FMSA:a meta-learning framework-based fast model stealing attack technique against intelligent network intrusion detection systems

Intrusion detection systems are increasingly using machine learning.While machine learning has shown excellent performance in identifying malicious traffic,it may increase the risk of privacy leakage.This paper focuses on imple-menting a model stealing attack on intrusion detection systems.Existing model stealing attacks are hard to imple-ment in practical network environments,as they either need private data of the victim dataset or frequent access to the victim model.In this paper,we propose a novel solution called Fast Model Stealing Attack(FMSA)to address the problem in the field of model stealing attacks.We also highlight the risks of using ML-NIDS in network security.First,meta-learning frameworks are introduced into the model stealing algorithm to clone the victim model in a black-box state.Then,the number of accesses to the target model is used as an optimization term,resulting in minimal queries to achieve model stealing.Finally,adversarial training is used to simulate the data distribution of the target model and achieve the recovery of privacy data.Through experiments on multiple public datasets,compared to existing state-of-the-art algorithms,FMSA reduces the number of accesses to the target model and improves the accuracy of the clone model on the test dataset to 88.9%and the similarity with the target model to 90.1%.We can demonstrate the successful execution of model stealing attacks on the ML-NIDS system even with protective measures in place to limit the number of anomalous queries.

Intrusion Detection Model Using Chaotic MAP for Network Coding Enabled Mobile Small Cells

Wireless Network security management is difficult because of the ever-increasing number of wireless network malfunctions,vulnerabilities,and assaults.Complex security systems,such as Intrusion Detection Systems(IDS),are essential due to the limitations of simpler security measures,such as cryptography and firewalls.Due to their compact nature and low energy reserves,wireless networks present a significant challenge for security procedures.The features of small cells can cause threats to the network.Network Coding(NC)enabled small cells are vulnerable to various types of attacks.Avoiding attacks and performing secure“peer”to“peer”data transmission is a challenging task in small cells.Due to the low power and memory requirements of the proposed model,it is well suited to use with constrained small cells.An attacker cannot change the contents of data and generate a new Hashed Homomorphic Message Authentication Code(HHMAC)hash between transmissions since the HMAC function is generated using the shared secret.In this research,a chaotic sequence mapping based low overhead 1D Improved Logistic Map is used to secure“peer”to“peer”data transmission model using lightweight H-MAC(1D-LM-P2P-LHHMAC)is proposed with accurate intrusion detection.The proposed model is evaluated with the traditional models by considering various evaluation metrics like Vector Set Generation Accuracy Levels,Key Pair Generation Time Levels,Chaotic Map Accuracy Levels,Intrusion Detection Accuracy Levels,and the results represent that the proposed model performance in chaotic map accuracy level is 98%and intrusion detection is 98.2%.The proposed model is compared with the traditional models and the results represent that the proposed model secure data transmission levels are high.

Multi-Agent Network Intrusion Active Defense Model Based on Immune Theory

Inspired by the immune theory and multi-agent systems, an immune multi-agent active defense model for network intrusion is established. The concept of immune agent is introduced, and its running mechanism is established. The method, which uses antibody concentration to quantitatively describe the degree of intrusion danger, is presented. This model implements the multi-layer and distributed active defense mechanism for network intrusion. The experiment results show that this model is a good solution to the network security defense.

Towards an Artificial Immune System for Detecting Anomalies in Wireless Mesh Networks

This paper focuses on investigating immunological principles in designing a multi-agent security architecture for intrusion detection and response in wireless mesh networks.In this approach,the immunity-based agents monitor the situation in the network.These agents can take appropriate actions according to the underlying security policies.Specifically,their activities are coordinated in a hierarchical fashion while sensing,communicating,determining and generating responses.Such an agent can learn about and adapt to its environment dynamically and can detect both known and unknown intrusions.The proposed intrusion detection architecture is designed to be flexible,extendible,and adaptable so that it can perform real-time monitoring.This paper provides the conceptual view and a general framework of the proposed system.In the end,the architecture is illustrated by an example and by simulation to show it can prevent attacks efficiently.

