Showing items 1 - 12 of 12

Your selections:

Cluster based rule discovery model for enhancement of government's tobacco control strategy

- Huda, Shamsul, Yearwood, John, Borland, Ron

  • Authors: Huda, Shamsul , Yearwood, John , Borland, Ron
  • Date: 2010
  • Type: Text , Conference proceedings
  • Full Text:
  • Description: Discovery of interesting rules describing the behavioural patterns of smokers' quitting intentions is an important task in the determination of an effective tobacco control strategy. In this paper, we investigate a compact and simplified rule discovery process for predicting smokers' quitting behaviour that can provide feedback to build an scientific evidence-based adaptive tobacco control policy. Standard decision tree (SDT) based rule discovery depends on decision boundaries in the feature space which are orthogonal to the axis of the feature of a particular decision node. This may limit the ability of SDT to learn intermediate concepts for high dimensional large datasets such as tobacco control. In this paper, we propose a cluster based rule discovery model (CRDM) for generation of more compact and simplified rules for the enhancement of tobacco control policy. The clusterbased approach builds conceptual groups from which a set of decision trees (a decision forest) are constructed. Experimental results on the tobacco control data set show that decision rules from the decision forest constructed by CRDM are simpler and can predict smokers' quitting intention more accurately than a single decision tree. © 2010 IEEE.

A new procedure to help system/network administrators identify multiple rootkit infections

- Lobo, Desmond, Watters, Paul, Wu, Xinwen

  • Authors: Lobo, Desmond , Watters, Paul , Wu, Xinwen
  • Date: 2010
  • Type: Text , Conference paper
  • Relation: Paper presented at 2nd International Conference on Communication Software and Networks, ICCSN 2010, Singapore : 26th-28th February 2010 p. 124-128
  • Full Text:
  • Description: Rootkits refer to software that is used to hide the presence of malware from system/network administrators and permit an attacker to take control of a computer. In our previous work, we designed a system that would categorize rootkits based on the hooks that had been created. Focusing on rootkits that use inline function hooking techniques, we showed that our system could successfully categorize a sample of rootkits using unsupervised EM clustering. In this paper, we extend our previous work by outlining a new procedure to help system/network administrators identify the rootkits that have infected their machines. Using a logistic regression model for profiling families of rootkits, we were able to identify at least one of the rootkits that had infected each of the systems that we tested. © 2010 IEEE.
  • Description: Rootkits refer to software that is used to hide the presence of malware from system/network administrators and permit an attacker to take control of a computer. In our previous work, we designed a system that would categorize rootkits based on the hooks that had been created. Focusing on rootkits that use inline function hooking techniques, we showed that our system could successfully categorize a sample of rootkits using unsupervised EM clustering. In this paper, we extend our previous work by outlining a new procedure to help system/network administrators identify the rootkits that have infected their machines. Using a logistic regression model for profiling families of rootkits, we were able to identify at least one of the rootkits that had infected each of the systems that we tested. © 2010 IEEE.

Coordination using social policies in dynamic agent organizations C3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

- Keogh, Kathleen, Sonenberg, Liz

Bio-inspired network security for 5G-enabled IoT applications

- Saleem, Kashif, Alabduljabbar, Ghadah, Alrowais, Nouf, Al-Muhtadi, Jalal, Imran, Muhammad, Rodrigues, Joel

  • Authors: Saleem, Kashif , Alabduljabbar, Ghadah , Alrowais, Nouf , Al-Muhtadi, Jalal , Imran, Muhammad , Rodrigues, Joel
  • Date: 2020
  • Type: Text , Journal article
  • Relation: IEEE access Vol. 8, no. (2020), p. 1-1
  • Full Text:
  • Reviewed:
  • Description: Every IPv6-enabled device connected and communicating over the Internet forms the Internet of things (IoT) that is prevalent in society and is used in daily life. This IoT platform will quickly grow to be populated with billions or more objects by making every electrical appliance, car, and even items of furniture smart and connected. The 5th generation (5G) and beyond networks will further boost these IoT systems. The massive utilization of these systems over gigabits per second generates numerous issues. Owing to the huge complexity in large-scale deployment of IoT, data privacy and security are the most prominent challenges, especially for critical applications such as Industry 4.0, e-healthcare, and military. Threat agents persistently strive to find new vulnerabilities and exploit them. Therefore, including promising security measures to support the running systems, not to harm or collapse them, is essential. Nature-inspired algorithms have the capability to provide autonomous and sustainable defense and healing mechanisms. This paper first surveys the 5G network layer security for IoT applications and lists the network layer security vulnerabilities and requirements in wireless sensor networks, IoT, and 5G-enabled IoT. Second, a detailed literature review is conducted with the current network layer security methods and the bio-inspired techniques for IoT applications exchanging data packets over 5G. Finally, the bio-inspired algorithms are analyzed in the context of providing a secure network layer for IoT applications connected over 5G and beyond networks.

