A Normalizing Flow-Based Bidirectional Mapping Residual Network for Unsupervised Defect Detection

Unsupervised methods based on density representation have shown their abilities in anomaly detection,but detection performance still needs to be improved.Specifically,approaches using normalizing flows can accurately evaluate sample distributions,mapping normal features to the normal distribution and anomalous features outside it.Consequently,this paper proposes a Normalizing Flow-based Bidirectional Mapping Residual Network(NF-BMR).It utilizes pre-trained Convolutional Neural Networks(CNN)and normalizing flows to construct discriminative source and target domain feature spaces.Additionally,to better learn feature information in both domain spaces,we propose the Bidirectional Mapping Residual Network(BMR),which maps sample features to these two spaces for anomaly detection.The two detection spaces effectively complement each other’s deficiencies and provide a comprehensive feature evaluation from two perspectives,which leads to the improvement of detection performance.Comparative experimental results on the MVTec AD and DAGM datasets against the Bidirectional Pre-trained Feature Mapping Network(B-PFM)and other state-of-the-art methods demonstrate that the proposed approach achieves superior performance.On the MVTec AD dataset,NF-BMR achieves an average AUROC of 98.7%for all 15 categories.Especially,it achieves 100%optimal detection performance in five categories.On the DAGM dataset,the average AUROC across ten categories is 98.7%,which is very close to supervised methods.

RRCNN: Request Response-Based Convolutional Neural Network for ICS Network Traffic Anomaly Detection

Nowadays,industrial control system(ICS)has begun to integrate with the Internet.While the Internet has brought convenience to ICS,it has also brought severe security concerns.Traditional ICS network traffic anomaly detection methods rely on statistical features manually extracted using the experience of network security experts.They are not aimed at the original network data,nor can they capture the potential characteristics of network packets.Therefore,the following improvements were made in this study:(1)A dataset that can be used to evaluate anomaly detection algorithms is produced,which provides raw network data.(2)A request response-based convolutional neural network named RRCNN is proposed,which can be used for anomaly detection of ICS network traffic.Instead of using statistical features manually extracted by security experts,this method uses the byte sequences of the original network packets directly,which can extract potential features of the network packets in greater depth.It regards the request packet and response packet in a session as a Request-Response Pair(RRP).The feature of RRP is extracted using a one-dimensional convolutional neural network,and then the RRP is judged to be normal or abnormal based on the extracted feature.Experimental results demonstrate that this model is better than several other machine learning and neural network models,with F1,accuracy,precision,and recall above 99%.

Classified VPN Network Traffic Flow Using Time Related to Artificial Neural Network

VPNs are vital for safeguarding communication routes in the continually changing cybersecurity world.However,increasing network attack complexity and variety require increasingly advanced algorithms to recognize and categorizeVPNnetwork data.We present a novelVPNnetwork traffic flowclassificationmethod utilizing Artificial Neural Networks(ANN).This paper aims to provide a reliable system that can identify a virtual private network(VPN)traffic fromintrusion attempts,data exfiltration,and denial-of-service assaults.We compile a broad dataset of labeled VPN traffic flows from various apps and usage patterns.Next,we create an ANN architecture that can handle encrypted communication and distinguish benign from dangerous actions.To effectively process and categorize encrypted packets,the neural network model has input,hidden,and output layers.We use advanced feature extraction approaches to improve the ANN’s classification accuracy by leveraging network traffic’s statistical and behavioral properties.We also use cutting-edge optimizationmethods to optimize network characteristics and performance.The suggested ANN-based categorization method is extensively tested and analyzed.Results show the model effectively classifies VPN traffic types.We also show that our ANN-based technique outperforms other approaches in precision,recall,and F1-score with 98.79%accuracy.This study improves VPN security and protects against new cyberthreats.Classifying VPNtraffic flows effectively helps enterprises protect sensitive data,maintain network integrity,and respond quickly to security problems.This study advances network security and lays the groundwork for ANN-based cybersecurity solutions.

