Optimization of Stealthwatch Network Security System for the Detection and Mitigation of Distributed Denial of Service (DDoS) Attack: Application to Smart Grid System

The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.

MA-IDS: A Distributed Intrusion Detection System Based on Data Mining

Aiming at the shortcomings in intrusion detection systems (IDSs) used incommercial and research fields, we propose the MA-IDS system, a distributed intrusion detectionsystem based on data mining. In this model, misuse intrusion detection system CM1DS) and anomalyintrusion de-lection system (AIDS) are combined. Data mining is applied to raise detectionperformance, and distributed mechanism is employed to increase the scalability and efficiency. Host-and network-based mining algorithms employ an improved. Bayes-ian decision theorem that suits forreal security environment to minimize the risks incurred by false decisions. We describe the overallarchitecture of the MA-IDS system, and discuss specific design and implementation issue.

Performance Study of Distributed Multi-Agent Intrusion Detection System

Traditional Intrusion Detection System （IDS） based on hosts or networks no longer meets the security requirements in today＇s network environment due to the increasing complexity and distributivity. A multi-agent distributed IDS model, enhanced with a method of computing its statistical values of performance is presented. This model can accomplish not only distributed information collection, but also distributed intrusion detection and real-time reaction. Owing to prompt reaction and openness, it can detect intrusion behavior of both known and unknown sources. According to preliminary tests, the accuracy ratio of intrusion detection is higher than 92% on the average.

A Distributed Intrusion Detection Model via Nondestructive Partitioning and Balanced Allocation for Big Data

There are two key issues in distributed intrusion detection system,that is,maintaining load balance of system and protecting data integrity.To address these issues,this paper proposes a new distributed intrusion detection model for big data based on nondestructive partitioning and balanced allocation.A data allocation strategy based on capacity and workload is introduced to achieve local load balance,and a dynamic load adjustment strategy is adopted to maintain global load balance of cluster.Moreover,data integrity is protected by using session reassemble and session partitioning.The simulation results show that the new model enjoys favorable advantages such as good load balance,higher detection rate and detection efficiency.

A High-level Architecture for Intrusion Detection on Heterogeneous Wireless Sensor Networks: Hierarchical, Scalable and Dynamic Reconfigurable

Networks protection against different types of attacks is one of most important posed issue into the network and information security domains. This problem on Wireless Sensor Networks (WSNs), in attention to their special properties, has more importance. Now, there are some of proposed solutions to protect Wireless Sensor Networks (WSNs) against different types of intrusions;but no one of them has a comprehensive view to this problem and they are usually designed in single-purpose;but, the proposed design in this paper has been a comprehensive view to this issue by presenting a complete Intrusion Detection Architecture (IDA). The main contribution of this architecture is its hierarchical structure;i.e. it is designed and applicable, in one, two or three levels, consistent to the application domain and its required security level. Focus of this paper is on the clustering WSNs, designing and deploying Sensor-based Intrusion Detection System (SIDS) on sensor nodes, Cluster-based Intrusion Detection System (CIDS) on cluster-heads and Wireless Sensor Network wide level Intrusion Detection System (WSNIDS) on the central server. Suppositions of the WSN and Intrusion Detection Architecture (IDA) are: static and heterogeneous network, hierarchical, distributed and clustering structure along with clusters' overlapping. Finally, this paper has been designed a questionnaire to verify the proposed idea;then it analyzed and evaluated the acquired results from the questionnaires.

