A New Intrusion Detection Algorithm AE-3WD for Industrial Control Network

In this paper,we propose a intrusion detection algorithm based on auto-encoder and three-way decisions(AE-3WD)for industrial control networks,aiming at the security problem of industrial control network.The ideology of deep learning is similar to the idea of intrusion detection.Deep learning is a kind of intelligent algorithm and has the ability of automatically learning.It uses self-learning to enhance the experience and dynamic classification capabilities.We use deep learning to improve the intrusion detection rate and reduce the false alarm rate through learning,a denoising AutoEncoder and three-way decisions intrusion detection method AE-3WD is proposed to improve intrusion detection accuracy.In the processing,deep learning AutoEncoder is used to extract the features of high-dimensional data by combining the coefficient penalty and reconstruction loss function of the encode layer during the training mode.A multi-feature space can be constructed by multiple feature extractions from AutoEncoder,and then a decision for intrusion behavior or normal behavior is made by three-way decisions.NSL-KDD data sets are used to the experiments.The experiment results prove that our proposed method can extract meaningful features and effectively improve the performance of intrusion detection.

Machine Learning Techniques for Intrusion Detection Systems in SDN-Recent Advances,Challenges and Future Directions

Software-Defined Networking(SDN)enables flexibility in developing security tools that can effectively and efficiently analyze and detect malicious network traffic for detecting intrusions.Recently Machine Learning(ML)techniques have attracted lots of attention from researchers and industry for developing intrusion detection systems(IDSs)considering logically centralized control and global view of the network provided by SDN.Many IDSs have developed using advances in machine learning and deep learning.This study presents a comprehensive review of recent work ofML-based IDS in context to SDN.It presents a comprehensive study of the existing review papers in the field.It is followed by introducing intrusion detection,ML techniques and their types.Specifically,we present a systematic study of recent works,discuss ongoing research challenges for effective implementation of ML-based intrusion detection in SDN,and promising future works in this field.

A Comprehensive Analysis of Datasets for Automotive Intrusion Detection Systems

Recently,automotive intrusion detection systems(IDSs)have emerged as promising defense approaches to counter attacks on in-vehicle networks(IVNs).However,the effectiveness of IDSs relies heavily on the quality of the datasets used for training and evaluation.Despite the availability of several datasets for automotive IDSs,there has been a lack of comprehensive analysis focusing on assessing these datasets.This paper aims to address the need for dataset assessment in the context of automotive IDSs.It proposes qualitative and quantitative metrics that are independent of specific automotive IDSs,to evaluate the quality of datasets.These metrics take into consideration various aspects such as dataset description,collection environment,and attack complexity.This paper evaluates eight commonly used datasets for automotive IDSs using the proposed metrics.The evaluation reveals biases in the datasets,particularly in terms of limited contexts and lack of diversity.Additionally,it highlights that the attacks in the datasets were mostly injected without considering normal behaviors,which poses challenges for training and evaluating machine learning-based IDSs.This paper emphasizes the importance of addressing the identified limitations in existing datasets to improve the performance and adaptability of automotive IDSs.The proposed metrics can serve as valuable guidelines for researchers and practitioners in selecting and constructing high-quality datasets for automotive security applications.Finally,this paper presents the requirements for high-quality datasets,including the need for representativeness,diversity,and balance.

FIDS:Filtering-Based Intrusion Detection System for In-Vehicle CAN

Modern vehicles are equipped with multiple Electronic Control Units(ECUs)that support various convenient driving functions,such as the Advanced Driver Assistance System(ADAS).To enable communication between these ECUs,the Controller Area Network(CAN)protocol is widely used.However,since CAN lacks any security technologies,it is vulnerable to cyber attacks.To address this,researchers have conducted studies on machine learning-based intrusion detection systems(IDSs)for CAN.However,most existing IDSs still have non-negligible detection errors.In this paper,we pro-pose a new filtering-based intrusion detection system(FIDS)to minimize the detection errors of machine learning-based IDSs.FIDS uses a whitelist and a blacklist created from CAN datasets.The whitelist stores the cryptographic hash value of normal packet sequences to correct false positives(FP),while the blacklist corrects false negatives(FN)based on transmission intervals and identifiers of CAN packets.We evaluated the performance of the proposed FIDS by implementing a machine learning-based IDS and applying FIDS to it.We conducted the evaluation using two CAN attack datasets provided by the Hacking and Countermeasure Research Lab(HCRL),which confirmed that FIDS can effectively reduce the FP and FN of the existing IDS.