Unsupervised Anomaly Detection for Network Flow Using Immune Network Based K-means Clustering

To detect effectively unknown anomalous attack behaviors of network traffic,an Unsupervised Anomaly Detection approach for network flow using Immune Network based K-means clustering(UADINK)is proposed.In UADINK,artificial immune network based K-means clustering algorithm(aiNet_KMC)is introduced to cluster network flow,i.e.extracting abstract internal images from network flows and obtaining an optimizing parameter K of K-means by aiNet model,and network flows are clustered by K-means algorithm.The cluster labeling algorithm(clusLA)and the network flow anomaly detection algorithm(NFAD)are introduced to detect anomalous attack behaviors of network flows,where the clusLA algorithm is used for labeling whether each cluster belongs to malicious,and the labeled clusters are regarded as detectors to identify anomaly network flows by NFAD.To evaluate the effectiveness of UADINK,the ISCX 2012 IDS dataset is considered as the simulating experimental dataset.Compared with the NDM based K-means anomaly detection approach,the results show that UADINK is a radical anomaly detection approach in order to detect anomalies of network flows.

A Multi-Stage Network Anomaly Detection Method for Improving Efficiency and Accuracy

Because of an explosive growth of the intrusions, necessity of anomaly-based Intrusion Detection Systems (IDSs) which are capable of detecting novel attacks, is increasing. Among those systems, flow-based detection systems which use a series of packets exchanged between two terminals as a unit of observation, have an advantage of being able to detect anomaly which is included in only some specific sessions. However, in large-scale networks where a large number of communications takes place, analyzing every flow is not practical. On the other hand, a timeslot-based detection systems need not to prepare a number of buffers although it is difficult to specify anomaly communications. In this paper, we propose a multi-stage anomaly detection system which is combination of timeslot-based and flow-based detectors. The proposed system can reduce the number of flows which need to be subjected to flow-based analysis but yet exhibits high detection accuracy. Through experiments using data set, we present the effectiveness of the proposed method.

An Efficient Intrusion Detection Framework in Software-Defined Networking for Cybersecurity Applications

Network management and multimedia data mining techniques have a great interest in analyzing and improving the network traffic process.In recent times,the most complex task in Software Defined Network(SDN)is security,which is based on a centralized,programmable controller.Therefore,monitoring network traffic is significant for identifying and revealing intrusion abnormalities in the SDN environment.Consequently,this paper provides an extensive analysis and investigation of the NSL-KDD dataset using five different clustering algorithms:K-means,Farthest First,Canopy,Density-based algorithm,and Exception-maximization(EM),using the Waikato Environment for Knowledge Analysis(WEKA)software to compare extensively between these five algorithms.Furthermore,this paper presents an SDN-based intrusion detection system using a deep learning(DL)model with the KDD(Knowledge Discovery in Databases)dataset.First,the utilized dataset is clustered into normal and four major attack categories via the clustering process.Then,a deep learning method is projected for building an efficient SDN-based intrusion detection system.The results provide a comprehensive analysis and a flawless reasonable study of different kinds of attacks incorporated in the KDD dataset.Similarly,the outcomes reveal that the proposed deep learning method provides efficient intrusion detection performance compared to existing techniques.For example,the proposed method achieves a detection accuracy of 94.21%for the examined dataset.

Adaptive and augmented active anomaly detection on dynamic network traffic streams

Active anomaly detection queries labels of sampled instances and uses them to incrementally update the detection model,and has been widely adopted in detecting network attacks.However,existing methods cannot achieve desirable performance on dynamic network traffic streams because(1)their query strategies cannot sample informative instances to make the detection model adapt to the evolving stream and(2)their model updating relies on limited query instances only and fails to leverage the enormous unlabeled instances on streams.To address these issues,we propose an active tree based model,adaptive and augmented active prior-knowledge forest(A3PF),for anomaly detection on network trafic streams.A prior-knowledge forest is constructed using prior knowledge of network attacks to find feature subspaces that better distinguish network anomalies from normal traffic.On one hand,to make the model adapt to the evolving stream,a novel adaptive query strategy is designed to sample informative instances from two aspects:the changes in dynamic data distribution and the uncertainty of anomalies.On the other hand,based on the similarity of instances in the neighborhood,we devise an augmented update method to generate pseudo labels for the unlabeled neighbors of query instances,which enables usage of the enormous unlabeled instances during model updating.Extensive experiments on two benchmarks,CIC-IDS2017 and UNSW-NB15,demonstrate that A3PF achieves significant improvements over previous active methods in terms of the area under the receiver operating characteristic curve(AUC-ROC)(20.9%and 21.5%)and the area under the precision-recall curve(AUC-PR)(44.6%and 64.1%).

