two convolutional neural networks (CNN), which predict individual beam doses (BD-CNN) and fluence maps (FM-CNN) sequentially for 9-beam intensity-modulated radiation therapy (IMRT) plans. Forty-five adrenal plans were split into training/validation/test sets with the ratio of 20/10/15. The base BD-CNN was re-trained with transfer learning using 5/10/15/20 adrenal training cases to produce multiple candidate adrenal BD-CNN models. The base FM-CNN was directly used for adrenal cases. The deep learning (DL) plans were evaluated by several clinically relevant dosimetric endpoints, producing a percentage score relative to the clinical plans. Main results: Transfer learning significantly reduced the number of training cases and training time needed to train such a DL framework. The adrenal transfer learning model trained with 5/10/15/20 cases achieved validation plan scores of 85.4/91.2/90.7/89.4, suggesting that model performance saturated with 10 training cases. Meanwhile, a model using all 20 adrenal training cases without transfer learning only scored 80.5. For the final test set, the 5/10/15/20-case models achieved scores of 73.5/75.3/78.9/83.3. Significance: It is feasible to use deep transfer learning to train an IMRT fluence prediction framework. This technique could adapt to different dose prescriptions and beam configurations. This framework potentially enables DL modeling for clinical sites that have a limited dataset, either due to few cases or due to rapid technology evolution.

With the fast development of 5G networks, the need to ensure that these networks are secured against cyber threats, which are advanced and constantly evolving, is of immense importance. In this paper, an intrusion detection system based on deep learning using a hybrid Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) architecture is introduced to meet the security requirements of 5G wireless networks. The model also showed high accuracy, precision, and recall when training and testing on various publicly available datasets (CICIDS 2017 and NSL-KDD) by identifying different types of attacks, namely Distributed Denial of Service (DDoS), SQL Injection, and Advanced Persistent Threats (APT). Findings reveal that the CNN-LSTM model performs better compared to standard machine learning models such as Support Vector Machines (SVM) and Decision Tree, scoring high with regard to detection abilities and optimizing computing requirements. The model is an effective intrusion detection method in real-time despite training time and latency issues, it is a very useful solution to the fast-developing intrusion detection scenario involving the dynamic 5G network. The study offers an insight into the possibility of deep learning methods in boosting cybersecurity in 5G networks and lays the foundation for newer advances in network security systems. Keywords: 5G Networks, Intrusion Detection System (Ids), Deep Learning, Cnn, Lstm, Hybrid Model, Cybersecurity, Real-Time Detection, Network Security, Machine Learning, Ddos, Apt, Attack Detection.

A comprehensive empirical study on bug characteristics of deep learning frameworks

Intrusion detection system (IDS) using machine learning approach is getting popularity as it has an advantage of getting updated by itself to defend against any new type of attack. Another emerging technology, called internet of things (IoT) is taking the responsibility to make automated system by communicating the devices without human intervention. In IoT based systems, the wireless communication between several devices through the internet causes vulnerability for different security threats. This paper proposes a novel unified intrusion detection system for IoT environment (UIDS) to defend the network from four types of attacks such as: exploit, DoS, probe, and generic. The system is also able to detect normal category of network traffic. Most of the related works on IDS are based on KDD99 or NSL-KDD 99 data sets which are unable to detect new type of attacks. In this paper, UNSW-NB15 data set is considered as the benchmark dataset to design UIDS for detecting malicious activities in the network. The performance analysis proves that the attack detection rate of the proposed model is higher compared to two existing approaches ENADS and DENDRON which also worked on UNSW-NB15 data set.

Nowadays, with the rapid increase in the number of applications and networks, the number of cyber multi-step attacks has been increasing exponentially. Thus, the need for a reliable and acceptable Intrusion Detection System (IDS) solution is becoming urgent to protect the networks and devices. However, implementing a robust IDS needs a reliable and up-to-date dataset in order to capture the behaviors of the new types of attacks especially a multi-step attack. In this paper, a new benchmark Multi-Step Cyber-Attack Dataset (MSCAD) is introduced. MSCAD includes two multi-step scenarios; the first scenario is a password cracking attack, and the second attack scenario is a volume-based Distributed Denial of Service (DDoS) attack. The MSCAD was assessed in two manners; firstly, the MSCAD was used to train IDS. Then, the performance of IDS was evaluated in terms of G-mean and Area Under Curve (AUC). Secondly, the MSCAD was compared with other free open-source and public datasets based on the latest keys criteria of a dataset evaluation framework. The results show that IDS-based MSCAD achieved the best performance with G-mean 0.83 and obtained good accuracy to detect the attacks. Besides, the MSCAD successfully passing twelve keys criteria.

In this paper, classifications of intrusion detection and methods of data mining applied on them were introduced. Then, intrusion detection system design and implementation of based on data mining were presented. Such a system used APRIORI algorithm to analyse data association, which is the most influencing algorithm in mining Boolean association rules continuity item muster, with recurrence arithmetic based on idea of two period continuity item muster as core. Experiments showed that new type of attack can be detected effectively in the system, and knowledge base can be updated automatically, so the efficiency and accuracy of the intrusion detection were improved, and security of the network was enhanced.

<p class="Abstract">Internet of things (IoT) systems have experienced significant growth in data traffic, resulting in security and real-time processing issues. Intrusion detection systems (IDS) are currently an indispensable tool for self-protection against various attacks. However, IoT systems face serious challenges due to the functional diversity of attacks, resulting in detection methods with machine learning (ML) and limited static models generated by the linear discriminant analysis (LDA) algorithm. The process entails adjusting the model parameters in real time as new data arrives. This paper proposes a new method of an IDS based on the LDA algorithm with the incremental model. The model framework is trained and tested on the IoT intrusion dataset (UNSW-NB15) using the streaming linear discriminant analysis (SLDA) ML algorithm. Our approach increased model accuracy after each training, resulting in continuous model improvement. The comparison reveals that our dynamic model becomes more accurate after each batch and can detect new types of attacks.</p>

Intrusion detection is very important to solve an increasing number of security threats. With new types of attack appearing continually, traditional approaches for detecting hazardous contents are facing a severe challenge. In this work, a new feature grouping method is proposed to select features for intrusion detection. The method is based on agglomerative hierarchical clustering method and is tested against KDD CUP 99 dataset. Agglomerative hierarchical clustering method is used to construct a hierarchical tree and it is combined with mutual information theory. Groups are created from the hierarchical tree by a given number. The largest mutual information between each feature and a class label within a certain group is then selected. The performance evaluation results show that better classification performance can be attained from such selected features.