Computers & Security最新文献_第7页

Edge-featured multi-hop attention graph neural network for intrusion detection system 用于入侵检测系统的边缘特征多跳注意力图神经网络

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-26 DOI: 10.1016/j.cose.2024.104132

Ping Deng, Yong Huang

With the development of the Internet, the application of computer technology has rapidly become widespread, driving the progress of Internet of Things (IoT) technology. The attacks present on networks have become more complex and stealthy. However, traditional network intrusion detection systems with singular functions are no longer sufficient to meet current demands. While some machine learning-based network intrusion detection systems have emerged, traditional machine learning methods cannot effectively respond to the complex and dynamic nature of network attacks. Intrusion detection systems utilizing deep learning can better enhance detection capabilities through diverse data learning and training. To capture the topological relationships in network data, using graph neural networks (GNNs) is most suitable. Most existing GNNs for intrusion detection use multi-layer network training, which may lead to over-smoothing issues. Additionally, current intrusion detection solutions often lack efficiency. To mitigate the issues mentioned above, this paper proposes an Edge-featured Multi-hop Attention Graph Neural Network for Intrusion Detection System (EMA-IDS), aiming to improve detection performance by capturing more features from data flows. Our method enhances computational efficiency through attention propagation and integrates node and edge features, fully leveraging data characteristics. We carried out experiments on four public datasets, which are NF-CSE-CIC-IDS2018-v2, NF-UNSW-NB15-v2, NF-BoT-IoT, and NF-ToN-IoT. Compared with existing models, our method demonstrated superior performance.

随着互联网的发展，计算机技术的应用迅速普及，推动了物联网（IoT）技术的进步。网络上出现的攻击行为也变得更加复杂和隐蔽。然而，功能单一的传统网络入侵检测系统已无法满足当前的需求。虽然出现了一些基于机器学习的网络入侵检测系统，但传统的机器学习方法无法有效应对复杂多变的网络攻击。利用深度学习的入侵检测系统可以通过多样化的数据学习和训练更好地提高检测能力。要捕捉网络数据中的拓扑关系，使用图神经网络（GNN）最为合适。现有用于入侵检测的图神经网络大多使用多层网络训练，这可能会导致过度平滑问题。此外，当前的入侵检测解决方案往往缺乏效率。为了缓解上述问题，本文提出了一种用于入侵检测系统的边缘特征多跳注意力图神经网络（EMA-IDS），旨在通过捕捉数据流中的更多特征来提高检测性能。我们的方法通过注意力传播提高了计算效率，并整合了节点和边缘特征，充分利用了数据特征。我们在 NF-CSE-CIC-IDS2018-v2、NF-UNSW-NB15-v2、NF-BoT-IoT 和 NF-ToN-IoT 四个公开数据集上进行了实验。与现有模型相比，我们的方法表现出更优越的性能。

{"title":"Edge-featured multi-hop attention graph neural network for intrusion detection system","authors":"Ping Deng, Yong Huang","doi":"10.1016/j.cose.2024.104132","DOIUrl":"10.1016/j.cose.2024.104132","url":null,"abstract":"<div><div>With the development of the Internet, the application of computer technology has rapidly become widespread, driving the progress of Internet of Things (IoT) technology. The attacks present on networks have become more complex and stealthy. However, traditional network intrusion detection systems with singular functions are no longer sufficient to meet current demands. While some machine learning-based network intrusion detection systems have emerged, traditional machine learning methods cannot effectively respond to the complex and dynamic nature of network attacks. Intrusion detection systems utilizing deep learning can better enhance detection capabilities through diverse data learning and training. To capture the topological relationships in network data, using graph neural networks (GNNs) is most suitable. Most existing GNNs for intrusion detection use multi-layer network training, which may lead to over-smoothing issues. Additionally, current intrusion detection solutions often lack efficiency. To mitigate the issues mentioned above, this paper proposes an <u>E</u>dge-featured <u>M</u>ulti-hop <u>A</u>ttention Graph Neural Network for <u>I</u>ntrusion <u>D</u>etection <u>S</u>ystem (EMA-IDS), aiming to improve detection performance by capturing more features from data flows. Our method enhances computational efficiency through attention propagation and integrates node and edge features, fully leveraging data characteristics. We carried out experiments on four public datasets, which are NF-CSE-CIC-IDS2018-v2, NF-UNSW-NB15-v2, NF-BoT-IoT, and NF-ToN-IoT. Compared with existing models, our method demonstrated superior performance.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104132"},"PeriodicalIF":4.8,"publicationDate":"2024-09-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142419447","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

An explainable unsupervised anomaly detection framework for Industrial Internet of Things 面向工业物联网的可解释无监督异常检测框架

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-25 DOI: 10.1016/j.cose.2024.104130

Yilixiati Abudurexiti , Guangjie Han , Fan Zhang , Li Liu

Industrial Internet of Things (IIoT) systems require effective anomaly detection techniques to ensure optimal operational efficiency. However, constructing a suitable anomaly detection framework for IIoT poses challenges due to the scarcity of labeled data. Additionally, most existing anomaly detection frameworks lack interpretability. To tackle these issues, an innovative unsupervised framework based on time series data analysis is proposed. This framework initially detects anomalous patterns in IIoT sensor data by extracting local features. An improved Time Convolutional Network (TCN) and Kolmogorov–Arnold Network (KAN) based Variational Auto-Encoder (VAE) is then constructed to capture long-term dependencies. The framework is trained in an unsupervised manner and interpreted using Explainable Artificial Intelligence (XAI) techniques. This approach offers insightful explanations regarding the importance of features, thereby facilitating informed decision-making and enhancements. Experimental results demonstrate that the framework is capable of extracting informative features and capturing long-term dependencies. This enables efficient anomaly detection in complex, dynamic industrial systems, surpassing other unsupervised methods.