A Method for Detecting Wide-scale Network Traffic Anomalies

Network traffic anomalies refer to the traffic changed abnormally and obviously.Local events such as temporary network congestion,Distributed Denial of Service(DDoS)attack and large-scale scan,or global events such as abnormal network routing,can cause network anomalies.Network anomaly detection and analysis are very important to Computer Security Incident Response Teams(CSIRT).But wide-scale traffic anomaly detection requires extracting anomalous modes from large amounts of high-dimensional noise-rich data,and interpreting the modes;so,it is very difficult.This paper proposes a general method based on Principle Component Analysis(PCA)to analyze network anomalies.This method divides the traffic matrix into normal and anomalous subspaces,maps traffic vectors into the normal subspace,gets the distance from detected vector to average normal vector,and detects anomalies based on that distance.

Deep Learning Based Intrusion Detection in Cloud Services for Resilience Management

In the global scenario one of the important goals for sustainable development in industrial field is innovate new technology,and invest in building infrastructure.All the developed and developing countries focus on building resilient infrastructure and promote sustainable developments by fostering innovation.At this juncture the cloud computing has become an important information and communication technologies model influencing sustainable development of the industries in the developing countries.As part of the innovations happening in the industrial sector,a new concept termed as‘smart manufacturing’has emerged,which employs the benefits of emerging technologies like internet of things and cloud computing.Cloud services deliver an on-demand access to computing,storage,and infrastructural platforms for the industrial users through Internet.In the recent era of information technology the number of business and individual users of cloud services have been increased and larger volumes of data is being processed and stored in it.As a consequence,the data breaches in the cloud services are also increasing day by day.Due to various security vulnerabilities in the cloud architecture;as a result the cloud environment has become non-resilient.To restore the normal behavior of the cloud,detect the deviations,and achieve higher resilience,anomaly detection becomes essential.The deep learning architectures-based anomaly detection mechanisms uses various monitoring metrics characterize the normal behavior of cloud services and identify the abnormal events.This paper focuses on designing an intelligent deep learning based approach for detecting cloud anomalies in real time to make it more resilient.The deep learning models are trained using features extracted from the system level and network level performance metrics observed in the Transfer Control Protocol(TCP)traces of the simulation.The experimental results of the proposed approach demonstrate a superior performance in terms of higher detection rate and lower false alarm rate when compared to the Support Vector Machine(SVM).

基于UNet3+生成对抗网络的视频异常检测

为解决传统视频异常检测方法在不同场景下多尺度特征提取不完全的问题,提出两种方法:一种是用于简单场景的基于UNet3+的生成对抗网络方法(简称U3P^(2)),另一种是用于复杂场景的基于UNet++的生成对抗网络方法(简称UP^(3))。两种方法分别对连续输入的视频帧生成预测,引入多种损失函数和光流模型学习其外观与运动信息,通过计算AUC进行性能评估。U3P^(2)方法以6.3 M参数量在Ped2数据集的AUC提升约0.6%,而UP^(3)方法在Avenue数据集的AUC提升约0.8%,验证其能够有效应对不同场景下的异常检测任务。

基于深度学习的Android恶意软件动态检测

为提高Android恶意软件的检测精度,提出一种基于改进DenseNet网络的Android恶意软件动态检测方法。以应用软件运行特定阶段的网络通信流量为分析对象,根据会话五元组信息切分原始网络流量并转换为灰度图,提出一种基于DenseNet网络改进的分类检测网络DenseNet_IS。通过添加具有不同大小卷积核的卷积分支获取不同感受野的特征,通过引入SimAM注意力模块,从空间和通道两个维度实现对重要特征的关注。结合应用软件判决机制,实现最终分类。在CICAndMal2017数据集上的实验结果表明,所提方法可以达到99.06%的良恶性检测精度和96.51%的多分类精度,验证了该方法的有效性。

