Showing items 1 - 20 of 121

Your selections:

A smart priority-based traffic control system for emergency vehicles

- Karmakar, Gour, Chowdhury, Abdullahi, Kamruzzaman, Joarder, Gondal, Iqbal

  • Authors: Karmakar, Gour , Chowdhury, Abdullahi , Kamruzzaman, Joarder , Gondal, Iqbal
  • Date: 2021
  • Type: Text , Journal article
  • Relation: IEEE Sensors Journal Vol. 21, no. 14 (2021), p. 15849-15858
  • Full Text: false
  • Reviewed:
  • Description: Unwanted events on roads, such as incidents and increased traffic jams, can cause human lives and economic loss. For efficient incident management, it is essential to send Emergency Vehicles (EVs) to the incident place as quickly as possible. To reduce incidence clearance time, several approaches exist to provide a clear pathway to EVs mainly fitted with RFID sensors in the urban areas. However, they neither assign priority to the EVs based on the type and severity of an incident nor consider the effect on other on-road traffic. To address this issue, in this paper, we introduce an Emergency Vehicle Priority System (EVPS) by determining the priority level of an EV based on the type and the severity of an incident, and estimating the number of necessary signal interventions while considering the impact of those interventions on the traffic in the roads surrounding the EV's travel path. We present how EVPS determines the priority code and a new algorithm to estimate the number of green signal interventions to attain the quickest incident response while concomitantly reducing impact on others. A simulation model is developed in Simulation of Urban Mobility (SUMO) using the real traffic data of Melbourne, Australia, captured by various sensors. Results show that our system recommends appropriate number of intervention that can reduce emergency response time significantly. © 2001-2012 IEEE.

Blockchain leveraged decentralized IoT eHealth framework

- Uddin, Ashraf, Stranieri, Andrew, Gondal, Iqbal, Balasubramanian, Venki

  • Authors: Uddin, Ashraf , Stranieri, Andrew , Gondal, Iqbal , Balasubramanian, Venki
  • Date: 2020
  • Type: Text , Journal article
  • Relation: Internet of Things Vol. 9, no. March 2020 p. 100159
  • Full Text:
  • Reviewed:
  • Description: Blockchain technologies recently emerging for eHealth, can facilitate a secure, decentral- ized and patient-driven, record management system. However, Blockchain technologies cannot accommodate the storage of data generated from IoT devices in remote patient management (RPM) settings as this application requires a fast consensus mechanism, care- ful management of keys and enhanced protocols for privacy. In this paper, we propose a Blockchain leveraged decentralized eHealth architecture which comprises three layers: (1) The Sensing layer –Body Area Sensor Networks include medical sensors typically on or in a patient body transmitting data to a smartphone. (2) The NEAR processing layer –Edge Networks consist of devices at one hop from data sensing IoT devices. (3) The FAR pro- cessing layer –Core Networks comprise Cloud or other high computing servers). A Patient Agent (PA) software replicated on the three layers processes medical data to ensure reli- able, secure and private communication. The PA executes a lightweight Blockchain consen- sus mechanism and utilizes a Blockchain leveraged task-offloading algorithm to ensure pa- tient’s privacy while outsourcing tasks. Performance analysis of the decentralized eHealth architecture has been conducted to demonstrate the feasibility of the system in the pro- cessing and storage of RPM data.