工业物联网（IIoT）系统需要有效的异常检测技术，以确保最佳的运行效率。然而，由于标注数据稀缺，为 IIoT 构建合适的异常检测框架面临着挑战。此外，大多数现有的异常检测框架缺乏可解释性。为了解决这些问题，我们提出了一种基于时间序列数据分析的创新型无监督框架。该框架最初通过提取局部特征来检测物联网传感器数据中的异常模式。然后，构建基于时间卷积网络（TCN）和科尔莫哥罗德网络（KAN）的改进型变异自动编码器（VAE），以捕捉长期依赖关系。该框架以无监督方式进行训练，并使用可解释人工智能（XAI）技术进行解释。这种方法能就特征的重要性提供有见地的解释，从而促进知情决策和改进。实验结果表明，该框架能够提取信息特征并捕捉长期依赖关系。这使得在复杂、动态的工业系统中进行高效的异常检测成为可能，超越了其他无监督方法。

{"title":"An explainable unsupervised anomaly detection framework for Industrial Internet of Things","authors":"Yilixiati Abudurexiti , Guangjie Han , Fan Zhang , Li Liu","doi":"10.1016/j.cose.2024.104130","DOIUrl":"10.1016/j.cose.2024.104130","url":null,"abstract":"<div><div>Industrial Internet of Things (IIoT) systems require effective anomaly detection techniques to ensure optimal operational efficiency. However, constructing a suitable anomaly detection framework for IIoT poses challenges due to the scarcity of labeled data. Additionally, most existing anomaly detection frameworks lack interpretability. To tackle these issues, an innovative unsupervised framework based on time series data analysis is proposed. This framework initially detects anomalous patterns in IIoT sensor data by extracting local features. An improved Time Convolutional Network (TCN) and Kolmogorov–Arnold Network (KAN) based Variational Auto-Encoder (VAE) is then constructed to capture long-term dependencies. The framework is trained in an unsupervised manner and interpreted using Explainable Artificial Intelligence (XAI) techniques. This approach offers insightful explanations regarding the importance of features, thereby facilitating informed decision-making and enhancements. Experimental results demonstrate that the framework is capable of extracting informative features and capturing long-term dependencies. This enables efficient anomaly detection in complex, dynamic industrial systems, surpassing other unsupervised methods.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104130"},"PeriodicalIF":4.8,"publicationDate":"2024-09-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142419448","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Improving IIoT security: Unveiling threats through advanced side-channel analysis 提高 IIoT 安全性：通过先进的侧信道分析揭示威胁

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-25 DOI: 10.1016/j.cose.2024.104135

Dalin He , Huanyu Wang , Tuo Deng , Jishi Liu , Junnian Wang

The widespread deployment of IIoT edge devices makes them attractive victims for malicious activities. Consequently, how to implement trustworthy operations becomes a realistic topic in embedded systems. While most current physical systems for detecting malicious activities primarily focus on identifying known intrusion codes at the block level, they ignore that even an unnoticeable injected function can result in system-wide loss of security. In this paper, we propose a framework called CNDSW built on deep-learning side-channel analysis for function-level industrial control flow integrity monitoring. By collaboratively utilizing correlation analysis and deep-learning techniques, the dual window sliding monitoring mechanism in the proposed CNDSW framework demonstrates a real-time code intrusion tracking capacity on embedded controllers with a 99% detection accuracy on average. Instead of focusing on known block-level intrusions, we experimentally show that our model is feasible to detect function-level code intrusions without knowing the potential threat type. Besides, we further explore how different configurations of the CNDSW framework can help the monitoring process with different emphases and to which extent the model can concurrently detect multiple code intrusion activities. All our experiments are conducted on 32-bit ARM Cortex-M4 and 8-bit RISC MCUs across five different control flow programs, providing a comprehensive evaluation of the framework’s capabilities.

IIoT 边缘设备的广泛部署使其成为恶意活动的目标。因此，如何实现值得信赖的操作成为嵌入式系统中的一个现实课题。虽然目前大多数用于检测恶意活动的物理系统主要侧重于在块级识别已知的入侵代码，但它们忽视了即使是一个不引人注意的注入函数也可能导致整个系统丧失安全性。在本文中，我们提出了一种基于深度学习侧信道分析的 CNDSW 框架，用于功能级工业控制流完整性监控。通过协同利用相关性分析和深度学习技术，所提出的 CNDSW 框架中的双窗口滑动监控机制在嵌入式控制器上展示了实时代码入侵跟踪能力，平均检测准确率达 99%。我们通过实验证明，我们的模型可以在不知道潜在威胁类型的情况下检测函数级代码入侵，而不是专注于已知的块级入侵。此外，我们还进一步探索了 CNDSW 框架的不同配置如何以不同的侧重点帮助监控过程，以及该模型能在多大程度上同时检测多个代码入侵活动。我们的所有实验都是在 32 位 ARM Cortex-M4 和 8 位 RISC MCU 上进行的，涉及五个不同的控制流程序，从而全面评估了该框架的能力。

{"title":"Improving IIoT security: Unveiling threats through advanced side-channel analysis","authors":"Dalin He , Huanyu Wang , Tuo Deng , Jishi Liu , Junnian Wang","doi":"10.1016/j.cose.2024.104135","DOIUrl":"10.1016/j.cose.2024.104135","url":null,"abstract":"<div><div>The widespread deployment of IIoT edge devices makes them attractive victims for malicious activities. Consequently, how to implement trustworthy operations becomes a realistic topic in embedded systems. While most current physical systems for detecting malicious activities primarily focus on identifying known intrusion codes at the block level, they ignore that even an unnoticeable injected function can result in system-wide loss of security. In this paper, we propose a framework called CNDSW built on deep-learning side-channel analysis for function-level industrial control flow integrity monitoring. By collaboratively utilizing correlation analysis and deep-learning techniques, the dual window sliding monitoring mechanism in the proposed CNDSW framework demonstrates a real-time code intrusion tracking capacity on embedded controllers with a 99% detection accuracy on average. Instead of focusing on known block-level intrusions, we experimentally show that our model is feasible to detect function-level code intrusions without knowing the potential threat type. Besides, we further explore how different configurations of the CNDSW framework can help the monitoring process with different emphases and to which extent the model can concurrently detect multiple code intrusion activities. All our experiments are conducted on 32-bit ARM Cortex-M4 and 8-bit RISC MCUs across five different control flow programs, providing a comprehensive evaluation of the framework’s capabilities.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104135"},"PeriodicalIF":4.8,"publicationDate":"2024-09-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142419449","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