融合1D-CNN与BiGRU的类不平衡流量异常检测

网络流量异常检测是利用各种检测技术分析判断网络流量,发现网络中潜在的攻击,是一种有效的网络安全防护方法。针对高维海量数据和不同攻击类别的网络流量数据不均衡而导致检测准确率低、误报率高的问题,提出一种融合一维卷积神经网络(1D-CNN)和双向门控循环单元(BiGRU)的类不平衡流量异常检测模型。首先,针对类不平衡数据,通过使用改进的合成少数类过采样技术(SMOTE)即Borderline-SMOTE和基于高斯混合模型(GMM)的欠采样聚类技术进行平衡处理;然后,使用1D-CNN提取数据的局部特征,并利用BiGRU更好地提取数据中的时序特征;最后,在UNSW-NB15数据集对所提模型进行验证,所提模型的准确率为98.12%,误报率为1.28%。结果表明,所提模型提高了对少数攻击的识别率,检测精度高于其他经典机器学习和深度学习模型。

动态生成Shapelet的网络流量异常检测

当前网络流量异常检测方法大多针对流量特征集构建检测算法,为充分利用网络流量本身数据信息,降低对人为构建特征集的依赖,采用原始网络流量数据,基于对抗性动态Shapelet网络(ADSN),动态学习Shapelet时序特征,提出一种单尺度输入的ADSN(S-ADSN)流量异常检测方法。将网络会话流中用于建立连接的数据转换为时间序列,基于S-ADSN对原始流量序列样本动态学习和生成Shapelet时序特征,计算Shapelet与流量序列之间的距离向量并通过分类器判断流量类别。实验结果表明,所提方法能够动态获取具有辨识性的流量时序特征,具有可解释性和早期检测性优点,实现较高的恶意流量检测精度。

基于S-UBayFS特征选择的网络流量异常检测方法

研究网络流量异常检测的方法,针对传统机器学习方法的局限性,提出一种基于S-UBayFS-GRU的检测算法。该算法分为3个步骤:利用SNHA算法从大量的网络流量特征中筛选出有因果关系的特征,形成“关联链”;利用“关联链”和网络安全领域知识,给特征赋值权重和侧面约束,用UBayFS算法进行特征选择,降低特征维度,提高特征质量;利用GRU循环神经网络对筛选后的特征进行学习和预测,实现网络流量异常检测。实验结果表明,提出的S-UBayFS-GRU算法在各项评价指标上均优于其他方法。

交互博弈引导的网络流量异常检测建模方法研究

基于网络流量的系统入侵会带来严重破坏,因此寻找能够准确识别和分类异常流量的方法具有重要的研究价值。数据作为基于机器学习模型的检测算法的唯一依据,训练过程对于外界是一个黑盒过程,整个模型在训练和使用过程中缺乏用户交互。这导致在网络运维场景中,专业运维人员不能根据当前模型检测结果,实时将指导信息反馈到系统中,进而削弱了系统的场景适应能力和检测纠错能力。本文基于强化学习过程,设计了一种基于动态贝叶斯博弈的交互引导式的网络流量异常检测方法。通过检测模型和运维人员交互的方式,在训练过程中让运维人员提供专业反馈使得模型获得外界针对当前检测效果的奖惩信号,从而对自身特征聚焦方向和收敛过程起到引导的作用。将运维人员和检测模型视为博弈的双方,建立博弈模型,使双方之间的交互引导行为达到动态平衡状态。通过博弈对于模型交互频次和内容反馈给出指导,从而使得模型具有动态适应当前场景的能力,有效控制了人机交互反馈所带来的系统开销。实验部分验证了交互式博弈的流量检测方法中,双方博弈指导交互行为的可行性与有效性,证明了该方法在动态场景中具有良好的适应能力。相较于传统的机器学习方法,交互引导式模型提高了模型整体的检测性能。性能对比测试结果表明交互频次每增加0.02%,系统整体检测性能随之提升0.01%。