Cyberattack triage using incremental clustering for intrusion detection systems

- Taheri, Sona, Bagirov, Adil, Gondal, Iqbal, Brown, Simon

  • Authors: Taheri, Sona , Bagirov, Adil , Gondal, Iqbal , Brown, Simon
  • Date: 2020
  • Type: Text , Journal article
  • Relation: International Journal of Information Security Vol. 19, no. 5 (2020), p. 597-607
  • Relation: http://purl.org/au-research/grants/arc/DP190100580
  • Full Text: false
  • Reviewed:
  • Description: Intrusion detection systems (IDSs) are devices or software applications that monitor networks or systems for malicious activities and signals alerts/alarms when such activity is discovered. However, an IDS may generate many false alerts which affect its accuracy. In this paper, we develop a cyberattack triage algorithm to detect these alerts (so-called outliers). The proposed algorithm is designed using the clustering, optimization and distance-based approaches. An optimization-based incremental clustering algorithm is proposed to find clusters of different types of cyberattacks. Using a special procedure, a set of clusters is divided into two subsets: normal and stable clusters. Then, outliers are found among stable clusters using an average distance between centroids of normal clusters. The proposed algorithm is evaluated using the well-known IDS data sets—Knowledge Discovery and Data mining Cup 1999 and UNSW-NB15—and compared with some other existing algorithms. Results show that the proposed algorithm has a high detection accuracy and its false negative rate is very low. © 2019, Springer-Verlag GmbH Germany, part of Springer Nature.
  • Description: This research was conducted in Internet Commerce Security Laboratory (ICSL) funded by Westpac Banking Corporation Australia. In addition, the research by Dr. Sona Taheri and A/Prof. Adil Bagirov was supported by the Australian Government through the Australian Research Council’s Discovery Projects funding scheme (DP190100580).

Dynamically recommending repositories for health data : a machine learning model

- Uddin, Md Ashraf, Stranieri, Andrew, Gondal, Iqbal, Balasubramanian, Venki

  • Authors: Uddin, Md Ashraf , Stranieri, Andrew , Gondal, Iqbal , Balasubramanian, Venki
  • Date: 2020
  • Type: Text , Conference proceedings
  • Relation: 2020 Australasian Computer Science Week Multiconference, ACSW 2020
  • Full Text: false
  • Reviewed:
  • Description: Recently, a wide range of digital health record repositories has emerged. These include Electronic Health record managed by the government, Electronic Medical Record (EMR) managed by healthcare providers, Personal Health Record (PHR) managed directly by the patient and new Blockchain-based systems mainly managed by technologies. Health record repositories differ from one another on the level of security, privacy, and quality of services (QoS) they provide. Health data stored in these repositories also varies from patient to patient in sensitivity, and significance depending on medical, personal preference, and other factors. Decisions regarding which digital record repository is most appropriate for the storage of each data item at every point in time are complex and nuanced. The challenges are exacerbated with health data continuously streamed from wearable sensors. In this paper, we propose a recommendation model for health data storage that can accommodate patient preferences and make storage decisions rapidly, in real-time, even with streamed data. The model maps health data to be stored in the repositories. The mapping between health data features and characteristics of each repository is learned using a machine learning-based classifier mediated through clinical rules. Evaluation results demonstrate the model's feasibility. © 2020 ACM.
  • Description: E1

Function similarity using family context

- Black, Paul, Gondal, Iqbal, Vamplew, Peter, Lakhotia, Arun

  • Authors: Black, Paul , Gondal, Iqbal , Vamplew, Peter , Lakhotia, Arun
  • Date: 2020
  • Type: Text , Journal article
  • Relation: Electronics Vol. 9, no. 7 (Jul 2020), p. 20
  • Full Text:
  • Reviewed:
  • Description: Finding changed and similar functions between a pair of binaries is an important problem in malware attribution and for the identification of new malware capabilities. This paper presents a new technique called Function Similarity using Family Context (FSFC) for this problem. FSFC trains a Support Vector Machine (SVM) model using pairs of similar functions from two program variants. This method improves upon previous research called Cross Version Contextual Function Similarity (CVCFS) e epresenting a function using features extracted not just from the function itself, but also, from other functions with which it has a caller and callee relationship. We present the results of an initial experiment that shows that the use of additional features from the context of a function significantly decreases the false positive rate, obviating the need for a separate pass for cleaning false positives. The more surprising and unexpected finding is that the SVM model produced by FSFC can abstract function similarity features from one pair of program variants to find similar functions in an unrelated pair of program variants. If validated by a larger study, this new property leads to the possibility of creating generic similar function classifiers that can be packaged and distributed in reverse engineering tools such as IDA Pro and Ghidra.
  • Description: This research was performed in the Internet Commerce Security Lab (ICSL), which is a joint venture with research partners Westpac, IBM, and Federation University Australia.