E-WebGuard: Enhanced neural architectures for precision web attack detection E-WebGuard：用于精确检测网络攻击的增强型神经架构

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-23 DOI: 10.1016/j.cose.2024.104127

Luchen Zhou , Wei-Chuen Yau , Y.S. Gan , Sze-Teng Liong

Web applications have become a favored tool for organizations to disseminate vast amounts of information to the public. With the increasing adoption and inherent openness of these applications, there is an observed surge in web-based attacks exploited by adversaries. However, most of the web attack detection works are based on public datasets that are outdated or do not cover a sufficient quantity of web application attacks. Furthermore, most of them are binary detection (i.e., normal or attack) and there is little work on multi-class web attack detection. This highlights the crucial need for automated web attack detection models to bolster web security. In this study, a suite of integrated machine learning and deep learning models is designed to detect web attacks. Specifically, this study employs the Character-level Support Vector Machine (Char-SVM), Character-level Long Short-Term Memory (Char-LSTM), Convolutional Neural Network - SVM (CNN-SVM), and CNN-Bi-LSTM models to differentiate between standard HTTP requests and HTTP-based attacks in both the CSIC 2010 and SR-BH 2020 datasets. Note that the CSIC 2010 dataset involves binary classification, while the SR-BH 2020 dataset involves multi-class classification, specifically with 13 classes. Notably, the input data is first converted to the character level before being fed into any of the proposed model architectures. In the binary classification task, the Char-SVM model with a linear kernel outperforms other models, achieving an accuracy rate of 99.60%. The CNN-Bi-LSTM model closely follows with a 99.41% accuracy, surpassing the performance of the CNN-LSTM model presented in previous research. In the context of multi-class classification, the CNN-Bi-LSTM model demonstrates outstanding performance with a 99.63% accuracy rate. Furthermore, the multi-class classification models, namely Char-LSTM and CNN-Bi-LSTM, achieve validation accuracies above 98%, outperforming the two machine learning-based methods mentioned in the original research.

网络应用程序已成为企业向公众传播大量信息的首选工具。随着这些应用的日益普及和固有的开放性，我们观察到被对手利用的基于网络的攻击激增。然而，大多数网络攻击检测工作都是基于过时的公共数据集，或者没有涵盖足够数量的网络应用程序攻击。此外，大多数检测都是二元检测（即正常或攻击），很少有关于多类网络攻击检测的工作。这凸显了对自动网络攻击检测模型的迫切需要，以加强网络安全。本研究设计了一套集成机器学习和深度学习模型来检测网络攻击。具体来说，本研究采用了字符级支持向量机（Char-SVM）、字符级长短期记忆（Char-LSTM）、卷积神经网络-SVM（CNN-SVM）和 CNN-Bi-LSTM 模型来区分 CSIC 2010 和 SR-BH 2020 数据集中的标准 HTTP 请求和基于 HTTP 的攻击。请注意，CSIC 2010 数据集涉及二元分类，而 SR-BH 2020 数据集涉及多类分类，特别是 13 类。值得注意的是，在将输入数据输入到任何建议的模型架构之前，首先要将其转换为字符级。在二元分类任务中，采用线性核的 Char-SVM 模型优于其他模型，准确率达到 99.60%。CNN-Bi-LSTM 模型紧随其后，准确率达到 99.41%，超过了之前研究中 CNN-LSTM 模型的表现。在多类分类方面，CNN-Bi-LSTM 模型表现突出，准确率达到 99.63%。此外，多类分类模型（即 Char-LSTM 和 CNN-Bi-LSTM）的验证准确率超过 98%，优于原始研究中提到的两种基于机器学习的方法。

{"title":"E-WebGuard: Enhanced neural architectures for precision web attack detection","authors":"Luchen Zhou , Wei-Chuen Yau , Y.S. Gan , Sze-Teng Liong","doi":"10.1016/j.cose.2024.104127","DOIUrl":"10.1016/j.cose.2024.104127","url":null,"abstract":"<div><div>Web applications have become a favored tool for organizations to disseminate vast amounts of information to the public. With the increasing adoption and inherent openness of these applications, there is an observed surge in web-based attacks exploited by adversaries. However, most of the web attack detection works are based on public datasets that are outdated or do not cover a sufficient quantity of web application attacks. Furthermore, most of them are binary detection (i.e., normal or attack) and there is little work on multi-class web attack detection. This highlights the crucial need for automated web attack detection models to bolster web security. In this study, a suite of integrated machine learning and deep learning models is designed to detect web attacks. Specifically, this study employs the Character-level Support Vector Machine (Char-SVM), Character-level Long Short-Term Memory (Char-LSTM), Convolutional Neural Network - SVM (CNN-SVM), and CNN-Bi-LSTM models to differentiate between standard HTTP requests and HTTP-based attacks in both the CSIC 2010 and SR-BH 2020 datasets. Note that the CSIC 2010 dataset involves binary classification, while the SR-BH 2020 dataset involves multi-class classification, specifically with 13 classes. Notably, the input data is first converted to the character level before being fed into any of the proposed model architectures. In the binary classification task, the Char-SVM model with a linear kernel outperforms other models, achieving an accuracy rate of 99.60%. The CNN-Bi-LSTM model closely follows with a 99.41% accuracy, surpassing the performance of the CNN-LSTM model presented in previous research. In the context of multi-class classification, the CNN-Bi-LSTM model demonstrates outstanding performance with a 99.63% accuracy rate. Furthermore, the multi-class classification models, namely Char-LSTM and CNN-Bi-LSTM, achieve validation accuracies above 98%, outperforming the two machine learning-based methods mentioned in the original research.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104127"},"PeriodicalIF":4.8,"publicationDate":"2024-09-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142323984","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Enhancing data integrity in opportunistic mobile social network: Leveraging Berkle Tree and secure data routing against attacks 增强机会主义移动社交网络中的数据完整性：利用伯克树和安全数据路由对抗攻击

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-22 DOI: 10.1016/j.cose.2024.104133

