Mathematics

Research

17 pages, 4772 KiB

Open AccessArticle

Design of Network Intrusion Detection System Using Lion Optimization-Based Feature Selection with Deep Learning Model

by Rayed AlGhamdi

Mathematics 2023, 11(22), 4607; https://doi.org/10.3390/math11224607 - 10 Nov 2023

Cited by 5 | Viewed by 1295

In the domain of network security, intrusion detection systems (IDSs) play a vital role in data security. While the utilization of the internet amongst consumers is increasing on a daily basis, the significance of security and privacy preservation of system alerts, due to [...] Read more.

In the domain of network security, intrusion detection systems (IDSs) play a vital role in data security. While the utilization of the internet amongst consumers is increasing on a daily basis, the significance of security and privacy preservation of system alerts, due to malicious actions, is also increasing. IDS is a widely executed system that protects computer networks from attacks. For the identification of unknown attacks and anomalies, several Machine Learning (ML) approaches such as Neural Networks (NNs) are explored. However, in real-world applications, the classification performances of these approaches are fluctuant with distinct databases. The major reason for this drawback is the presence of some ineffective or redundant features. So, the current study proposes the Network Intrusion Detection System using a Lion Optimization Feature Selection with a Deep Learning (NIDS-LOFSDL) approach to remedy the aforementioned issue. The NIDS-LOFSDL technique follows the concept of FS with a hyperparameter-tuned DL model for the recognition of intrusions. For the purpose of FS, the NIDS-LOFSDL method uses the LOFS technique, which helps in improving the classification results. Furthermore, the attention-based bi-directional long short-term memory (ABiLSTM) system is applied for intrusion detection. In order to enhance the intrusion detection performance of the ABiLSTM algorithm, the gorilla troops optimizer (GTO) is deployed so as to perform hyperparameter tuning. Since trial-and-error manual hyperparameter tuning is a tedious process, the GTO-based hyperparameter tuning process is performed, which demonstrates the novelty of the work. In order to validate the enhanced solution of the NIDS-LOFSDL system in terms of intrusion detection, a comprehensive range of experiments was performed. The simulation values confirm the promising results of the NIDS-LOFSDL system compared to existing DL methodologies, with a maximum accuracy of 96.88% and 96.92% on UNSW-NB15 and AWID datasets, respectively. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

23 pages, 5770 KiB

Open AccessArticle

ENRN: A System for Evaluating Network Resilience against Natural Disasters

by Mohammed J. F. Alenazi

Mathematics 2023, 11(20), 4250; https://doi.org/10.3390/math11204250 - 11 Oct 2023

Viewed by 1586

Abstract

The frequency and severity of natural disasters is surging, posing an urgent need for robust communication network infrastructure that is capable of withstanding these events. In this paper, we present a groundbreaking graph-theoretic system designed to evaluate and enhance network resilience in the [...] Read more.

The frequency and severity of natural disasters is surging, posing an urgent need for robust communication network infrastructure that is capable of withstanding these events. In this paper, we present a groundbreaking graph-theoretic system designed to evaluate and enhance network resilience in the face of natural disasters. Our solution harnesses the power of topological robustness metrics, integrating real-time weather data, geographic information, detailed network topology data, advanced resilience algorithms, and continuous network monitoring. The proposed scheme considers four major real-world U.S.-based network providers and evaluates their physical topologies against two major hurricanes. Our novel framework quantifies the important characteristics of network infrastructure; for instance, AT&T is identified to have fared better against Hurricane Ivan (57.98 points) than Hurricane Katrina (39.17 points). We not only provide current insights into network infrastructure resilience, but also uncover valuable findings that shed light on the performance of backbone U.S. networks during hurricanes. Furthermore, our findings provide actionable insights to enrich the overall survivability and functionality of communication networks, mitigating the adverse impacts of natural disasters on communication systems and critical services in terms of improving network resiliency via adding additional nodes and link or rewiring. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

17 pages, 2098 KiB

Open AccessArticle

Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks

by Grigorii Asyaev, Alexander Sokolov and Alexey Ruchay

Mathematics 2023, 11(18), 3939; https://doi.org/10.3390/math11183939 - 16 Sep 2023

Viewed by 1026

Abstract

This paper considers the main approaches to building algorithms for the decision support systems of information protection strategies against cyberattacks in the networks of automated process control systems (the so-called recommender systems). The advantages and disadvantages of each of the considered algorithms are [...] Read more.