Hybrid intrusion detection system based on the stacking ensemble of C5 decision tree classifier and one class support vector machine

- Khraisat, Ansam, Gondal, Iqbal, Vamplew, Peter, Kamruzzaman, Joarder, Alazab, Ammar

  • Authors: Khraisat, Ansam , Gondal, Iqbal , Vamplew, Peter , Kamruzzaman, Joarder , Alazab, Ammar
  • Date: 2020
  • Type: Text , Journal article
  • Relation: Electronics (Switzerland) Vol. 9, no. 1 (2020), p.
  • Full Text:
  • Reviewed:
  • Description: Cyberttacks are becoming increasingly sophisticated, necessitating the efficient intrusion detection mechanisms to monitor computer resources and generate reports on anomalous or suspicious activities. Many Intrusion Detection Systems (IDSs) use a single classifier for identifying intrusions. Single classifier IDSs are unable to achieve high accuracy and low false alarm rates due to polymorphic, metamorphic, and zero-day behaviors of malware. In this paper, a Hybrid IDS (HIDS) is proposed by combining the C5 decision tree classifier and One Class Support Vector Machine (OC-SVM). HIDS combines the strengths of SIDS) and Anomaly-based Intrusion Detection System (AIDS). The SIDS was developed based on the C5.0 Decision tree classifier and AIDS was developed based on the one-class Support Vector Machine (SVM). This framework aims to identify both the well-known intrusions and zero-day attacks with high detection accuracy and low false-alarm rates. The proposed HIDS is evaluated using the benchmark datasets, namely, Network Security Laboratory-Knowledge Discovery in Databases (NSL-KDD) and Australian Defence Force Academy (ADFA) datasets. Studies show that the performance of HIDS is enhanced, compared to SIDS and AIDS in terms of detection rate and low false-alarm rates. © 2020 by the authors. Licensee MDPI, Basel, Switzerland.

Partial undersampling of imbalanced data for cyber threats detection

- Moniruzzaman, Md, Bagirov, Adil, Gondal, Iqbal

  • Authors: Moniruzzaman, Md , Bagirov, Adil , Gondal, Iqbal
  • Date: 2020
  • Type: Text , Conference proceedings , Conference paper
  • Relation: 2020 Australasian Computer Science Week Multiconference, ACSW 2020
  • Full Text:
  • Reviewed:
  • Description: Real-time detection of cyber threats is a challenging task in cyber security. With the advancement of technology and ease of access to the internet, more and more individuals and organizations are becoming the target for various cyber attacks such as malware, ransomware, spyware. The target of these attacks is to steal money or valuable information from the victims. Signature-based detection methods fail to keep up with the constantly evolving new threats. Machine learning based detection has drawn more attention of researchers due to its capability of detecting new and modified attacks based on previous attack's behaviour. The number of malicious activities in a certain domain is significantly low compared to the number of normal activities. Therefore, cyber threats detection data sets are imbalanced. In this paper, we proposed a partial undersampling method to deal with imbalanced data for detecting cyber threats. © 2020 ACM.
  • Description: E1

Rapid health data repository allocation using predictive machine learning

- Uddin, Ashraf, Stranieri, Andrew, Gondal, Iqbal, Balasubramanian, Venki

  • Authors: Uddin, Ashraf , Stranieri, Andrew , Gondal, Iqbal , Balasubramanian, Venki
  • Date: 2020
  • Type: Text , Journal article
  • Relation: Health Informatics Journal Vol. 26, no. 4 (2020), p. 3009-3036
  • Full Text:
  • Reviewed:
  • Description: Health-related data is stored in a number of repositories that are managed and controlled by different entities. For instance, Electronic Health Records are usually administered by governments. Electronic Medical Records are typically controlled by health care providers, whereas Personal Health Records are managed directly by patients. Recently, Blockchain-based health record systems largely regulated by technology have emerged as another type of repository. Repositories for storing health data differ from one another based on cost, level of security and quality of performance. Not only has the type of repositories increased in recent years, but the quantum of health data to be stored has increased. For instance, the advent of wearable sensors that capture physiological signs has resulted in an exponential growth in digital health data. The increase in the types of repository and amount of data has driven a need for intelligent processes to select appropriate repositories as data is collected. However, the storage allocation decision is complex and nuanced. The challenges are exacerbated when health data are continuously streamed, as is the case with wearable sensors. Although patients are not always solely responsible for determining which repository should be used, they typically have some input into this decision. Patients can be expected to have idiosyncratic preferences regarding storage decisions depending on their unique contexts. In this paper, we propose a predictive model for the storage of health data that can meet patient needs and make storage decisions rapidly, in real-time, even with data streaming from wearable sensors. The model is built with a machine learning classifier that learns the mapping between characteristics of health data and features of storage repositories from a training set generated synthetically from correlations evident from small samples of experts. Results from the evaluation demonstrate the viability of the machine learning technique used. © The Author(s) 2020.