Vimitha R. Vidhya Lakshmi , Gireesh Kumar T

In Opportunistic Mobile Social Networks (OMSNs), ensuring data integrity is crucial. The anonymous and opportunistic nature of node communication makes these networks vulnerable to data integrity attacks. The existing literature identified significant shortcomings in effectively addressing data integrity attacks with high efficiency and accuracy. This paper addresses these issues by proposing the "Berkle Tree", a novel data structure designed to mitigate data integrity attacks in OMSNs. The Berkle Tree leverages the EvolvedBloom filter, which is a variant of the bloom filter with a negligible False Positive Rate (FPR). The key contributions of this study include i) an innovative application of EvolvedBloom for membership testing and Berkle Tree root validation, and ii) comparative analysis with existing data structures like Merkle and Verkle Trees. The Berkle Tree demonstrates superior performance, reducing tree generation and integrity validation times and leading to substantial computational cost reductions of 79.50 % and 90.57 %, respectively. The proposed method integrates the Berkle Tree into OMSN routing models and evaluates performance against Packet Drop, Modification, and Fake Attacks (PDA, PMA, PFA). Results show average Malicious Node Detection Accuracy of 98.2 %, 85.2 %, and 94.4 %; Malicious Path Detection Accuracy of 98.6 %, 86.6 %, and 90.2 %; Malicious Data Detection Accuracy of 98.4 %, 80.2 %, and 93.4 %; and False Negative Rates of 1.8 %, 14.8 %, and 5.6 % for PDA, PMA, and PFA, respectively. The major findings demonstrate that the proposed approach significantly improves OMSN routing models by reducing Packet Dropping, Modifying, and Faking Rates by 48.62 %, 28.99 %, and 31.2 %, respectively. Compared to existing methods, the Berkle Tree achieves a substantial reduction in filter size by approximately 25 %–40 %, while maintaining a negligible FPR. These advancements contribute to the state-of-the-art of OMSNs by providing robust solutions for data integrity with significant implications for enhancing security and trustworthiness in OMSNs.

在机会移动社交网络（OMSN）中，确保数据完整性至关重要。节点通信的匿名性和机会性使这些网络容易受到数据完整性攻击。现有文献指出了在高效、准确地有效解决数据完整性攻击方面存在的重大缺陷。针对这些问题，本文提出了 "Berkle 树"，这是一种新型数据结构，旨在减轻 OMSN 中的数据完整性攻击。Berkle Tree 利用了 EvolvedBloom 过滤器，这是 Bloom 过滤器的一种变体，其假阳性率 (FPR) 可忽略不计。本研究的主要贡献包括：i）将 EvolvedBloom 创新性地应用于成员资格测试和 Berkle 树根验证；ii）与 Merkle 树和 Verkle 树等现有数据结构进行比较分析。Berkle 树表现出卓越的性能，缩短了树的生成和完整性验证时间，使计算成本分别大幅降低了 79.50 % 和 90.57 %。所提出的方法将 Berkle 树集成到 OMSN 路由模型中，并评估了针对数据包丢弃、修改和伪造攻击（PDA、PMA、PFA）的性能。结果显示，针对 PDA、PMA 和 PFA 的平均恶意节点检测准确率分别为 98.2%、85.2% 和 94.4%；恶意路径检测准确率分别为 98.6%、86.6% 和 90.2%；恶意数据检测准确率分别为 98.4%、80.2% 和 93.4%；误报率分别为 1.8%、14.8% 和 5.6%。主要研究结果表明，所提出的方法大大改进了 OMSN 路由模型，将丢包、修改和伪造率分别降低了 48.62 %、28.99 % 和 31.2 %。与现有方法相比，Berkle Tree 在保持可忽略不计的 FPR 的同时，将滤波器的大小大幅缩小了约 25%-40%。这些进步为数据完整性提供了稳健的解决方案，对提高 OMSN 的安全性和可信度具有重要意义，从而为 OMSN 的最新发展做出了贡献。

{"title":"Enhancing data integrity in opportunistic mobile social network: Leveraging Berkle Tree and secure data routing against attacks","authors":"Vimitha R. Vidhya Lakshmi , Gireesh Kumar T","doi":"10.1016/j.cose.2024.104133","DOIUrl":"10.1016/j.cose.2024.104133","url":null,"abstract":"<div><div>In Opportunistic Mobile Social Networks (OMSNs), ensuring data integrity is crucial. The anonymous and opportunistic nature of node communication makes these networks vulnerable to data integrity attacks. The existing literature identified significant shortcomings in effectively addressing data integrity attacks with high efficiency and accuracy. This paper addresses these issues by proposing the \"Berkle Tree\", a novel data structure designed to mitigate data integrity attacks in OMSNs. The Berkle Tree leverages the EvolvedBloom filter, which is a variant of the bloom filter with a negligible False Positive Rate (FPR). The key contributions of this study include i) an innovative application of EvolvedBloom for membership testing and Berkle Tree root validation, and ii) comparative analysis with existing data structures like Merkle and Verkle Trees. The Berkle Tree demonstrates superior performance, reducing tree generation and integrity validation times and leading to substantial computational cost reductions of 79.50 % and 90.57 %, respectively. The proposed method integrates the Berkle Tree into OMSN routing models and evaluates performance against Packet Drop, Modification, and Fake Attacks (PDA, PMA, PFA). Results show average Malicious Node Detection Accuracy of 98.2 %, 85.2 %, and 94.4 %; Malicious Path Detection Accuracy of 98.6 %, 86.6 %, and 90.2 %; Malicious Data Detection Accuracy of 98.4 %, 80.2 %, and 93.4 %; and False Negative Rates of 1.8 %, 14.8 %, and 5.6 % for PDA, PMA, and PFA, respectively. The major findings demonstrate that the proposed approach significantly improves OMSN routing models by reducing Packet Dropping, Modifying, and Faking Rates by 48.62 %, 28.99 %, and 31.2 %, respectively. Compared to existing methods, the Berkle Tree achieves a substantial reduction in filter size by approximately 25 %–40 %, while maintaining a negligible FPR. These advancements contribute to the state-of-the-art of OMSNs by providing robust solutions for data integrity with significant implications for enhancing security and trustworthiness in OMSNs.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104133"},"PeriodicalIF":4.8,"publicationDate":"2024-09-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142356816","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Adaptive edge security framework for dynamic IoT security policies in diverse environments 适用于多样化环境中动态物联网安全策略的自适应边缘安全框架