An optimized hybrid deep intrusion detection model (HD-IDM) for enhancing network security

- Ahmad, Iftikhar, Imran, Muhammad, Qayyum, Abdul, Ramzan, Muhammad, Alassafi, Madini

  • Authors: Ahmad, Iftikhar , Imran, Muhammad , Qayyum, Abdul , Ramzan, Muhammad , Alassafi, Madini
  • Date: 2023
  • Type: Text , Journal article
  • Relation: Mathematics Vol. 11, no. 21 (2023), p.
  • Full Text:
  • Reviewed:
  • Description: Detecting cyber intrusions in network traffic is a tough task for cybersecurity. Current methods struggle with the complexity of understanding patterns in network data. To solve this, we present the Hybrid Deep Learning Intrusion Detection Model (HD-IDM), a new way that combines GRU and LSTM classifiers. GRU is good at catching quick patterns, while LSTM handles long-term ones. HD-IDM blends these models using weighted averaging, boosting accuracy, especially with complex patterns. We tested HD-IDM on four datasets: CSE-CIC-IDS2017, CSE-CIC-IDS2018, NSL KDD, and CIC-DDoS2019. The HD-IDM classifier achieved remarkable performance metrics on all datasets. It attains an outstanding accuracy of 99.91%, showcasing its consistent precision across the dataset. With an impressive precision of 99.62%, it excels in accurately categorizing positive cases, crucial for minimizing false positives. Additionally, maintaining a high recall of 99.43%, it effectively identifies the majority of actual positive cases while minimizing false negatives. The F1-score of 99.52% emphasizes its robustness, making it the top choice for classification tasks requiring precision and reliability. It is particularly good at ROC and precision/recall curves, discriminating normal and harmful network activities. While HD-IDM is promising, it has limits. It needs labeled data and may struggle with new intrusion methods. Future work should find ways to handle unlabeled data and adapt to emerging threats. Also, making HD-IDM work faster for real-time use and dealing with scalability challenges is key for its broader use in changing network environments. © 2023 by the authors.

Mining malware to detect variants

- Azab, Ahmad, Layton, Robert, Alazab, Mamoun, Oliver, Jonathan

  • Authors: Azab, Ahmad , Layton, Robert , Alazab, Mamoun , Oliver, Jonathan
  • Date: 2015
  • Type: Text , Conference paper
  • Relation: 5th Cybercrime and Trustworthy Computing Conference, CTC 2014; Aukland, New Zealand; 24th-25th November 2014 p. 44-53
  • Full Text: false
  • Reviewed:
  • Description: Cybercrime continues to be a growing challenge and malware is one of the most serious security threats on the Internet today which have been in existence from the very early days. Cyber criminals continue to develop and advance their malicious attacks. Unfortunately, existing techniques for detecting malware and analysing code samples are insufficient and have significant limitations. For example, most of malware detection studies focused only on detection and neglected the variants of the code. Investigating malware variants allows antivirus products and governments to more easily detect these new attacks, attribution, predict such or similar attacks in the future, and further analysis. The focus of this paper is performing similarity measures between different malware binaries for the same variant utilizing data mining concepts in conjunction with hashing algorithms. In this paper, we investigate and evaluate using the Trend Locality Sensitive Hashing (TLSH) algorithm to group binaries that belong to the same variant together, utilizing the k-NN algorithm. Two Zeus variants were tested, TSPY-ZBOT and MAL-ZBOT to address the effectiveness of the proposed approach. We compare TLSH to related hashing methods (SSDEEP, SDHASH and NILSIMSA) that are currently used for this purpose. Experimental evaluation demonstrates that our method can effectively detect variants of malware and resilient to common obfuscations used by cyber criminals. Our results show that TLSH and SDHASH provide the highest accuracy results in scoring an F-measure of 0.989 and 0.999 respectively. © 2014 IEEE.