Adaptive Butterfly Optimization Algorithm(ABOA)Based Feature Selection and Deep Neural Network(DNN)for Detection of Distributed Denial-of-Service(DDoS)Attacks in Cloud

Cloud computing technology provides flexible,on-demand,and completely controlled computing resources and services are highly desirable.Despite this,with its distributed and dynamic nature and shortcomings in virtualization deployment,the cloud environment is exposed to a wide variety of cyber-attacks and security difficulties.The Intrusion Detection System(IDS)is a specialized security tool that network professionals use for the safety and security of the networks against attacks launched from various sources.DDoS attacks are becoming more frequent and powerful,and their attack pathways are continually changing,which requiring the development of new detection methods.Here the purpose of the study is to improve detection accuracy.Feature Selection(FS)is critical.At the same time,the IDS’s computational problem is limited by focusing on the most relevant elements,and its performance and accuracy increase.In this research work,the suggested Adaptive butterfly optimization algorithm(ABOA)framework is used to assess the effectiveness of a reduced feature subset during the feature selection phase,that was motivated by this motive Candidates.Accurate classification is not compromised by using an ABOA technique.The design of Deep Neural Networks(DNN)has simplified the categorization of network traffic into normal and DDoS threat traffic.DNN’s parameters can be finetuned to detect DDoS attacks better using specially built algorithms.Reduced reconstruction error,no exploding or vanishing gradients,and reduced network are all benefits of the changes outlined in this paper.When it comes to performance criteria like accuracy,precision,recall,and F1-Score are the performance measures that show the suggested architecture outperforms the other existing approaches.Hence the proposed ABOA+DNN is an excellent method for obtaining accurate predictions,with an improved accuracy rate of 99.05%compared to other existing approaches.

分布式网络攻击检测系统(DIDS)

介绍了网络攻击检测系统 (IDS)的运作机理 ,分析了IDS的优缺点。针对传统IDS的问题提出了分布式IDS(DIDS)的概念 ,比较了DIDS的设计目标与目前一些IDS产品的性能。最后从功能模块设计、攻击特征的获取和更新、提高攻击行为的检测和反应速度、攻击行为关联性分析和更加主动的反应策略五个方面详细阐述了DIDS的具体设计思路 。

基于SVM的数据融合方法在DIDS中的应用

考虑到传统SVM解决传统IDS问题的困难,建立基于带概率输出信息的SVM局部信息检测和数据融合、决策分析的分布式入侵检测DIDS模型。该模型尽可能利用局部SVM分类器的优势,充分考虑了各局部SVM的性能差别。通过KDD99数据集对该模型的测试,证明该分布式入侵检测模型可以明显地降低入侵检测的漏报率,提高检测精度。

移动Agent在DIDS中应用的关键技术

移动代理作为一种先进的软件技术,可有效解决入侵检测系统分布式天然特性所带来的诸多问题。针对目前入侵检测系统的不足,将新型分布式处理技术移动Agent与入侵检测融为一体,提出了一种基于移动代理的分布式入侵检测系统(DIDS)的模型,并深入阐述了在分布式入侵检测系统中应用移动代理技术所需要解决的关键问题。

DIDS监视代理间数据融合算法的设计与实现

提出并实现用于分布式入侵检测系统中多监视代理之间协同检测的数据融合算法,实验证明该算法可以在0.07 s～1s之内检测出SYN洪水、Smurf、Land等多种分布式拒绝服务攻击,并及时采取响应措施,阻断攻击者的网络连接。该算法建立在对多数据源的数据分析基础之上,提高了入侵检测的准确性,克服了路由访问控制列表过滤的局限性,可以实现在不影响网络正常运行情况下的实时检测与报警功能。

一种应用于DIDS的实时自调整归约算法

根据归约与分布处理的思路,设计了用于分布式入侵检测系统节点的实时自调整归约算法,并在Java环境中实现.在实验平台上验证了算法的正确性并证明其有效性.实时自调整归约算法能让使用者根据实际环境改变算法参数,使归约效果、警报响应实时性和系统性能能同时接近最优,为设计高效、稳定的入侵检测系统提供了一条捷径.