Optimized Artificial Neural Network Techniques to Improve Cybersecurity of Higher Education Institution

Education acts as an important part of economic growth and improvement in human welfare.The educational sectors have transformed a lot in recent days,and Information and Communication Technology(ICT)is an effective part of the education field.Almost every action in university and college,right from the process fromcounselling to admissions and fee deposits has been automated.Attendance records,quiz,evaluation,mark,and grade submissions involved the utilization of the ICT.Therefore,security is essential to accomplish cybersecurity in higher security institutions(HEIs).In this view,this study develops an Automated Outlier Detection for CyberSecurity in Higher Education Institutions(AOD-CSHEI)technique.The AOD-CSHEI technique intends to determine the presence of intrusions or attacks in the HEIs.The AOD-CSHEI technique initially performs data pre-processing in two stages namely data conversion and class labelling.In addition,the Adaptive Synthetic(ADASYN)technique is exploited for the removal of outliers in the data.Besides,the sparrow search algorithm(SSA)with deep neural network(DNN)model is used for the classification of data into the existence or absence of intrusions in the HEIs network.Finally,the SSA is utilized to effectually adjust the hyper parameters of the DNN approach.In order to showcase the enhanced performance of the AOD-CSHEI technique,a set of simulations take place on three benchmark datasets and the results reported the enhanced efficiency of the AOD-CSHEI technique over its compared methods with higher accuracy of 0.9997.

An immunity based network security risk estimation

According to the relationship between the antibody concentration and the pathogen intrusion intensity, here we present an immunitybased model for the network security risk estimation （Insre）. In Insre, the concepts and formal definitions of self, nonself, antibody, antigen and lymphocyte in the network security domain are given. Then the mathematical models of the selftolerance, the clonal selection, the lifecycle of mature lymphocyte, immune memory and immune surveillance are established. Building upon the above models, a quantitative computation model for network security risk estimation, which is based on the calculation of antibody concentration, is thus presented. By using Insre, the types and intensity of network attacks, as well as the risk level of network security, can be calculated quantitatively and in real-time. Our theoretical analysis and experimental results show that Insre is a good solution to real-time risk evaluation for the network security.

Intrusion Detection Algorithm Based on Model Checking Interval Temporal Logic

Model checking based on linear temporal logic reduces the false negative rate of misuse detection.However,linear temporal logic formulae cannot be used to describe concurrent attacks and piecewise attacks.So there is still a high rate of false negatives in detecting these complex attack patterns.To solve this problem,we use interval temporal logic formulae to describe concurrent attacks and piecewise attacks.On this basis,we formalize a novel algorithm for intrusion detection based on model checking interval temporal logic.Compared with the method based on model checking linear temporal logic,the new algorithm can find unknown succinct attacks.The simulation results show that the new method can effectively reduce the false negative rate of concurrent attacks and piecewise attacks.

Grey-theory based intrusion detection model

To solve the problem that current intrusion detection model needs large-scale data in formulating the model in real-time use, an intrusion detection system model based on grey theory （GTIDS） is presented. Grey theory has merits of fewer requirements on original data scale, less limitation of the distribution pattern and simpler algorithm in modeling. With these merits GTIDS constructs model according to partial time sequence for rapid detect on intrusive act in secure system. In this detection model rate of false drop and false retrieval are effectively reduced through twice modeling and repeated detect on target data. Furthermore, GTIDS framework and specific process of modeling algorithm are presented. The affectivity of GTIDS is proved through emulated experiments comparing snort and next-generation intrusion detection expert system （NIDES） in SRI international.

Novel design concepts for network intrusion systems based on dendritic cells processes

An abstraction and an investigation to the worth of dendritic cells (DCs) ability to collect, process and present antigens are presented. Computationally, this ability is shown to provide a feature reduction mechanism that could be used to reduce the complexity of a search space, a mechanism for development of highly specialized detector sets as well as a selective mechanism used in directing subsets of detectors to be activated when certain danger signals are present. It is shown that DCs, primed by different danger signals, provide a basis for different anomaly detection pathways. Different antigen-peptides are developed based on different danger signals present, and these peptides are presented to different adaptive layer detectors that correspond to the given danger signal. Experiments are then undertaken that compare current approaches, where a full antigen structure and the whole repertoire of detectors are used, with the proposed approach. Experiment results indicate that such an approach is feasible and can help reduce the complexity of the problem by significant levels. It also improves the efficiency of the system, given that only a subset of detectors are involved during the detection process. Having several different sets of detectors increases the robustness of the resulting system. Detectors developed based on peptides are also highly discriminative, which reduces the false positives rates, making the approach feasible for a real time environment.

