A New Intrusion Detection Algorithm AE-3WD for Industrial Control Network

In this paper,we propose a intrusion detection algorithm based on auto-encoder and three-way decisions(AE-3WD)for industrial control networks,aiming at the security problem of industrial control network.The ideology of deep learning is similar to the idea of intrusion detection.Deep learning is a kind of intelligent algorithm and has the ability of automatically learning.It uses self-learning to enhance the experience and dynamic classification capabilities.We use deep learning to improve the intrusion detection rate and reduce the false alarm rate through learning,a denoising AutoEncoder and three-way decisions intrusion detection method AE-3WD is proposed to improve intrusion detection accuracy.In the processing,deep learning AutoEncoder is used to extract the features of high-dimensional data by combining the coefficient penalty and reconstruction loss function of the encode layer during the training mode.A multi-feature space can be constructed by multiple feature extractions from AutoEncoder,and then a decision for intrusion behavior or normal behavior is made by three-way decisions.NSL-KDD data sets are used to the experiments.The experiment results prove that our proposed method can extract meaningful features and effectively improve the performance of intrusion detection.

Machine Learning Techniques for Intrusion Detection Systems in SDN-Recent Advances,Challenges and Future Directions

Software-Defined Networking(SDN)enables flexibility in developing security tools that can effectively and efficiently analyze and detect malicious network traffic for detecting intrusions.Recently Machine Learning(ML)techniques have attracted lots of attention from researchers and industry for developing intrusion detection systems(IDSs)considering logically centralized control and global view of the network provided by SDN.Many IDSs have developed using advances in machine learning and deep learning.This study presents a comprehensive review of recent work ofML-based IDS in context to SDN.It presents a comprehensive study of the existing review papers in the field.It is followed by introducing intrusion detection,ML techniques and their types.Specifically,we present a systematic study of recent works,discuss ongoing research challenges for effective implementation of ML-based intrusion detection in SDN,and promising future works in this field.

A Comprehensive Analysis of Datasets for Automotive Intrusion Detection Systems

Recently,automotive intrusion detection systems(IDSs)have emerged as promising defense approaches to counter attacks on in-vehicle networks(IVNs).However,the effectiveness of IDSs relies heavily on the quality of the datasets used for training and evaluation.Despite the availability of several datasets for automotive IDSs,there has been a lack of comprehensive analysis focusing on assessing these datasets.This paper aims to address the need for dataset assessment in the context of automotive IDSs.It proposes qualitative and quantitative metrics that are independent of specific automotive IDSs,to evaluate the quality of datasets.These metrics take into consideration various aspects such as dataset description,collection environment,and attack complexity.This paper evaluates eight commonly used datasets for automotive IDSs using the proposed metrics.The evaluation reveals biases in the datasets,particularly in terms of limited contexts and lack of diversity.Additionally,it highlights that the attacks in the datasets were mostly injected without considering normal behaviors,which poses challenges for training and evaluating machine learning-based IDSs.This paper emphasizes the importance of addressing the identified limitations in existing datasets to improve the performance and adaptability of automotive IDSs.The proposed metrics can serve as valuable guidelines for researchers and practitioners in selecting and constructing high-quality datasets for automotive security applications.Finally,this paper presents the requirements for high-quality datasets,including the need for representativeness,diversity,and balance.

FIDS:Filtering-Based Intrusion Detection System for In-Vehicle CAN

Modern vehicles are equipped with multiple Electronic Control Units(ECUs)that support various convenient driving functions,such as the Advanced Driver Assistance System(ADAS).To enable communication between these ECUs,the Controller Area Network(CAN)protocol is widely used.However,since CAN lacks any security technologies,it is vulnerable to cyber attacks.To address this,researchers have conducted studies on machine learning-based intrusion detection systems(IDSs)for CAN.However,most existing IDSs still have non-negligible detection errors.In this paper,we pro-pose a new filtering-based intrusion detection system(FIDS)to minimize the detection errors of machine learning-based IDSs.FIDS uses a whitelist and a blacklist created from CAN datasets.The whitelist stores the cryptographic hash value of normal packet sequences to correct false positives(FP),while the blacklist corrects false negatives(FN)based on transmission intervals and identifiers of CAN packets.We evaluated the performance of the proposed FIDS by implementing a machine learning-based IDS and applying FIDS to it.We conducted the evaluation using two CAN attack datasets provided by the Hacking and Countermeasure Research Lab(HCRL),which confirmed that FIDS can effectively reduce the FP and FN of the existing IDS.