一种基于半监督学习的网络异常流量检测方法

针对网络流量数据存在标记样本获取困难、实际数据类别不平衡等问题,提出一种合成数据增强的半监督网络异常流量检测方法(SEASAND)。SEASAND利用无标记数据辅助模型学习,只需少量的有标签数据即可达到较高识别准确率,降低了训练成本。考虑一致性正则和熵最小化原则,通过混合采样解决网络流量数据不平衡的问题,并采用混合样本算法对样本进行二次数据增强,提高了对无标记数据的利用效率。最后利用一维残差网络Resnet1D 18对数据增强后的数据集进行训练。SEASAND在KDDCup9910、UNSW-NB15、CICIDS2017数据集上进行仿真实验,结果表明,与相关算法对比,SEASAND在少样本、多分类问题上具有较好的性能,降低了对有标记样本量的需求。

基于数据包头序列的物联网恶意流量检测

现有的基于机器学习(ML)的恶意流量检测方法,通常以高维的流量特征作为输入,并采用复杂模型,在实践中产生高误报率且资源占用较高。更重要的是,加密协议的广泛使用,使得数据包有效载荷特征很难被访问。幸运的是,物联网(IoT)设备的网络行为通常是有规律和周期性的,该特征反映在通信数据包序列上,每个数据包一定程度上描述了一次网络事件。基于此,本文提出了基于数据包头序列的恶意流量检测方法。它将流量序列转换为网络事件序列,并计算一组特征(即序列性、频率性、周期性和爆发性)来描述网络行为。实验环境包含一组真实的物联网设备,并将提出的方法部署在树莓派模拟的网关上。实验结果表明,与最新的检测方法相比,本文提出的方法能够在复杂网络环境下保持高准确性和低误报率,并提升了处理速率。

双特征层次嵌入的多维时序异常检测方法

开展多维时序特征下的工业实体设备实时运行状态在线异常检测,对维护复杂工业系统稳定运行、推动国家经济发展提质增效具有重要意义。针对现有异常检测方法对时序数据高度非线性的时间依赖关系及其模式多样的维度耦合关系分析不足的问题,综合考虑监控数据分布未知导致训练数据中可能掺杂噪声或异常数据的情况,提出双特征层次嵌入的多维时序异常检测方法。通过循环神经网络对时序特征数据进行处理,引入流模型仿射机制拓展数据分布并得到时间嵌入变量,捕捉长时间序列的全局及局部特征;与此同时,利用变分自编码器将多维输入映射到潜空间,共享时间嵌入的流模型参数,基于门控循环单元对维度间的耦合关系进一步关联分析,充分挖掘多维时序数据的时间依赖性和维度相关性,提高异常检测准确率。在5个权威公开的多维时序数据集上开展实验,与12种典型时序异常检测方法进行对比,所提算法在多种评价指标上的平均排名均位列第一,验证了所提方法的先进性和有效性。

基于网络流跟踪的信号灯检测方法

结合信号灯信息对机动车行进速度进行引导,减少机动车启停次数,可有效减少废气排放,缓解其造成的污染问题。针对信号灯转换时刻的获取问题,提出了一种基于网络流跟踪的信号灯检测方法。首先,该方法在数据集中引入辅助信号灯类别进行训练,将视频序列中该类目标检测结果关联为踪片,并通过踪片建模多目标跟踪任务。其次,该方法将多目标跟踪任务转换为最小费用流优化任务,以踪片作为节点建立最小费用流网络,提出了适合于信号灯的费用构建方式,通过最短路径算法求解,得到视频序列中辅助信号灯的多条轨迹。最后,基于求解的轨迹结果和图像分类技术,实现信号灯检测性能的提升。该方法的跟踪性能相较于对比算法有大幅提升,并将小目标信号灯检测响应的mAP提升至94.35%。实验结果表明,基于网络流的建模方式能极大地提升信号灯的跟踪准确率,结合跟踪轨迹还能大幅提高视频序列中小目标信号灯的检测准确率,并可有效确定信号灯状态的转换时刻。