一个DIDS模型的通信协议设计

文章介绍了一个旨在提高分布式入侵检测系统(DIDS)适应性和扩充性的协议模型。在简单地介绍了系统的设计模型后,给出了系统通信报文及报文格式。最后,描述了系统模型的通信过程,并介绍了如何使用给出的报文进行协议通信,实现模型目标。

基于消息安全的DIDS研究

将密码学运用到入侵检测系统中,实现入侵检测系统的安全;将agent技术和点到点技术应用到研究中,实现分布式入侵检测系统。给出系统的设计与实现方法。对系统的安全性及性能进行了分析。

一种基于代理的DIDS的构建方法

一个入侵检测系统应具有准确性、可靠性、可用性、适应性、实时性和安全性等特点。通过分析目前入侵检测系统存在的不足,提出了一个基于移动代理的分布式检测系统的模型。目前的入侵检测系统一般采用集中式的系统结构,存在单点失效、效率低等问题。使用代理技术,不但解决了传统入侵检测体系结构的瓶颈问题,同时可以对入侵行为进行追踪,收集与入侵相关的信息,决策入侵是否发生。同时还详细介绍了基于代理的DIDS的模型的体系结构、各部分的功能、系统的工作流程等。

一种基于移动代理的分布式入侵检测系统(MADIDS)设计思想

随着计算机和网络技术的普及和应用,计算机安全变得越来越重要.入侵检测是计算机安全体系结构中的一个重要的组成部分,但面对日益更新的网络环境和层出不穷的攻击方法,传统构建入侵检测系统的方法显得缺乏一定的有效性、适应性和可扩展性.本文借鉴了移动Agent技术,在将Agent技术引入入侵检测领域方面做出探索,提出了一种基于移动Agent的分布式入侵检测系统(MADIDS)的设计思想.该系统中将现在比较流行的轻量级入侵检测系统Snort与IBM的Aglet移动代理平台相结合,实现检测任务的分担,同时力求将基于主机与基于网络的入侵检测技术结合在一起,增强系统的检测能力.

A Hierarchy Distributed-Agents Model for Network Risk Evaluation Based on Deep Learning

Deep Learning presents a critical capability to be geared into environments being constantly changed and ongoing learning dynamic,which is especially relevant in Network Intrusion Detection.In this paper,as enlightened by the theory of Deep Learning Neural Networks,Hierarchy Distributed-Agents Model for Network Risk Evaluation,a newly developed model,is proposed.The architecture taken on by the distributed-agents model are given,as well as the approach of analyzing network intrusion detection using Deep Learning,the mechanism of sharing hyper-parameters to improve the efficiency of learning is presented,and the hierarchical evaluative framework for Network Risk Evaluation of the proposed model is built.Furthermore,to examine the proposed model,a series of experiments were conducted in terms of NSLKDD datasets.The proposed model was able to differentiate between normal and abnormal network activities with an accuracy of 97.60%on NSL-KDD datasets.As the results acquired from the experiment indicate,the model developed in this paper is characterized by high-speed and high-accuracy processing which shall offer a preferable solution with regard to the Risk Evaluation in Network.

DDoS Attack Detection in Cloud Computing Based on Ensemble Feature Selection and Deep Learning

Intrusion Detection System(IDS)in the cloud Computing(CC)environment has received paramount interest over the last few years.Among the latest approaches,Deep Learning(DL)-based IDS methods allow the discovery of attacks with the highest performance.In the CC environment,Distributed Denial of Service(DDoS)attacks are widespread.The cloud services will be rendered unavailable to legitimate end-users as a consequence of the overwhelming network traffic,resulting in financial losses.Although various researchers have proposed many detection techniques,there are possible obstacles in terms of detection performance due to the use of insignificant traffic features.Therefore,in this paper,a hybrid deep learning mode based on hybridizing Convolutional Neural Network(CNN)with Long-Short-Term Memory(LSTM)is used due to its robustness and efficiency in detecting normal and attack traffic.Besides,the ensemble feature selection,mutualization aggregation between Particle Swarm Optimizer(PSO),Grey Wolf Optimizer(PSO),Krill Hird(KH),andWhale Optimization Algorithm(WOA),is used to select the most important features that would influence the detection performance in detecting DDoS attack in CC.A benchmark dataset proposed by the Canadian Institute of Cybersecurity(CIC),called CICIDS 2017 is used to evaluate the proposed IDS.The results revealed that the proposed IDS outperforms the state-of-the-art IDSs,as it achieved 97.9%,98.3%,97.9%,98.1%,respectively.As a result,the proposed IDS achieves the requirements of getting high security,automatic,efficient,and self-decision detection of DDoS attacks.