AN IMMUNITY-BASED SECURITY ARCHITECTURE FOR MOBILE AD HOC NETWORKS

This paper focuses on investigating immunological principles in designing a multi-agent security architecture for intrusion detection and response in mobile ad hoc networks. In this approach, the immunity-based agents monitor the situation in the network. These agents can take appropriate actions according to the underlying security policies. Specifically, their activities are coordinated in a hierarchical fashion while sensing, communicating, decision and generating responses. Such an agent can learn and adapt to its environment dynamically and can detect both known and unknown intrusions. The proposed intrusion detection architecture is designed to be flexible, extendible, and adaptable that can perform real-time monitoring. This paper provides the conceptual view and a general framework of the proposed system. In the end, the architecture is illustrated by an example to show it can prevent the attack efficiently.

Classification Model with High Deviation for Intrusion Detection on System Call Traces

A new classification model for host intrusion detection based on the unidentified short sequences and RIPPER algorithm is proposed. The concepts of different short sequences on the system call traces are strictly defined on the basis of in-depth analysis of completeness and correctness of pattern databases. Labels of short sequences are predicted by learned RIPPER rule set and the nature of the unidentified short sequences is confirmed by statistical method. Experiment results indicate that the classification model increases clearly the deviation between the attack and the normal traces and improves detection capability against known and unknown attacks.

An immunity-based technique to detect network intrusions

This paper briefly reviews other people’s works on negative selection algorithm and their shortcomings. With a view to the real problem to be solved, authors bring forward two assumptions, based on which a new immune algorithm, multi-level negative selection algorithm, is developed. In essence, compared with Forrest’s negative selection algorithm, it enhances detector generation efficiency. This algorithm integrates clonal selection process into negative selection process for the first time. After careful analyses, this algorithm was applied to network intrusion detection and achieved good results.

Cyber Resilience through Real-Time Threat Analysis in Information Security

This paper examines how cybersecurity is developing and how it relates to more conventional information security. Although information security and cyber security are sometimes used synonymously, this study contends that they are not the same. The concept of cyber security is explored, which goes beyond protecting information resources to include a wider variety of assets, including people [1]. Protecting information assets is the main goal of traditional information security, with consideration to the human element and how people fit into the security process. On the other hand, cyber security adds a new level of complexity, as people might unintentionally contribute to or become targets of cyberattacks. This aspect presents moral questions since it is becoming more widely accepted that society has a duty to protect weaker members of society, including children [1]. The study emphasizes how important cyber security is on a larger scale, with many countries creating plans and laws to counteract cyberattacks. Nevertheless, a lot of these sources frequently neglect to define the differences or the relationship between information security and cyber security [1]. The paper focus on differentiating between cybersecurity and information security on a larger scale. The study also highlights other areas of cybersecurity which includes defending people, social norms, and vital infrastructure from threats that arise from online in addition to information and technology protection. It contends that ethical issues and the human factor are becoming more and more important in protecting assets in the digital age, and that cyber security is a paradigm shift in this regard [1].

基于人工智能的网络入侵检测与响应机制

针对当前网络入侵检测领域的挑战,提出了一种基于改进型朴素贝叶斯算法的网络入侵检测方法。首先,深入研究了网络入侵检测与响应的整体框架;其次,提出了改进型朴素贝叶斯算法,引入了特征加权和条件概率平滑策略,以提高对入侵行为检测的准确性;最后,利用CIC-IDS2017数据集进行实验验证,并与传统朴素贝叶斯方法进行比较。实验结果表明,改进型朴素贝叶斯方法的多个指标均优于传统方法,充分证明了其在网络入侵检测中的有效性。

基于人工智能技术的轻量级网络入侵检测系统设计

以提升网络入侵检测技术水平为目的,设计基于人工智能技术的轻量级网络入侵检测系统。该系统数据采集层利用若干个用户探针连接IDS检测服务器后,使用网络数据包捕获模块捕获用户网络运行数据,再通过传输层内防火墙、核心交换机和MQTT/CoAP通信协议将用户网络运行数据发送到逻辑运算层内,该层利用数据预处理模块对用户网络运行数据进行去噪预处理后,将其输入到基于人工智能的网络入侵检测模块内,通过该模块输出轻量级网络入侵检测结果,然后将检测结果发送到展示层,通过入侵告警信息、数据可视化展示等模块实现人机交互。实验表明:该系统运行较为稳定,可有效检测不同类型网络入侵的同时,其检测及时性和入侵告警能力较好,应用效果良好。

人工智能技术在网络安全检测中的应用研究

传统的网络安全检测技术难以解决新网络流量无标签、未知攻击以及标签稀缺等问题。为此,将人工智能技术应用到上述场景的网络安全入侵检测中,使用无标签网络安全检测方案解决目标网络域和源网络域间特征分布不同的问题。针对未知网络攻击的问题构建一个未知攻击网络安全检测模型,针对标签稀缺问题将半监督学习和主动学技术结合起来,构建一种标签稀缺网络安全检测算法.