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-21 DOI: 10.1016/j.cose.2024.104128

Malka N. Halgamuge , Dusit Niyato

The rapid expansion of Internet of Things (IoT) technologies has introduced significant cybersecurity challenges, particularly at the network edge where IoT devices operate. Traditional security policies designed for static environments fall short of addressing the dynamic, heterogeneous, and resource-constrained nature of IoT ecosystems. Existing dynamic security policy models lack versatility and fail to fully integrate comprehensive risk assessments, regulatory compliance, and AI/ML (artificial intelligence/machine learning)-driven adaptability. We develop a novel adaptive edge security framework that dynamically generates and adjusts security policies for IoT edge devices. Our framework integrates a dynamic security policy generator, a conflict detection and resolution in policy generator, a bias-aware risk assessment system, a regulatory compliance analysis system, and an AI-driven adaptability integration system. This approach produces tailored security policies that adapt to changes in the threat landscape, regulatory requirements, and device statuses. Our study identifies critical security challenges in diverse IoT environments and demonstrates the effectiveness of our framework through simulations and real-world scenarios. We found that our framework significantly enhances the adaptability and resilience of IoT security policies. Our results demonstrate the potential of AI/ML integration in creating responsive and robust security measures for IoT ecosystems. The implications of our findings suggest that dynamic and adaptive security frameworks are essential for protecting IoT devices against evolving cyber threats, ensuring compliance with regulatory standards, and maintaining the integrity and availability of IoT services across various applications.

物联网（IoT）技术的快速发展带来了巨大的网络安全挑战，尤其是在物联网设备运行的网络边缘。为静态环境设计的传统安全策略无法应对物联网生态系统的动态、异构和资源受限等特性。现有的动态安全策略模型缺乏多功能性，未能充分整合全面的风险评估、监管合规性和人工智能/机器学习（AI/ML）驱动的适应性。我们开发了一种新型自适应边缘安全框架，可为物联网边缘设备动态生成和调整安全策略。我们的框架集成了动态安全策略生成器、策略生成器中的冲突检测和解决、偏差感知风险评估系统、法规合规性分析系统和人工智能驱动的适应性集成系统。这种方法可生成量身定制的安全策略，以适应威胁环境、监管要求和设备状态的变化。我们的研究确定了不同物联网环境中的关键安全挑战，并通过模拟和真实场景展示了我们框架的有效性。我们发现，我们的框架大大增强了物联网安全策略的适应性和弹性。我们的研究结果表明，人工智能/移动语言的整合在为物联网生态系统创建反应灵敏、稳健的安全措施方面具有潜力。我们的研究结果表明，动态和自适应安全框架对于保护物联网设备免受不断变化的网络威胁、确保符合监管标准以及在各种应用中维护物联网服务的完整性和可用性至关重要。

{"title":"Adaptive edge security framework for dynamic IoT security policies in diverse environments","authors":"Malka N. Halgamuge , Dusit Niyato","doi":"10.1016/j.cose.2024.104128","DOIUrl":"10.1016/j.cose.2024.104128","url":null,"abstract":"<div><div>The rapid expansion of Internet of Things (IoT) technologies has introduced significant cybersecurity challenges, particularly at the network edge where IoT devices operate. Traditional security policies designed for static environments fall short of addressing the dynamic, heterogeneous, and resource-constrained nature of IoT ecosystems. Existing dynamic security policy models lack versatility and fail to fully integrate comprehensive risk assessments, regulatory compliance, and AI/ML (artificial intelligence/machine learning)-driven adaptability. We develop a novel adaptive edge security framework that dynamically generates and adjusts security policies for IoT edge devices. Our framework integrates a dynamic security policy generator, a conflict detection and resolution in policy generator, a bias-aware risk assessment system, a regulatory compliance analysis system, and an AI-driven adaptability integration system. This approach produces tailored security policies that adapt to changes in the threat landscape, regulatory requirements, and device statuses. Our study identifies critical security challenges in diverse IoT environments and demonstrates the effectiveness of our framework through simulations and real-world scenarios. We found that our framework significantly enhances the adaptability and resilience of IoT security policies. Our results demonstrate the potential of AI/ML integration in creating responsive and robust security measures for IoT ecosystems. The implications of our findings suggest that dynamic and adaptive security frameworks are essential for protecting IoT devices against evolving cyber threats, ensuring compliance with regulatory standards, and maintaining the integrity and availability of IoT services across various applications.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104128"},"PeriodicalIF":4.8,"publicationDate":"2024-09-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142319656","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Security awareness, decision style, knowledge, and phishing email detection: Moderated mediation analyses 安全意识、决策风格、知识和网络钓鱼邮件检测：调节中介分析

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-20 DOI: 10.1016/j.cose.2024.104129

Daniel Sturman , Jaime C. Auton , Ben W. Morrison

This study examines whether the negative relationship between email information security awareness and phishing email susceptibility is mediated by less intuitive decision-making when assessing emails, and whether this relationship is moderated by phishing email knowledge. Participants (N = 291) completed an online email sorting task, a measure of email use information security awareness, a measure of preference for intuitive decision-making with emails, and a measure of phishing email knowledge. Moderated mediation analyses indicated that information security awareness predicted positive behavioural intentions directly and indirectly through lower preference for intuitive decision-making, and these relationships were stronger when phishing email knowledge was lower. Further, both the direct and indirect relationships between information security awareness and sensitivity through intuitive decision styles were moderated by phishing email knowledge, with information security awareness positively predicting ability to discriminate phishing from genuine emails when phishing knowledge was average or high but not low. These findings suggest that in the absence of phishing knowledge, information security awareness and less intuitive decision styles reduce susceptibility to phishing attacks through increased caution. Further, the findings provide strong support for the proposition that some level of phishing knowledge is required before email security behaviours and decision-making processes aid in the detection of phishing emails. From an applied perspective, the outcomes suggest that focusing on a combination of awareness, knowledge, and decision-making processes could increase the effectiveness of anti-phishing and cybersecurity training programs.