A Decentralized Patient Agent Controlled Blockchain for Remote Patient Monitoring

- Uddin, Ashraf, Stranieri, Andrew, Gondal, Iqbal, Balasubramanian, Venki

  • Authors: Uddin, Ashraf , Stranieri, Andrew , Gondal, Iqbal , Balasubramanian, Venki
  • Date: 2019
  • Type: Text , Conference proceedings
  • Relation: 15th International Conference on Wireless and Mobile Computing, Networking and Communications, WiMob 2019 Vol. 2019-October, p. 207-214
  • Full Text: false
  • Reviewed:
  • Description: Blockchain emerging for healthcare provides a secure, decentralized and patient driven record management system. However, the storage of data generated from IoT devices in remote patient management applications requires a fast consensus mechanism. In this paper, we propose a lightweight consensus mechanism and a decentralized patient software agent to control a remote patient monitoring (RPM) system. The decentralized RPM architecture includes devices at three levels; 1) Body Area Sensor Network-medical sensors typically on or in patient's body transmitting data to a Smartphone, 2) Fog/Edge, and 3) Cloud. We propose that a Patient Agent(PA) software replicated on the Smartphone, Fog and Cloud servers processes medical data to ensure reliable, secure and private communication. Performance analysis has been conducted to demonstrate the feasibility of the proposed Blockchain leveraged, distributed Patient Agent controlled remote patient monitoring system. © 2019 IEEE.
  • Description: E1

A lightweight blockchain based framework for underwater ioT

- Uddin, Ashraf, Stranieri, Andrew, Gondal, Iqbal, Balasurbramanian, Venki

  • Authors: Uddin, Ashraf , Stranieri, Andrew , Gondal, Iqbal , Balasurbramanian, Venki
  • Date: 2019
  • Type: Text , Journal article
  • Relation: Electronics (Switzerland) Vol. 8, no. 12 (2019), p.
  • Full Text:
  • Reviewed:
  • Description: The Internet of Things (IoT) has facilitated services without human intervention for a wide range of applications, including underwater monitoring, where sensors are located at various depths, and data must be transmitted to surface base stations for storage and processing. Ensuring that data transmitted across hierarchical sensor networks are kept secure and private without high computational cost remains a challenge. In this paper, we propose a multilevel sensor monitoring architecture. Our proposal includes a layer-based architecture consisting of Fog and Cloud elements to process and store and process the Internet of Underwater Things (IoUT) data securely with customized Blockchain technology. The secure routing of IoUT data through the hierarchical topology ensures the legitimacy of data sources. A security and performance analysis was performed to show that the architecture can collect data from IoUT devices in the monitoring region efficiently and securely. © 2020 by the authors. Licensee MDPI, Basel, Switzerland.

A novel ensemble of hybrid intrusion detection system for detecting internet of things attacks

- Khraisat, Ansam, Gondal, Iqbal, Vamplew, Peter, Kamruzzaman, Joarder, Alazab, Ammar

  • Authors: Khraisat, Ansam , Gondal, Iqbal , Vamplew, Peter , Kamruzzaman, Joarder , Alazab, Ammar
  • Date: 2019
  • Type: Text , Journal article
  • Relation: Electronics (Switzerland) Vol. 8, no. 11 (2019), p.
  • Full Text:
  • Reviewed:
  • Description: The Internet of Things (IoT) has been rapidly evolving towards making a greater impact on everyday life to large industrial systems. Unfortunately, this has attracted the attention of cybercriminals who made IoT a target of malicious activities, opening the door to a possible attack to the end nodes. Due to the large number and diverse types of IoT devices, it is a challenging task to protect the IoT infrastructure using a traditional intrusion detection system. To protect IoT devices, a novel ensemble Hybrid Intrusion Detection System (HIDS) is proposed by combining a C5 classifier and One Class Support Vector Machine classifier. HIDS combines the advantages of Signature Intrusion Detection System (SIDS) and Anomaly-based Intrusion Detection System (AIDS). The aim of this framework is to detect both the well-known intrusions and zero-day attacks with high detection accuracy and low false-alarm rates. The proposed HIDS is evaluated using the Bot-IoT dataset, which includes legitimate IoT network traffic and several types of attacks. Experiments show that the proposed hybrid IDS provide higher detection rate and lower false positive rate compared to the SIDS and AIDS techniques. © 2019 by the authors. Licensee MDPI, Basel, Switzerland.