Defending SDN against packet injection attacks using deep learning

- Phu, Anh, Li, Bo, Ullah, Faheem, Ul Huque, Tanvir, Naha, Ranesh, Babar, Muhammad, Nguyen, Hung

  • Authors: Phu, Anh , Li, Bo , Ullah, Faheem , Ul Huque, Tanvir , Naha, Ranesh , Babar, Muhammad , Nguyen, Hung
  • Date: 2023
  • Type: Text , Journal article
  • Relation: Computer Networks Vol. 234, no. (2023), p.
  • Full Text:
  • Reviewed:
  • Description: The (logically) centralized architecture of software-defined networks makes them an easy target for packet injection attacks. In these attacks, the attacker injects malicious packets into the SDN network to affect the services and performance of the SDN controller and overflows the capacity of the SDN switches. Such attacks have been shown to ultimately stop the network functioning in real-time, leading to network breakdowns. There have been significant works on detecting and defending against similar DoS attacks in non-SDN networks, but detection and protection techniques for SDN against packet injection attacks are still in their infancy. Furthermore, many of the proposed solutions have been shown to be easily bypassed by simple modifications to the attacking packets or by altering the attacking profile. In this paper, we develop novel Graph Convolutional Neural Network models and algorithms for grouping network nodes/users into security classes by learning from network data. We start with two simple classes — nodes that engage in suspicious packet injection attacks and nodes that are not. From these classes, we then partition the network into separate segments with different security policies using distributed Ryu controllers in an SDN network. We show in experiments on an emulated SDN that our detection solution outperforms alternative approaches with above 99% detection accuracy for various types (both old and new) of injection attacks. More importantly, our mitigation solution maintains continuous functions of non-compromised nodes while isolating compromised/suspicious nodes in real-time. All code and data are publicly available for the reproducibility of our results. © 2023 The Author(s)

Adaptive clustering with feature ranking for DDoS attacks detection

- Zi, Lifang, Yearwood, John, Wu, Xin

  • Authors: Zi, Lifang , Yearwood, John , Wu, Xin
  • Date: 2010
  • Type: Text , Conference proceedings
  • Full Text:
  • Description: Distributed Denial of Service (DDoS) attacks pose an increasing threat to the current internet. The detection of such attacks plays an important role in maintaining the security of networks. In this paper, we propose a novel adaptive clustering method combined with feature ranking for DDoS attacks detection. First, based on the analysis of network traffic, preliminary variables are selected. Second, the Modified Global K-means algorithm (MGKM) is used as the basic incremental clustering algorithm to identify the cluster structure of the target data. Third, the linear correlation coefficient is used for feature ranking. Lastly, the feature ranking result is used to inform and recalculate the clusters. This adaptive process can make worthwhile adjustments to the working feature vector according to different patterns of DDoS attacks, and can improve the quality of the clusters and the effectiveness of the clustering algorithm. The experimental results demonstrate that our method is effective and adaptive in detecting the separate phases of DDoS attacks. © 2010 IEEE.

A novel countermeasure technique for reactive jamming attack in internet of things

- Fadele, Alaba, Othman, Mazliza, Hashem, Ibrahim, Yaqoob, Ibrar, Imran, Muhammad, Shoaib, Muhammad

  • Authors: Fadele, Alaba , Othman, Mazliza , Hashem, Ibrahim , Yaqoob, Ibrar , Imran, Muhammad , Shoaib, Muhammad
  • Date: 2019
  • Type: Text , Journal article
  • Relation: Multimedia Tools and Applications Vol. 78, no. 21 (2019), p. 29899-29920
  • Full Text: false
  • Reviewed:
  • Description: In recent years, Internet of Things (IoT) has attracted significant attention because of its wide range of applications in various domains. However, security is a growing concern as users of small devices in an IoT network are unable to defend themselves against reactive jamming attacks. These attacks negatively affect the performance of devices and hinder IoT operations. To address such an issue, this paper presents a novel countermeasure detection and consistency algorithm (CDCA), which aims to fight reactive jamming attacks on IoT networks. The proposed CDCA uses a change in threshold value to detect and treat an attack. The algorithm employs channel signal strength to check packet consistency by determining if the data transmission value contradicts the threshold value. The node that sends the threshold value is periodically checked and the threshold value is compared with the current value after data transmission to find out if an attack has occurred in the network. Based on realistic simulation scenarios (e.g., with varying traffic interval, number of malicious nodes, and random mobility patterns), the performance of the proposed CDCA is evaluated using a Cooja simulator. Simulation results demonstrate the superiority of the proposed technique compared with contemporary schemes in terms of performance metrics such as energy consumption, traffic delay, and network throughput. © 2018, Springer Science+Business Media, LLC, part of Springer Nature.