Correlation Composition Awareness Model with Pair Collaborative Localization for IoT Authentication and Localization

Secure authentication and accurate localization among Internet of Things(IoT)sensors are pivotal for the functionality and integrity of IoT networks.IoT authentication and localization are intricate and symbiotic,impacting both the security and operational functionality of IoT systems.Hence,accurate localization and lightweight authentication on resource-constrained IoT devices pose several challenges.To overcome these challenges,recent approaches have used encryption techniques with well-known key infrastructures.However,these methods are inefficient due to the increasing number of data breaches in their localization approaches.This proposed research efficiently integrates authentication and localization processes in such a way that they complement each other without compromising on security or accuracy.The proposed framework aims to detect active attacks within IoT networks,precisely localize malicious IoT devices participating in these attacks,and establish dynamic implicit authentication mechanisms.This integrated framework proposes a Correlation Composition Awareness(CCA)model,which explores innovative approaches to device correlations,enhancing the accuracy of attack detection and localization.Additionally,this framework introduces the Pair Collaborative Localization(PCL)technique,facilitating precise identification of the exact locations of malicious IoT devices.To address device authentication,a Behavior and Performance Measurement(BPM)scheme is developed,ensuring that only trusted devices gain access to the network.This work has been evaluated across various environments and compared against existing models.The results prove that the proposed methodology attains 96%attack detection accuracy,84%localization accuracy,and 98%device authentication accuracy.

A Case Study on Security Recommendations for a Global Organization

In today’s world, computer networks form an essential part of any organization. They are used not only to communicate information amongst the various parties involved but also to process data and store critical information which is accessible to approved subscribers. Protecting critical data, ensuring confidentiality, and thwarting illegal access are primary concerns for such organizations. This case study presents security recommendations for any such organization, to assist them in defining security policies at various levels of the network infrastructure.

继电保护远程运维系统报文合规检测及入侵阻断技术应用

继电保护远程运维中数据传输各环节存在网络入侵风险,现有安全措施未有效处理业务层风险,且存在风险阻断不及时等问题。为此,提出一种报文合规检测方法及入侵阻断技术,分析报文的对象、格式、业务逻辑和行为模式,建立报文合规规则库及不合规报文阻断策略,设计开发不合规报文阻断模块及“一键阻断”紧急控制模块。通过模拟仿真环境测试,结果表明,上述技术对不同类型异常报文进行的阻断效果与预期一致,可有效阻断非法入侵攻击,从而提高继电保护远程运维的安全性和稳定性。

基于MobileViT轻量化网络的车载CAN入侵检测方法

车载控制区域网络(controller area network,CAN)总线因缺少安全措施而易被攻击,因此入侵检测系统(intrusion detection system,IDS)在保护车载CAN总线免受网络攻击中发挥着重要作用.现有基于深度学习的车载CAN总线入侵检测方法存在资源开销大和延迟较高的问题.为减少检测延迟,提高检测率,提出一种利用改进的轻量化MobileViT模型对车载CAN总线进行入侵检测的方法.首先,将攻击流量可视化为彩色图,再使用GELU替换MobileViT的MV2模块中常规ReLU6,从而作为该模块的激活函数,可有效解决神经元死亡问题,提升模型收敛速度.使用指数衰减自动更新学习率,并通过迁移学习加速训练过程实现对彩色图分类,从而达到对入侵行为的检测.基于CAR-HACKING DATASET数据集的实验表明,改进后的MobileViT在消耗较少算力的情况下对入侵行为的检测准确率为100%,模型参数仅为2.12 MB,平均响应时间仅为1.6 ms,节省了训练资源,并保证了检测的准确率.

面向工艺数据分析的流程工业入侵检测及攻击定位

为解决攻击者利用流程工业生产中深度耦合的工序参数进行生产过程攻击的问题,提出一种基于SSA-LSTM的深度学习算法,对工艺数据进行异常检测。通过麻雀优化算法优化LSTM神经网络的迭代次数、学习率和隐藏层节点数三个超参数,实现对工艺数据的准确预测。将预测数据与真实数据进行对比,超出阈值的点定义为异常点,再运用Petri网理论对生产工艺参数间的耦合关系进行建模,确定异常点与入侵点之间的因果关系,为预测结果提供理论支撑。将SWAT水处理系统数据集用于验证算法效率,证明了所提出的模型在检测精度和攻击定位准确性方面优于其他算法模型。实验结果表明,所提出的算法模型可有效检测出通过暴力篡改传感器数据对工业生产造成重大影响的入侵行为。

数据中心机房网络通信安全架构的设计与实施

随着数据中心在现代信息基础设施中的重要性不断提升,数据中心的网络通信安全面临越来越多的挑战。通过分析数据中心网络架构的现状及其主要安全挑战,概述其网络通信安全需求。同时,提出一套综合的安全架构设计方案,涵盖安全分区与网络分段、边界安全防护、数据加密与传输安全、访问控制与身份验证机制以及入侵检测与防御系统设计。最后,通过案例分析和安全效果评估,验证所提方案的有效性和可行性,为提升数据中心的网络通信安全性提供理论基础和实践指导。

企业网络安全防护技术研究与应用

在信息技术飞速发展的今天,企业网络安全防护技术研究和应用已成为信息安全领域中的一个中心课题。本研究首先简要描述了网络安全防护技术的各种分类和局限性,然后深入分析了网络入侵检测、数据加密和访问控制,以及安全信息与事件管理(Security Information and Event Managemen,SIEM)技术的最新研究进展。随后,对防火墙和入侵防御系统、虚拟私人网络和远程访问技术以及SIEM在现代企业的具体应用进行了详细描述。本文在深入分析上述技术及具体案例的基础上,致力于为企业提供更完善、更有效的网络安全解决方案。