本研究探讨了电子邮件信息安全意识与网络钓鱼电子邮件易感性之间的负相关关系是否会因评估电子邮件时较少的直觉决策而发生中介作用，以及这种关系是否会受到网络钓鱼电子邮件知识的调节。参与者（N = 291）完成了一项在线电子邮件分类任务、一项电子邮件使用信息安全意识测量、一项电子邮件直觉决策偏好测量和一项网络钓鱼电子邮件知识测量。调节中介分析表明，信息安全意识直接或间接地通过降低对直觉决策的偏好来预测积极的行为意向，当网络钓鱼邮件知识较低时，这些关系更强。此外，信息安全意识和通过直觉决策方式的敏感性之间的直接和间接关系都受到网络钓鱼邮件知识的调节，当网络钓鱼邮件知识一般或较高而不是较低时，信息安全意识会积极预测辨别网络钓鱼邮件和真实邮件的能力。这些研究结果表明，在不了解网络钓鱼知识的情况下，信息安全意识和直觉性较低的决策风格会通过提高警惕性来降低对网络钓鱼攻击的易感性。此外，研究结果还有力地支持了这样一种观点，即在电子邮件安全行为和决策过程有助于发现网络钓鱼电子邮件之前，需要具备一定程度的网络钓鱼知识。从应用的角度来看，研究结果表明，注重意识、知识和决策过程的结合可以提高反网络钓鱼和网络安全培训计划的有效性。

{"title":"Security awareness, decision style, knowledge, and phishing email detection: Moderated mediation analyses","authors":"Daniel Sturman , Jaime C. Auton , Ben W. Morrison","doi":"10.1016/j.cose.2024.104129","DOIUrl":"10.1016/j.cose.2024.104129","url":null,"abstract":"<div><div>This study examines whether the negative relationship between email information security awareness and phishing email susceptibility is mediated by less intuitive decision-making when assessing emails, and whether this relationship is moderated by phishing email knowledge. Participants (<em>N</em> = 291) completed an online email sorting task, a measure of email use information security awareness, a measure of preference for intuitive decision-making with emails, and a measure of phishing email knowledge. Moderated mediation analyses indicated that information security awareness predicted positive behavioural intentions directly and indirectly through lower preference for intuitive decision-making, and these relationships were stronger when phishing email knowledge was lower. Further, both the direct and indirect relationships between information security awareness and sensitivity through intuitive decision styles were moderated by phishing email knowledge, with information security awareness positively predicting ability to discriminate phishing from genuine emails when phishing knowledge was average or high but not low. These findings suggest that in the absence of phishing knowledge, information security awareness and less intuitive decision styles reduce susceptibility to phishing attacks through increased caution. Further, the findings provide strong support for the proposition that some level of phishing knowledge is required before email security behaviours and decision-making processes aid in the detection of phishing emails. From an applied perspective, the outcomes suggest that focusing on a combination of awareness, knowledge, and decision-making processes could increase the effectiveness of anti-phishing and cybersecurity training programs.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104129"},"PeriodicalIF":4.8,"publicationDate":"2024-09-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://www.sciencedirect.com/science/article/pii/S0167404824004346/pdfft?md5=428b80616259772376cc426315aeb174&pid=1-s2.0-S0167404824004346-main.pdf","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142315502","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Towards more realistic evaluations: The impact of label delays in malware detection pipelines 实现更真实的评估：恶意软件检测管道中标签延迟的影响

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-19 DOI: 10.1016/j.cose.2024.104122

Marcus Botacin , Heitor Gomes

Developing and evaluating malware classification pipelines to reflect real-world needs is as vital to protect users as it is hard to achieve. In many cases, the experimental conditions when the approach was developed and the deployment settings mismatch, which causes the solutions not to achieve the desired results. In this work, we explore how unrealistic project and evaluation decisions in the literature are. In particular, we shed light on the problem of label delays, i.e., the assumption that ground-truth labels for classifier retraining are always available when in the real world they take significant time to be produced, which also causes a significant attack opportunity window. In our analyses, among diverse aspects, we address: (1) The use of metrics that do not account for the effect of time; (2) The occurrence of concept drift and ideal assumptions about the amount of drift data a system can handle; and (3) Ideal assumptions about the availability of oracle data for drift detection and the need for relying on pseudo-labels for mitigating drift-related delays. We present experiments based on a newly proposed exposure metric to show that delayed labels due to limited analysis queue sizes impose a significant challenge for detection (e.g., up to a 75% greater attack opportunity in the real world than in the experimental setting) and that pseudo-labels are useful in mitigating the delays (reducing the detection loss to only 30% of the original value).

开发和评估恶意软件分类管道以反映真实世界的需求，对于保护用户至关重要，但却很难实现。在许多情况下，方法开发时的实验条件与部署设置不匹配，导致解决方案无法达到预期效果。在这项工作中，我们探讨了文献中的项目和评估决策是如何不切实际。特别是，我们揭示了标签延迟的问题，即假设用于分类器再训练的地面实况标签总是可用的，而在现实世界中，标签的生成需要大量时间，这也造成了大量的攻击机会窗口。在我们的分析中，我们涉及了多个方面：(1) 使用不考虑时间影响的度量标准；(2) 概念漂移的发生以及关于系统可处理漂移数据量的理想假设；(3) 关于漂移检测甲骨文数据可用性的理想假设，以及依赖伪标签来减轻漂移相关延迟的必要性。我们基于新提出的暴露度量标准进行了实验，结果表明，由于分析队列规模有限而导致的标签延迟给检测带来了巨大挑战（例如，现实世界中的攻击机会比实验环境中的攻击机会最多高出 75%），而伪标签在缓解延迟方面非常有用（将检测损失降至原始值的 30%）。