Correlation Composition Awareness Model with Pair Collaborative Localization for IoT Authentication and Localization

Secure authentication and accurate localization among Internet of Things(IoT)sensors are pivotal for the functionality and integrity of IoT networks.IoT authentication and localization are intricate and symbiotic,impacting both the security and operational functionality of IoT systems.Hence,accurate localization and lightweight authentication on resource-constrained IoT devices pose several challenges.To overcome these challenges,recent approaches have used encryption techniques with well-known key infrastructures.However,these methods are inefficient due to the increasing number of data breaches in their localization approaches.This proposed research efficiently integrates authentication and localization processes in such a way that they complement each other without compromising on security or accuracy.The proposed framework aims to detect active attacks within IoT networks,precisely localize malicious IoT devices participating in these attacks,and establish dynamic implicit authentication mechanisms.This integrated framework proposes a Correlation Composition Awareness(CCA)model,which explores innovative approaches to device correlations,enhancing the accuracy of attack detection and localization.Additionally,this framework introduces the Pair Collaborative Localization(PCL)technique,facilitating precise identification of the exact locations of malicious IoT devices.To address device authentication,a Behavior and Performance Measurement(BPM)scheme is developed,ensuring that only trusted devices gain access to the network.This work has been evaluated across various environments and compared against existing models.The results prove that the proposed methodology attains 96%attack detection accuracy,84%localization accuracy,and 98%device authentication accuracy.

继电保护远程运维系统报文合规检测及入侵阻断技术应用

继电保护远程运维中数据传输各环节存在网络入侵风险,现有安全措施未有效处理业务层风险,且存在风险阻断不及时等问题。为此,提出一种报文合规检测方法及入侵阻断技术,分析报文的对象、格式、业务逻辑和行为模式,建立报文合规规则库及不合规报文阻断策略,设计开发不合规报文阻断模块及“一键阻断”紧急控制模块。通过模拟仿真环境测试,结果表明,上述技术对不同类型异常报文进行的阻断效果与预期一致,可有效阻断非法入侵攻击,从而提高继电保护远程运维的安全性和稳定性。

基于MobileViT轻量化网络的车载CAN入侵检测方法

车载控制区域网络(controller area network,CAN)总线因缺少安全措施而易被攻击,因此入侵检测系统(intrusion detection system,IDS)在保护车载CAN总线免受网络攻击中发挥着重要作用.现有基于深度学习的车载CAN总线入侵检测方法存在资源开销大和延迟较高的问题.为减少检测延迟,提高检测率,提出一种利用改进的轻量化MobileViT模型对车载CAN总线进行入侵检测的方法.首先,将攻击流量可视化为彩色图,再使用GELU替换MobileViT的MV2模块中常规ReLU6,从而作为该模块的激活函数,可有效解决神经元死亡问题,提升模型收敛速度.使用指数衰减自动更新学习率,并通过迁移学习加速训练过程实现对彩色图分类,从而达到对入侵行为的检测.基于CAR-HACKING DATASET数据集的实验表明,改进后的MobileViT在消耗较少算力的情况下对入侵行为的检测准确率为100%,模型参数仅为2.12 MB,平均响应时间仅为1.6 ms,节省了训练资源,并保证了检测的准确率.