局域网环境背景下的计算机网络安全技术应用分析

在局域网环境背景下,计算机网络安全技术的应用尤为重要。通过分析局域网环境下计算机网络安全技术的现状和应用,探讨如何保障网络安全,提高网络防护能力。针对局域网环境的特殊性,研究并提出相应的网络安全策略和解决方案,以确保数据的安全性和机密性。同时,介绍一些实用的网络安全技术和工具,帮助读者更好地了解和应用网络安全技术,从而保障局域网的安全稳定运行。

安全局域网的设计和实现

该文详细分析了局域网的安全问题，重点研究讨论了安全局域网的功能需求。给出了一种基于Ｗｉｎｄｏｗｓ的安全局域网的实现与设计方案。

火电厂工控系统网络安全风险及防护

火电厂工控系统快速发展的同时,带来了诸如木马、病毒、网络攻击等安全风险。本文从火电厂工控系统实现的功能出发,分析了其在系统结构和维护管理方面所面临的网络安全风险,总结了国内外工控系统网络安全相关制度、标准和主要防护技术的研究进展情况,提出了将网络安全防护理念融入设计、建设、运行维护等全生命周期,从构建健壮网络架构、采用主动防御技术及建立高效管理制度等方面进行综合防护的措施。

分布式协同入侵检测—系统结构设计与实现问题

本文首先对现有入侵检测技术提出了一种综合分类方法 ,分析了大规模、多管理域网络环境对入侵检测的特殊需求 .在此基础上设计了一个分布式协同入侵检测系统 (DCIDS) ,文中具体介绍了系统的四个组成部分 :传感器、分析器、管理器和用户界面 ,并讨论了系统实现中的通信、与网络管理系统的集成、入侵检测点的选择等关键技术问题 .

僵尸网络命令与控制信道的特征提取模型研究

僵尸网络发起的分布式拒绝服务攻击、垃圾邮件发送以及敏感信息窃取等恶意活动已经成为网络安全面临的重要威胁。命令与控制信道正是僵尸网络操纵这些恶意活动的唯一途径。利用命令与控制信道中攻击命令具有相对固定的格式和命令字的特点,基于现有的特征提取技术,针对边缘网络的可疑流量,提出了一个新型的特征提取模型。实验结果表明,该模型能够准确地提取出具有命令格式的特征,而且由这些特征转化的入侵检测规则能够有效识别感染的僵尸主机。

无线自组网的安全问题综述

无中心、自组织和资源受限等特点给无线自组网的安全性带来了新的问题和挑战。通过介绍无线自组网面临的安全问题特殊之处,给出了无线自组网的安全目标和策略。在此基础上,系统归纳和分析了可用于增强无线自组网安全性的各种措施和机制,介绍一种多重安全防御方案,并展望了今后研究工作的方向。

网络疑似入侵环境下的最优接口访问控制模型仿真

在网络疑似入侵环境下通过最优接口访问控制实现网络入侵的可靠性拦截,保障网络安全;传统方法采用自由链路分散控制模型进行网络入侵检测和接口访问控制,在受到较大的特征干扰下,入侵访问控制和拦截性能不好;提出一种基于自适应循环堆栈接口调度的网络疑似入侵环境下的最优接口访问控制模型;进行接口访问控制模型总体设计及组件模块分析,接口访问控制系统包括通信库、协议库、核心控制库和资源库,采用小波包自适应波束调制方法进行入侵检测算法设计,作为接口访问控制系统软件核心;通过SDICmdCon寄存器设置网络疑似入侵环境下的最优接口的内核,在嵌入式Linux环境下通过自适应循环堆栈接口调度实现接口访问控制的软件开发;仿真结果表明,采用该模型进行网络入侵检测,准确检测性能较好,通过最优接口访问控制,实现对网络入侵数据的准确识别和拦截。

分布式入侵检测技术在网络控制系统中的应用

随着控制系统复杂性的日益扩大,控制系统的网络化是控制系统发展的必然。自动控制、计算机网络和通讯技术的融合,为实现控制和管理信息一体化提供了一条新思路,但也带来以一系列安全问题,如何保障网络控制系统的安全是当前控制网络信息建设的研究热点。文中通过分析网络控制系统的结构和对网络安全的要求,提出了将分布式入侵检测技术运用到网络控制系统的具体方案,并对相关技术和网络安全体系的建设进行了讨论。

物联网应用中802.11无线局域网拒绝服务攻击研究

针对物联网应用所面临的无线拒绝服务攻击,利用排队理论研究WiFi设备通信资源的消耗特征,探求无线拒绝服务攻击下通信资源快速耗尽的原因,研发解决拒绝服务攻击的技术。此研究将有助于物联网应用的大力推广及健康发展。