{"title":"Towards more realistic evaluations: The impact of label delays in malware detection pipelines","authors":"Marcus Botacin , Heitor Gomes","doi":"10.1016/j.cose.2024.104122","DOIUrl":"10.1016/j.cose.2024.104122","url":null,"abstract":"<div><div>Developing and evaluating malware classification pipelines to reflect real-world needs is as vital to protect users as it is hard to achieve. In many cases, the experimental conditions when the approach was developed and the deployment settings mismatch, which causes the solutions not to achieve the desired results. In this work, we explore how unrealistic project and evaluation decisions in the literature are. In particular, we shed light on the problem of label delays, i.e., the assumption that ground-truth labels for classifier retraining are always available when in the real world they take significant time to be produced, which also causes a significant attack opportunity window. In our analyses, among diverse aspects, we address: (1) The use of metrics that do not account for the effect of time; (2) The occurrence of concept drift and ideal assumptions about the amount of drift data a system can handle; and (3) Ideal assumptions about the availability of oracle data for drift detection and the need for relying on pseudo-labels for mitigating drift-related delays. We present experiments based on a newly proposed exposure metric to show that delayed labels due to limited analysis queue sizes impose a significant challenge for detection (e.g., up to a 75% greater attack opportunity in the real world than in the experimental setting) and that pseudo-labels are useful in mitigating the delays (reducing the detection loss to only 30% of the original value).</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104122"},"PeriodicalIF":4.8,"publicationDate":"2024-09-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142311599","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

LaAeb: A comprehensive log-text analysis based approach for insider threat detection LaAeb：基于日志文本分析的内部威胁综合检测方法

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-19 DOI: 10.1016/j.cose.2024.104126

Kexiong Fei , Jiang Zhou , Yucan Zhou , Xiaoyan Gu , Haihui Fan , Bo Li , Weiping Wang , Yong Chen

Insider threats have increasingly become a critical issue that modern enterprises and organizations faced. They are mainly initiated by insider attackers, which may cause disastrous impacts. Numerous research studies have been conducted for insider threat detection. However, most of them are limited due to a small number of malicious samples. Moreover, as existing methods often concentrate on feature information or statistical characteristics for anomaly detection, they still lack effective use of comprehensive textual content information contained in logs and thus will affect detection efficiency.

We propose LaAeb, a novel unsupervised insider threat detection framework that leverages rich linguistic information in log contents to enable conventional methods, such as an Isolation Forest-based anomaly detection, to better detect insider threats besides using various features and statistical information. To find malicious acts under different scenarios, we consider three patterns of insider threats, including attention, emotion, and behavior anomaly. The attention anomaly detection analyzes textual contents of operation objects (e.g., emails and web pages) in logs to detect threats, where the textual information reflects the areas that employees focus on. When the attention seriously deviates from daily work, an employee may involve malicious acts. The emotion anomaly detection analyzes all dialogs between every two employees’ daily communicated texts and uses the degree of negative to find potential psychological problems. The behavior anomaly detection analyzes the operations of logs to detect threats. It utilizes information acquired from attention and emotion anomalies as ancillary features, integrating them with features and statistics extracted from log operations to create log embeddings. With these log embeddings, LaAeb employs anomaly detection algorithm like Isolation Forest to analyze an employee’s malicious operations, and further detects the employee’s behavior anomaly by considering all employees’ acts in the same department. Finally, LaAeb consolidates detection results of three patterns indicative of insider threats in a comprehensive manner.

We implement the prototype of LaAeb and test it on CERT and LANL datasets. Our evaluations demonstrate that compared with state-of-the-art unsupervised methods, LaAeb reduces FPR by 50% to reach 0.05 on CERT dataset under the same AUC

(0.93)

, and gets the best AUC

(0.97)

with 0.06 higher value on LANL dataset.

内部威胁日益成为现代企业和组织面临的关键问题。它们主要由内部攻击者发起，可能造成灾难性的影响。针对内部威胁检测开展了大量研究。然而，由于恶意样本数量较少，大多数研究都存在局限性。我们提出的 LaAeb 是一种新型的无监督内部威胁检测框架，它利用日志内容中丰富的语言信息，使传统方法（如基于隔离森林的异常检测）除了利用各种特征和统计信息外，还能更好地检测内部威胁。为了发现不同场景下的恶意行为，我们考虑了三种内部威胁模式，包括注意力异常、情绪异常和行为异常。注意力异常检测通过分析日志中操作对象（如电子邮件和网页）的文本内容来检测威胁，其中文本信息反映了员工关注的领域。当员工的注意力严重偏离日常工作时，就可能涉及恶意行为。情绪异常检测分析每两名员工日常交流文本之间的所有对话，通过负面程度发现潜在的心理问题。行为异常检测通过分析日志操作来发现威胁。它利用从注意力和情绪异常中获取的信息作为辅助特征，并将其与从日志操作中提取的特征和统计信息相整合，创建日志嵌入。有了这些日志嵌入，LaAeb 就会采用 Isolation Forest 等异常检测算法来分析员工的恶意操作，并通过考虑同一部门所有员工的行为来进一步检测员工的行为异常。最后，LaAeb 综合了三种表明内部威胁的模式的检测结果。我们实现了 LaAeb 的原型，并在 CERT 和 LANL 数据集上进行了测试。我们的评估结果表明，与最先进的无监督方法相比，LaAeb 在 CERT 数据集上降低了 50%的 FPR，在相同的 AUC（0.93）下达到 0.05，在 LANL 数据集上获得最佳 AUC（0.97），高出 0.06。