基于混合神经网络模型的低速率网络入侵检测研究

针对低速率入侵,常规的入侵检测方法能力不足,虚警率、漏警率偏高。为保证网络安全,提出一种基于混合神经网络模型的低速率网络入侵检测方法。利用NetFlow技术采集网络流量数据,对网络流量数据进行过滤和图像化处理。搭建由卷积神经网络和人工神经网络构成的混合神经网络模型,利用卷积神经网络提取网络流量数据的图像提取特征,利用人工神经网络检测网络入侵类型。结果表明:提出方法的虚警率、漏警率低于Transformer入侵检测方法、栈式自编码-长短期记忆(SAE-LSTM)检测方法和萤火虫优化(GSO)-基分类器检测方法,尤其在入侵速率更低(2 Mb/s)的情况下,所表现出的检测能力更为突出,说明针对低速率网络入侵问题,基于混合神经网络模型的检测方法的检测能力更强,检测结果更为准确。

基于人工智能的网络入侵检测方法研究

随着网络环境的日益复杂和入侵威胁的不断升级,致力于研究一种基于卷积神经网络(Convolutional Neural Networks,CNN)和K-means聚类的网络入侵检测方法。通过构建综合性的网络入侵检测系统架构,利用深度学习和聚类分析相结合的方式,提高对网络流量中入侵行为的敏感性和准确性。在实验阶段,采用1998DARPA数据集进行验证,通过CNN提取特征向量,并应用K-means聚类进行数据分析,实现对网络入侵的有效检测。结果表明,所提方法在准确率、召回率和精确率等方面表现出色,为网络安全领域提供一种可靠的解决方案。

Intelligent Deep Learning Model for Privacy Preserving IIoT on 6G Environment

In recent times,Industrial Internet of Things(IIoT)experiences a high risk of cyber attacks which needs to be resolved.Blockchain technology can be incorporated into IIoT system to help the entrepreneurs realize Industry 4.0 by overcoming such cyber attacks.Although blockchain-based IIoT network renders a significant support and meet the service requirements of next generation network,the performance arrived at,in existing studies still needs improvement.In this scenario,the current research paper develops a new Privacy-Preserving Blockchain with Deep Learning model for Industrial IoT(PPBDL-IIoT)on 6G environment.The proposed PPBDLIIoT technique aims at identifying the existence of intrusions in network.Further,PPBDL-IIoT technique also involves the design of Chaos Game Optimization(CGO)with Bidirectional Gated Recurrent Neural Network(BiGRNN)technique for both detection and classification of intrusions in the network.Besides,CGO technique is applied to fine tune the hyperparameters in BiGRNN model.CGO algorithm is applied to optimally adjust the learning rate,epoch count,and weight decay so as to considerably improve the intrusion detection performance of BiGRNN model.Moreover,Blockchain enabled Integrity Check(BEIC)scheme is also introduced to avoid the misrouting attacks that tamper the OpenFlow rules of SDN-based IIoT system.The performance of the proposed PPBDL-IIoT methodology was validated using Industrial Control System Cyber-attack(ICSCA)dataset and the outcomes were analysed under various measures.The experimental results highlight the supremacy of the presented PPBDL-IIoT technique than the recent state-of-the-art techniques with the higher accuracy of 91.50%.

智能化漏洞挖掘与网络空间威胁发现综述

当前网络空间面临的威胁日益严重,大量研究关注网络空间安全防御技术及体系,其中漏洞挖掘技术可以应用于网络攻击发生前及时发现漏洞并修补,降低被入侵的风险,而威胁发现技术可以应用于网络攻击发生时及发生后的威胁检测,进而及时发现威胁并响应处置,降低入侵造成的危害和损失.分析并总结了基于智能方法进行漏洞挖掘与网络空间威胁发现的研究.其中,在智能化漏洞挖掘方面,从结合人工智能技术的漏洞补丁识别、漏洞预测、代码比对和模糊测试等几个应用分类方面总结了当前研究进展;在网络空间威胁发现方面,从基于网络流量、主机数据、恶意文件、网络威胁情报等威胁发现涉及的信息载体分类方面总结了当前研究进展.