An efficient selective miner consensus protocol in blockchain oriented iot smart monitoring

- Uddin, Ashraf, Stranieri, Andrew, Gondal, Iqbal, Balasubramanian, Venki

  • Authors: Uddin, Ashraf , Stranieri, Andrew , Gondal, Iqbal , Balasubramanian, Venki
  • Date: 2019
  • Type: Text , Conference proceedings , Conference paper
  • Relation: 2019 IEEE International Conference on Industrial Technology, ICIT 2019; Melbourne; Australia; 13th-15th February 2019 Vol. 2019-February, p. 1135-1142
  • Full Text:
  • Reviewed:
  • Description: Blockchains have been widely used in Internet of Things(IoT) applications including smart cities, smart home and smart governance to provide high levels of security and privacy. In this article, we advance a Blockchain based decentralized architecture for the storage of IoT data produced from smart home/cities. The architecture includes a secure communication protocol using a sign-encryption technique between power constrained IoT devices and a Gateway. The sign encryption also preserves privacy. We propose that a Software Agent executing on the Gateway selects a Miner node using performance parameters of Miners. Simulations demonstrate that the recommended Miner selection outperforms Proof of Works selection used in Bitcoin and Random Miner Selection.
  • Description: Proceedings of the IEEE International Conference on Industrial Technology

Blockchain leveraged task migration in body area sensor networks

- Uddin, Ashraf, Stranieri, Andrew, Gondal, Iqbal, Balasubramanian, Venki

  • Authors: Uddin, Ashraf , Stranieri, Andrew , Gondal, Iqbal , Balasubramanian, Venki
  • Date: 2019
  • Type: Text , Conference proceedings , Conference paper
  • Relation: 25th Asia-Pacific Conference on Communications, APCC 2019 p. 177-184
  • Full Text:
  • Reviewed:
  • Description: Blockchain technologies emerging for healthcare support secure health data sharing with greater interoperability among different heterogeneous systems. However, the collection and storage of data generated from Body Area Sensor Net-works(BASN) for migration to high processing power computing services requires an efficient BASN architecture. We present a decentralized BASN architecture that involves devices at three levels; 1) Body Area Sensor Network-medical sensors typically on or in patient's body transmitting data to a Smartphone, 2) Fog/Edge, and 3) Cloud. We propose that a Patient Agent(PA) replicated on the Smartphone, Fog and Cloud servers processes medical data and execute a task offloading algorithm by leveraging a Blockchain. Performance analysis is conducted to demonstrate the feasibility of the proposed Blockchain leveraged, distributed Patient Agent controlled BASN. © 2019 IEEE.
  • Description: E1

Cybersecurity indexes for eHealth

- Burke, Wendy, Oseni, Taiwo, Jolfaei, Alireza, Gondal, Iqbal

  • Authors: Burke, Wendy , Oseni, Taiwo , Jolfaei, Alireza , Gondal, Iqbal
  • Date: 2019
  • Type: Text , Conference proceedings
  • Relation: 2019 Australasian Computer Science Week Multiconference, ACSW 2019; Sydney, Australia; 29th-31st January 2019 p. 1-8
  • Full Text: false
  • Reviewed:
  • Description: This study aimed to explore the cybersecurity landscape to identify cybersecurity indexes that may be relevant to the health industry. While the healthcare sector poses security concerns regarding patients' records, cybersecurity in the healthcare sector has not been given much consideration. Cybersecurity indexes are a survey that measures security preparedness and capabilities of a country or organisation. An index is made up of a series of questions, often broken into categories. These categories target areas such as law, technical responses, organisational threats, capacity building and social context. Some indexes provide ranking capabilities against other countries, while others directly evaluate what it means to be cyber-ready. In this paper, cybersecurity indexes were reviewed regarding the level of assessment (country level/organisation level), and their consideration of the wider community, the health sector, and their appearance in academic literature. Results from this study found that there was no consistency between the indexes investigated, with each index having a diverse number of categories and indicators. Some indexes resulted in a score; others did not rank their results in league tables. Evidence to calculate the level of adherence was often obtained from secondary sources, with four of the country indexes using both primary and secondary sources. Eight (out of fourteen) indexes measured wider community indicators and only one index specifically measured eHealth services. Findings from the initial systematic review suggest that hardly any peer-reviewed journal articles exist on the topic of cybersecurity indexes. The paper concludes that most of the indexes studied are broad and do not consider the eHealth sector specifically. Each index relies on a different process to gauge cybersecurity, with little to no academic rigour. It is expected that this research will contribute to the current (limited) literature addressing cybersecurity indexes.
  • Description: ACM International Conference Proceeding Series