{"title":"LaAeb: A comprehensive log-text analysis based approach for insider threat detection","authors":"Kexiong Fei , Jiang Zhou , Yucan Zhou , Xiaoyan Gu , Haihui Fan , Bo Li , Weiping Wang , Yong Chen","doi":"10.1016/j.cose.2024.104126","DOIUrl":"10.1016/j.cose.2024.104126","url":null,"abstract":"<div><div>Insider threats have increasingly become a critical issue that modern enterprises and organizations faced. They are mainly initiated by insider attackers, which may cause disastrous impacts. Numerous research studies have been conducted for insider threat detection. However, most of them are limited due to a small number of malicious samples. Moreover, as existing methods often concentrate on feature information or statistical characteristics for anomaly detection, they still lack effective use of comprehensive textual content information contained in logs and thus will affect detection efficiency.</div><div>We propose <span>LaAeb</span>, a novel unsupervised insider threat detection framework that leverages rich linguistic information in log contents to enable conventional methods, such as an Isolation Forest-based anomaly detection, to better detect insider threats besides using various features and statistical information. To find malicious acts under different scenarios, we consider three patterns of insider threats, including <em>attention</em>, <em>emotion</em>, and <em>behavior anomaly</em>. The attention anomaly detection analyzes textual contents of operation objects (e.g., emails and web pages) in logs to detect threats, where the textual information reflects the areas that employees focus on. When the attention seriously deviates from daily work, an employee may involve malicious acts. The emotion anomaly detection analyzes all dialogs between every two employees’ daily communicated texts and uses the degree of negative to find potential psychological problems. The behavior anomaly detection analyzes the operations of logs to detect threats. It utilizes information acquired from attention and emotion anomalies as ancillary features, integrating them with features and statistics extracted from log operations to create log embeddings. With these log embeddings, <span>LaAeb</span> employs anomaly detection algorithm like Isolation Forest to analyze an employee’s malicious operations, and further detects the employee’s behavior anomaly by considering all employees’ acts in the same department. Finally, <span>LaAeb</span> consolidates detection results of three patterns indicative of insider threats in a comprehensive manner.</div><div>We implement the prototype of <span>LaAeb</span> and test it on CERT and LANL datasets. Our evaluations demonstrate that compared with state-of-the-art unsupervised methods, <span>LaAeb</span> reduces FPR by 50% to reach 0.05 on CERT dataset under the same AUC <span><math><mrow><mo>(</mo><mn>0</mn><mo>.</mo><mn>93</mn><mo>)</mo></mrow></math></span>, and gets the best AUC <span><math><mrow><mo>(</mo><mn>0</mn><mo>.</mo><mn>97</mn><mo>)</mo></mrow></math></span> with 0.06 higher value on LANL dataset.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104126"},"PeriodicalIF":4.8,"publicationDate":"2024-09-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142311603","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Detecting interest flooding attacks in NDN: A probability-based event-driven approach 检测 NDN 中的兴趣泛洪攻击：基于概率的事件驱动方法

IF 4.8 2区计算机科学 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

Computers & Security

Pub Date : 2024-09-19 DOI: 10.1016/j.cose.2024.104124

Matta Krishna Kumari, Nikhil Tripathi

The foundational concepts of the Internet were developed in the 1960s and 1970s with the goal of interconnecting hosts using the TCP/IP architecture. While this architecture has significantly impacted communication and commerce, it struggles to accommodate the Internet’s vast user base and diverse applications. Named Data Network (NDN), a next-generation Internet architecture is designed to overcome the current TCP/IP based Internet architecture’s limitations. NDN’s basic operations make it resilient against several traditional DoS/DDoS attacks. However, NDN remains vulnerable to Interest Flooding Attack (IFA), a class of DoS attacks that can exhaust the routers’ as well as the producers’ resources to disrupt network functionality. To detect these attacks, researchers came up with a few approaches. However, existing detection techniques focus on specific IFA variants but struggle to detect other variants. To address this challenge, in this paper, we propose a statistical abnormality detection scheme to identify all variants of IFA. Additionally, we generate a comprehensive NDN traffic dataset through our experiments and use it to evaluate the performance of the detection scheme. The experimental results show that our scheme can detect all variants of IFA with high accuracy. Towards the end, we also present a sensitivity analysis study that shows the impact of varying a few parameters on the detection performance of the proposed scheme.

互联网的基本概念是在 20 世纪 60 年代和 70 年代提出的，其目标是使用 TCP/IP 架构实现主机之间的互联。尽管这种架构对通信和商务产生了重大影响，但它仍难以适应互联网庞大的用户群和多样化的应用。命名数据网络（NDN）是下一代互联网架构，旨在克服当前基于 TCP/IP 的互联网架构的局限性。NDN 的基本操作使其能够抵御几种传统的 DoS/DDoS 攻击。然而，NDN 仍然容易受到兴趣泛滥攻击 (IFA) 的攻击，这类 DoS 攻击会耗尽路由器和生产者的资源，从而破坏网络功能。为了检测这些攻击，研究人员提出了一些方法。然而，现有的检测技术只关注特定的 IFA 变体，却很难检测到其他变体。为了应对这一挑战，我们在本文中提出了一种统计异常检测方案来识别 IFA 的所有变体。此外，我们还通过实验生成了一个全面的 NDN 流量数据集，并用它来评估检测方案的性能。实验结果表明，我们的方案可以高精度地检测出 IFA 的所有变体。最后，我们还进行了敏感性分析研究，显示了改变几个参数对所提方案检测性能的影响。

{"title":"Detecting interest flooding attacks in NDN: A probability-based event-driven approach","authors":"Matta Krishna Kumari, Nikhil Tripathi","doi":"10.1016/j.cose.2024.104124","DOIUrl":"10.1016/j.cose.2024.104124","url":null,"abstract":"<div><div>The foundational concepts of the Internet were developed in the 1960s and 1970s with the goal of interconnecting hosts using the TCP/IP architecture. While this architecture has significantly impacted communication and commerce, it struggles to accommodate the Internet’s vast user base and diverse applications. Named Data Network (NDN), a next-generation Internet architecture is designed to overcome the current TCP/IP based Internet architecture’s limitations. NDN’s basic operations make it resilient against several traditional DoS/DDoS attacks. However, NDN remains vulnerable to Interest Flooding Attack (IFA), a class of DoS attacks that can exhaust the routers’ as well as the producers’ resources to disrupt network functionality. To detect these attacks, researchers came up with a few approaches. However, existing detection techniques focus on specific IFA variants but struggle to detect other variants. To address this challenge, in this paper, we propose a statistical abnormality detection scheme to identify all variants of IFA. Additionally, we generate a comprehensive NDN traffic dataset through our experiments and use it to evaluate the performance of the detection scheme. The experimental results show that our scheme can detect all variants of IFA with high accuracy. Towards the end, we also present a sensitivity analysis study that shows the impact of varying a few parameters on the detection performance of the proposed scheme.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"148 ","pages":"Article 104124"},"PeriodicalIF":4.8,"publicationDate":"2024-09-19","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142319655","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0