面向工艺数据分析的流程工业入侵检测及攻击定位

为解决攻击者利用流程工业生产中深度耦合的工序参数进行生产过程攻击的问题,提出一种基于SSA-LSTM的深度学习算法,对工艺数据进行异常检测。通过麻雀优化算法优化LSTM神经网络的迭代次数、学习率和隐藏层节点数三个超参数,实现对工艺数据的准确预测。将预测数据与真实数据进行对比,超出阈值的点定义为异常点,再运用Petri网理论对生产工艺参数间的耦合关系进行建模,确定异常点与入侵点之间的因果关系,为预测结果提供理论支撑。将SWAT水处理系统数据集用于验证算法效率,证明了所提出的模型在检测精度和攻击定位准确性方面优于其他算法模型。实验结果表明,所提出的算法模型可有效检测出通过暴力篡改传感器数据对工业生产造成重大影响的入侵行为。

企业网络安全防护技术研究与应用

在信息技术飞速发展的今天,企业网络安全防护技术研究和应用已成为信息安全领域中的一个中心课题。本研究首先简要描述了网络安全防护技术的各种分类和局限性,然后深入分析了网络入侵检测、数据加密和访问控制,以及安全信息与事件管理(Security Information and Event Managemen,SIEM)技术的最新研究进展。随后,对防火墙和入侵防御系统、虚拟私人网络和远程访问技术以及SIEM在现代企业的具体应用进行了详细描述。本文在深入分析上述技术及具体案例的基础上,致力于为企业提供更完善、更有效的网络安全解决方案。

局域网环境背景下的计算机网络安全技术应用分析

在局域网环境背景下,计算机网络安全技术的应用尤为重要。通过分析局域网环境下计算机网络安全技术的现状和应用,探讨如何保障网络安全,提高网络防护能力。针对局域网环境的特殊性,研究并提出相应的网络安全策略和解决方案,以确保数据的安全性和机密性。同时,介绍一些实用的网络安全技术和工具,帮助读者更好地了解和应用网络安全技术,从而保障局域网的安全稳定运行。

A Case Study on Security Recommendations for a Global Organization

In today’s world, computer networks form an essential part of any organization. They are used not only to communicate information amongst the various parties involved but also to process data and store critical information which is accessible to approved subscribers. Protecting critical data, ensuring confidentiality, and thwarting illegal access are primary concerns for such organizations. This case study presents security recommendations for any such organization, to assist them in defining security policies at various levels of the network infrastructure.

内生安全支撑的新型网络体系结构与关键技术研究构想与成果展望

目前,网络威胁已进入未知威胁时代。然而,传统网络安全基于“马奇诺”式的静态被动防御,缺乏自主性以及自我演化进化的内生安全能力,对未知威胁基本上只能通过“打补丁”的方式事后弥补。这种亡羊补牢的处理方法往往伴随巨大的损失,必须寻求新的思路。网络安全保护系统与人体免疫系统具有惊人的相似性,免疫系统无需病毒先验知识,学习推演能力强,天生具备未知病毒的灭活能力。有鉴于此,本文以“未知威胁”为核心,以“人工免疫”为创新手段,紧紧围绕未知威胁环境下网络安全系统自身演进机理、未知威胁环境下网络自适应可信传输条件、不完备条件下未知威胁快速发现机制,以及不完备条件下未知威胁快速应对策略等四大关键科学问题,分别开展1个基础理论、3大关键技术及1套原型系统的研究。通过面向内生安全基于免疫的新型网络体系结构与基础理论,基于mRNA免疫的可信任网络寻址与路由控制技术、大规模动态可信行为分析与未知网络威胁发现技术、基于免疫的网络动态风险评估与控制技术等研究,突破传统网络安全以“打补丁”为主被动防御的技术瓶颈,藉此奠定内生安全免疫支撑的新型网络系统的基础理论和方法。通过构建一个面向内生安全基于免疫的新型网络原型系统,对研究成果进行技术验证,同时根据验证结果对所提出理论及方法进行改进和提高。通过上述研究实现以下5个方面创新:一是,面向内生安全的网络空间安全免疫体系结构;二是,基于mRNA免疫的可信任网络寻址与路由控制方法;三是,基于基因进化演化的未知网络威胁自适应发现方法;四是,基于人体体温预警机制的网络动态风险实时定量计算方法;五是,基于特异性免疫的快速动态反馈迭代网络风险控制方法。本研究成果对网络空间安全保护的科学研究、技术研发、产业发展等具有十分重要的理论意义和实际应用价值。