Hybrid wrapper-filter approaches for input feature selection using maximum relevance and Artificial Neural Network Input Gain Measurement Approximation (ANNIGMA)

- Huda, Shamsul, Yearwood, John, Stranieri, Andrew

  • Authors: Huda, Shamsul , Yearwood, John , Stranieri, Andrew
  • Date: 2010
  • Type: Text , Conference proceedings
  • Full Text:
  • Description: Feature selection is an important research problem in machine learning and data mining applications. This paper proposes a hybrid wrapper and filter feature selection algorithm by introducing the filter's feature ranking score in the wrapper stage to speed up the search process for wrapper and thereby finding a more compact feature subset. The approach hybridizes a Mutual Information (MI) based Maximum Relevance (MR) filter ranking heuristic with an Artificial Neural Network (ANN) based wrapper approach where Artificial Neural Network Input Gain Measurement Approximation (ANNIGMA) has been combined with MR (MR-ANNIGMA) to guide the search process in the wrapper. The novelty of our approach is that we use hybrid of wrapper and filter methods that combines filter's ranking score with the wrapper-heuristic's score to take advantages of both filter and wrapper heuristics. Performance of the proposed MRANNIGMA has been verified using bench mark data sets and compared to both independent filter and wrapper based approaches. Experimental results show that MR-ANNIGMA achieves more compact feature sets and higher accuracies than both filter and wrapper approaches alone. © 2010 IEEE.

Securing internet of medical things with friendly-jamming schemes

- Li, Xuran, Dai, Hong-Ning, Wang, Qubeijian, Imran, Muhammad, Li, Dengwang

  • Authors: Li, Xuran , Dai, Hong-Ning , Wang, Qubeijian , Imran, Muhammad , Li, Dengwang
  • Date: 2020
  • Type: Text , Journal article , Review
  • Relation: Computer Communications Vol. 160, no. (2020), p. 431-442
  • Full Text: false
  • Reviewed:
  • Description: The Internet of Medical Things (IoMT)-enabled e-healthcare can complement traditional medical treatments in a flexible and convenient manner. However, security and privacy become the main concerns of IoMT due to the limited computational capability, memory space and energy constraint of medical sensors, leading to the in-feasibility for conventional cryptographic approaches, which are often computationally-complicated. In contrast to cryptographic approaches, friendly jamming (Fri-jam) schemes will not cause extra computing cost to medical sensors, thereby becoming potential countermeasures to ensure security of IoMT. In this paper, we present a study on using Fri-jam schemes in IoMT. We first analyze the data security in IoMT and discuss the challenges. We then propose using Fri-jam schemes to protect the confidential medical data of patients collected by medical sensors from being eavesdropped. We also discuss the integration of Fri-jam schemes with various communication technologies, including beamforming, Simultaneous Wireless Information and Power Transfer (SWIPT) and full duplexity. Moreover, we present two case studies of Fri-jam schemes in IoMT. The results of these two case studies indicate that the Fri-jam method will significantly decrease the eavesdropping risk while leading to no significant influence on legitimate transmission. © 2020

An intelligent and efficient network intrusion detection system using deep learning

- Qazi, Emad-Ul-Haq, Imran, Muhammad, Haider, Noman, Shoaib, Muhammad, Razzak, Imran

  • Authors: Qazi, Emad-Ul-Haq , Imran, Muhammad , Haider, Noman , Shoaib, Muhammad , Razzak, Imran
  • Date: 2022
  • Type: Text , Journal article
  • Relation: Computers and Electrical Engineering Vol. 99, no. (2022), p.
  • Full Text: false
  • Reviewed:
  • Description: With continuously escalating threats and attacks, accurate and timely intrusion detection in communication networks is challenging. Many approaches have already been proposed recently on network intrusion detection. However, they face critical challenges due to the continuous increase of new threats that current systems do not understand. Motivated by the outstanding performance of deep learning (DL) in many detection and recognition tasks, we introduce an intelligent and efficient network intrusion detection system (NIDS) based on DL. This study proposes a non-symmetric deep auto-encoder for network intrusion detection problems and presents its detailed functionality and performance. We validate the robustness and effectiveness of the proposed NIDS using a benchmark dataset, i.e., KDD CUP'99. Our DL-based method is implemented in the TensorFlow library and GPU framework, and it achieves an accuracy of 99.65%. The proposed system can be used in network security research domains and DL-based detection and classification systems. © 2022
  • 1