Generative malware outbreak detection

- Park, Sean, Gondal, Iqbal, Kamruzzaman, Joarder, Oliver, Jon

  • Authors: Park, Sean , Gondal, Iqbal , Kamruzzaman, Joarder , Oliver, Jon
  • Date: 2019
  • Type: Text , Conference proceedings , Conference paper
  • Relation: 2019 IEEE International Conference on Industrial Technology, ICIT 2019 Vol. 2019-February, p. 1149-1154
  • Full Text: false
  • Reviewed:
  • Description: Recently several deep learning approaches have been attempted to detect malware binaries using convolutional neural networks and stacked deep autoencoders. Although they have shown respectable performance on a large corpus of dataset, practical defense systems require precise detection during the malware outbreaks where only a handful of samples are available. This paper demonstrates the effectiveness of the latent representations obtained through the adversarial autoencoder for malware outbreak detection. Using instruction sequence distribution mapped to a semantic latent vector, the model provides a highly effective neural signature that helps detecting variants of a previously identified malware within a campaign mutated with minor functional upgrade, function shuffling, or slightly modified obfuscations. The method demonstrates how adversarial autoencoder can turn a multiclass classification task into a clustering problem when the sample set size is limited and the distribution is biased. The model performance is evaluated on OS X malware dataset against traditional machine learning models. © 2019 IEEE.
  • Description: E1

Instruction cognitive one-shot malware outbreak detection

- Park, Sean, Gondal, Iqbal, Kamruzzaman, Joarder, Oliver, Jon

  • Authors: Park, Sean , Gondal, Iqbal , Kamruzzaman, Joarder , Oliver, Jon
  • Date: 2019
  • Type: Text , Conference paper
  • Relation: 26th International Conference on Neural Information Processing [ICONIP 2019] December 12-15 2019, Proceedings, Part IV Vol. 1142, p. 769-778
  • Full Text: false
  • Reviewed:
  • Description: New malware outbreaks cannot provide thousands of training samples which are required to counter malware campaigns. In some cases, there could be just one sample. So, the defense system at the firing line must be able to quickly detect many automatically generated variants using a single malware instance observed from the initial outbreak by tatically inspecting the binary executables. As previous research works show, statistical features such as term frequency-inverse document frequency and n-gram are significantly vulnerable to attacks by mutation through reinforcement learning. Recent studies focus on raw binary executable as a base feature which contains instructions describing the core logic of the sample. However, many approaches using image-matching neural networks are insufficient due to the malware mutation technique that generates a large number of samples with high entropy data. Deriving instruction cognitive representation that disambiguates legitimate instructions from the context is necessary for accurate detection over raw binary executables. In this paper, we present a novel method of detecting semantically similar malware variants within a campaign using a single raw binary malware executable. We utilize Discrete Fourier Transform of instruction cognitive representation extracted from self-attention transformer network. The experiments were conducted with in-the-wild malware samples from ransomware and banking Trojan campaigns. The proposed method outperforms several state of the art binary classification models.
  • Description: E1

Mobile malware detection : an analysis of deep learning model

- Khoda, Mahbub, Kamruzzaman, Joarder, Gondal, Iqbal, Imam, Tasadduq, Rahman, Ashfaqur, IEEE