基于以太网的列车控制网络信息安全技术研究

基于以太网的列车控制网络存在非法外联、网络攻击等信息安全隐患。本文结合轨道交通信息安全技术、相关技术标准的要求,总结了以太网列车控制网络的相关特点,阐述了信息安全相关防护技术及相关要求;针对以太网列车控制网络的主要信息安全风险因素,提出了边界防护、访问控制、入侵及恶意代码防范、安全审计等信息安全防护措施,并提出一套车载信息安全防护系统技术方案,解决以太网列车控制网络的信息安全问题。

分布式入侵检测系统在烟草生产工业控制网络中的应用

工业控制网络是一种专门服务于工业网络建设及发展的控制网络技术,已经被应用于烟草生产工业等领域。分布式入侵检测系统在烟草生产工业控制网络中的应用,能提高烟草生产效率及安全性,并加快烟草生产工业的网络建设及发展速度。但在烟草生产工业控制网络中,依然存在木马病毒、蠕虫、人为攻击等网络安全问题,轻者会导致企业的重要信息及私密文件泄露,重者会直接给企业造成巨大的经济损失,因此必须在烟草生产工业的控制网络中应用入侵检测系统。

安全局域网的设计和实现

该文详细分析了局域网的安全问题，重点研究讨论了安全局域网的功能需求。给出了一种基于Ｗｉｎｄｏｗｓ的安全局域网的实现与设计方案。

火电厂工控系统网络安全风险及防护

火电厂工控系统快速发展的同时,带来了诸如木马、病毒、网络攻击等安全风险。本文从火电厂工控系统实现的功能出发,分析了其在系统结构和维护管理方面所面临的网络安全风险,总结了国内外工控系统网络安全相关制度、标准和主要防护技术的研究进展情况,提出了将网络安全防护理念融入设计、建设、运行维护等全生命周期,从构建健壮网络架构、采用主动防御技术及建立高效管理制度等方面进行综合防护的措施。

分布式协同入侵检测—系统结构设计与实现问题

本文首先对现有入侵检测技术提出了一种综合分类方法 ,分析了大规模、多管理域网络环境对入侵检测的特殊需求 .在此基础上设计了一个分布式协同入侵检测系统 (DCIDS) ,文中具体介绍了系统的四个组成部分 :传感器、分析器、管理器和用户界面 ,并讨论了系统实现中的通信、与网络管理系统的集成、入侵检测点的选择等关键技术问题 .

僵尸网络命令与控制信道的特征提取模型研究

僵尸网络发起的分布式拒绝服务攻击、垃圾邮件发送以及敏感信息窃取等恶意活动已经成为网络安全面临的重要威胁。命令与控制信道正是僵尸网络操纵这些恶意活动的唯一途径。利用命令与控制信道中攻击命令具有相对固定的格式和命令字的特点,基于现有的特征提取技术,针对边缘网络的可疑流量,提出了一个新型的特征提取模型。实验结果表明,该模型能够准确地提取出具有命令格式的特征,而且由这些特征转化的入侵检测规则能够有效识别感染的僵尸主机。

无线自组网的安全问题综述

无中心、自组织和资源受限等特点给无线自组网的安全性带来了新的问题和挑战。通过介绍无线自组网面临的安全问题特殊之处,给出了无线自组网的安全目标和策略。在此基础上,系统归纳和分析了可用于增强无线自组网安全性的各种措施和机制,介绍一种多重安全防御方案,并展望了今后研究工作的方向。

分布式入侵检测技术在网络控制系统中的应用

随着控制系统复杂性的日益扩大,控制系统的网络化是控制系统发展的必然。自动控制、计算机网络和通讯技术的融合,为实现控制和管理信息一体化提供了一条新思路,但也带来以一系列安全问题,如何保障网络控制系统的安全是当前控制网络信息建设的研究热点。文中通过分析网络控制系统的结构和对网络安全的要求,提出了将分布式入侵检测技术运用到网络控制系统的具体方案,并对相关技术和网络安全体系的建设进行了讨论。