一种基于移动代理的DIDS模型研究

对传统的分布式入侵检测系统（DIDS）的局限性进行了详细分析,并提出了一种基于移动代理的DIDS模型,给出了设计思想、系统结构和检测原理。该模型可有效的提高分布式入侵检测系统的安全性和适应性。

Developing a Secure Framework Using Feature Selection and Attack Detection Technique

Intrusion detection is critical to guaranteeing the safety of the data in the network.Even though,since Internet commerce has grown at a breakneck pace,network traffic kinds are rising daily,and network behavior characteristics are becoming increasingly complicated,posing significant hurdles to intrusion detection.The challenges in terms of false positives,false negatives,low detection accuracy,high running time,adversarial attacks,uncertain attacks,etc.lead to insecure Intrusion Detection System(IDS).To offset the existing challenge,the work has developed a secure Data Mining Intrusion detection system(DataMIDS)framework using Functional Perturbation(FP)feature selection and Bengio Nesterov Momentum-based Tuned Generative Adversarial Network(BNM-tGAN)attack detection technique.The data mining-based framework provides shallow learning of features and emphasizes feature engineering as well as selection.Initially,the IDS data are analyzed for missing values based on the Marginal Likelihood Fisher Information Matrix technique(MLFIMT)that identifies the relationship among the missing values and attack classes.Based on the analysis,the missing values are classified as Missing Completely at Random(MCAR),Missing at random(MAR),Missing Not at Random(MNAR),and handled according to the types.Thereafter,categorical features are handled followed by feature scaling using Absolute Median Division based Robust Scalar(AMDRS)and the Handling of the imbalanced dataset.The selection of relevant features is initiated using FP that uses‘3’Feature Selection(FS)techniques i.e.,Inverse Chi Square based Flamingo Search(ICS-FSO)wrapper method,Hyperparameter Tuned Threshold based Decision Tree(HpTT-DT)embedded method,and Xavier Normal Distribution based Relief(XavND-Relief)filter method.Finally,the selected features are trained and tested for detecting attacks using BNM-tGAN.The Experimental analysis demonstrates that the introduced DataMIDS framework produces an accurate diagnosis about the attack with low computation time.The work avoids false alarm rate of attacks and remains to be relatively robust against malicious attacks as compared to existing methods.

基于Agent的分布式入侵检测系统模型

提出了一个基于 Agent的分布式入侵检测系统模型框架 .该模型提供了基于网络和基于主机入侵检测部件的接口 ,为不同 Agent的相互协作提供了条件 .在分布式环境中 ,按照系统和网络的异常使用模式的不同特征和环境差异 ,可利用不同的 Agent进行检测 ,各 Agent相互协作 ,检测异常行为 .该模型是一个开放的系统模型 ,具有很好的可扩充性 ,易于加入新的协作主机和入侵检测 Agent,也易于扩充新的入侵检测模式 .它采用没有中心控制模块的并行 Agent检测模式 ,各 Agent之间的协作是通过它们之间的通信来完成的 ,各 Agent之间可以交流可疑信息和进行数据收集 .Agent之间各自独立 ,相互协作 ,合作完成检测任务 .另外 ,模型采用一定的状态检查和验证策略 ,保证了 Agent的自身安全和通信安全 .该模型与特定的系统应用环境无关 ,因此 。