  • Authors: Khoda, Mahbub , Kamruzzaman, Joarder , Gondal, Iqbal , Imam, Tasadduq , Rahman, Ashfaqur , IEEE
  • Date: 2019
  • Type: Text , Book chapter
  • Relation: 2019 IEEE International Conference on Industrial Technology p. 1161-1166
  • Full Text: false
  • Reviewed:
  • Description: Due to its widespread use, with numerous applications deployed everyday, smartphones have become an inevitable target of the malware developers. This huge number of applications renders manual inspection of codes infeasible; as such, researchers have proposed several malware detection techniques based on automatic machine learning tools. Deep learning has gained a lot of attention from the malware researchers due to its ability of capture complex relationships among inputs and outputs. However, deep learning models depend largely on several hyper-parameters (i.e., learning rate, batch size, dropout rate). Hence, it is of utmost importance to analyze the effect of these parameters on classifier performance. In this paper, we systematically studied the effect of these parameters along with the effect of network architecture. We showed that building arbitrary deep networks does not always improve classifier performance. We also determined the combination of hyper-parameters that yields best result. This study will be useful in building better deep neural network based model for malware classification.

Multi-source cyber-attacks detection using machine learning

- Taheri, Sona, Gondal, Iqbal, Bagirov, Adil, Harkness, Greg, Brown, Simon, Chi, Chihung

  • Authors: Taheri, Sona , Gondal, Iqbal , Bagirov, Adil , Harkness, Greg , Brown, Simon , Chi, Chihung
  • Date: 2019
  • Type: Text , Conference proceedings , Conference paper
  • Relation: 2019 IEEE International Conference on Industrial Technology, ICIT 2019; Melbourne, Australia; 13th-15th February 2019 Vol. 2019-February, p. 1167-1172
  • Full Text:
  • Reviewed:
  • Description: The Internet of Things (IoT) has significantly increased the number of devices connected to the Internet ranging from sensors to multi-source data information. As the IoT continues to evolve with new technologies number of threats and attacks against IoT devices are on the increase. Analyzing and detecting these attacks originating from different sources needs machine learning models. These models provide proactive solutions for detecting attacks and their sources. In this paper, we propose to apply a supervised machine learning classification technique to identify cyber-attacks from each source. More precisely, we apply the incremental piecewise linear classifier that constructs boundary between sources/classes incrementally starting with one hyperplane and adding more hyperplanes at each iteration. The algorithm terminates when no further significant improvement of the separation of sources/classes is possible. The construction and usage of piecewise linear boundaries allows us to avoid any possible overfitting. We apply the incremental piecewise linear classifier on the multi-source real world cyber security data set to identify cyber-attacks and their sources.
  • Description: Proceedings of the IEEE International Conference on Industrial Technology

One-shot malware outbreak detection using spatio-temporal isomorphic dynamic features

- Park, Sean, Gondal, Iqbal, Kamruzzaman, Joarder, Zhang, Leo

Robust malware defense in industrial IoT applications using machine learning with selective adversarial samples

- Khoda, Mahbub, Imam, Tasadduq, Kamruzzaman, Joarder, Gondal, Iqbal, Rahman, Ashfaqur

  • Authors: Khoda, Mahbub , Imam, Tasadduq , Kamruzzaman, Joarder , Gondal, Iqbal , Rahman, Ashfaqur
  • Date: 2019
  • Type: Text , Journal article
  • Relation: IEEE Transactions on Industry Applications Vol.56, no 4. (2020), p. 4415-4424
  • Full Text:
  • Reviewed:
  • Description: Industrial Internet of Things (IIoT) deploys edge devices to act as intermediaries between sensors and actuators and application servers or cloud services. Machine learning models have been widely used to thwart malware attacks in such edge devices. However, these models are vulnerable to adversarial attacks where attackers craft adversarial samples by introducing small perturbations to malware samples to fool a classifier to misclassify them as benign applications. Literature on deep learning networks proposes adversarial retraining as a defense mechanism where adversarial samples are combined with legitimate samples to retrain the classifier. However, existing works select such adversarial samples in a random fashion which degrades the classifier's performance. This work proposes two novel approaches for selecting adversarial samples to retrain a classifier. One, based on the distance from malware cluster center, and the other, based on a probability measure derived from a kernel based learning (KBL). Our experiments show that both of our sample selection methods outperform the random selection method and the KBL selection method improves detection accuracy by 6%. Also, while existing works focus on deep neural networks with respect to adversarial retraining, we additionally assess the impact of such adversarial samples on other classifiers and our proposed selective adversarial retraining approaches show similar performance improvement for these classifiers as well. The outcomes from the study can assist in designing robust security systems for IIoT applications.