This paper considers the main approaches to building algorithms for the decision support systems of information protection strategies against cyberattacks in the networks of automated process control systems (the so-called recommender systems). The advantages and disadvantages of each of the considered algorithms are revealed, and their applicability to the processing of the information security events of the UNSW-NB 15 dataset is analyzed. The dataset used contains raw network packets collected using the IXIA PerfectStorm software in the CyberRange laboratory of the Australian Cyber Security Centre (Canberra) in order to create a hybrid of the simulation of the real actions and the synthetic behavior of the network traffic generated during attacks. The possibility of applying four semantic proximity algorithms to partition process the data into clusters based on attack type in a distribution control system (DCS) is analyzed. The percentage of homogeneous records belonging to a particular type of attack is used as the metric that determines the optimal method of cluster partitioning. This metric was chosen under the assumption that cyberattacks located “closer” to each other in the multidimensional space have similar defense strategies. A hypothesis is formulated about the possibility of transferring knowledge about attacks from the vector feature space into a semantic form using semantic proximity methods. The percentage of homogeneous entries was maximal when the cosine proximity measure was used, which confirmed the hypothesis about the possibility of applying the corresponding algorithm in the recommender system. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

25 pages, 4803 KiB

Open AccessArticle

A Double-Layer Indemnity Enhancement Using LSTM and HASH Function Technique for Intrusion Detection System

by Abdullah Marish Ali, Fahad Alqurashi, Fawaz Jaber Alsolami and Sana Qaiyum

Mathematics 2023, 11(18), 3894; https://doi.org/10.3390/math11183894 - 13 Sep 2023

Cited by 1 | Viewed by 1220

Abstract

The Intrusion Detection System (IDS) is the most widely used network security mechanism for distinguishing between normal and malicious traffic network activities. It aids network security in that it may identify unforeseen hazards in network traffic. Several techniques have been put forth by [...] Read more.

The Intrusion Detection System (IDS) is the most widely used network security mechanism for distinguishing between normal and malicious traffic network activities. It aids network security in that it may identify unforeseen hazards in network traffic. Several techniques have been put forth by different researchers for network intrusion detection. However, because network attacks have increased dramatically, making it difficult to execute precise detection rates quickly, the demand for effectively recognizing network incursion is growing. This research proposed an improved solution that uses Long Short-Term Memory (LSTM) and hash functions to construct a revolutionary double-layer security solution for IoT Network Intrusion Detection. The presented framework utilizes standard and well-known real-time IDS datasets such as KDDCUP99 and UNSWNB-15. In the presented framework, the dataset was pre-processed, and it employed the Shuffle Shepherd Optimization (SSO) algorithm for tracking the most informative attributes from the filtered database. Further, the designed model used the LSTM algorithm for classifying the normal and malicious network traffic precisely. Finally, a secure hash function SHA3-256 was utilized for countering the attacks. The intensive experimental assessment of the presented approach with the conventional algorithms emphasized the efficiency of the proposed framework in terms of accuracy, precision, recall, etc. The analysis showed that the presented model attained attack prediction accuracy of 99.92% and 99.91% for KDDCUP99 and UNSWNB-15, respectively. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

15 pages, 1456 KiB

Open AccessArticle

Enhanced Internet of Things Security Situation Assessment Model with Feature Optimization and Improved SSA-LightGBM

by Baoshan Xie, Fei Li, Hao Li, Liya Wang and Aimin Yang

Mathematics 2023, 11(16), 3617; https://doi.org/10.3390/math11163617 - 21 Aug 2023

Cited by 6 | Viewed by 1335

Abstract

In this paper, an improved Internet of Things (IoT) network security situation assessment model is designed to solve the problems arising from the existing IoT network security situation assessment approach regarding feature extraction, validity, and accuracy. Firstly, raw data are dimensionally reduced using [...] Read more.

In this paper, an improved Internet of Things (IoT) network security situation assessment model is designed to solve the problems arising from the existing IoT network security situation assessment approach regarding feature extraction, validity, and accuracy. Firstly, raw data are dimensionally reduced using independent component analysis (ICA), and the weights of all features are calculated and fused using the maximum relevance minimum redundancy (mRMR) algorithm, Spearman’s rank correlation coefficient, and extreme gradient boosting (XGBoost) feature importance method to filter out the optimal subset of features. Piecewise chaotic mapping and firefly perturbation strategies are then used to optimize the sparrow search algorithm (SSA) to achieve fast convergence and prevent getting trapped in local optima, and then the optimized algorithm is used to improve the light gradient boosting machine (LightGBM) algorithm. Finally, the improved LightGBM method is used for training to calculate situation values based on a threat impact to assess the IoT network security situation. The research findings reveal that the model attained an evaluation accuracy of 99.34%, sustained a mean square error at the 0.00001 level, and reached its optimum convergence value by the 45th iteration with the fastest convergence speed. This enables the model to more effectively evaluate the IoT network security status. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

36 pages, 5844 KiB

Open AccessArticle

P4-HLDMC: A Novel Framework for DDoS and ARP Attack Detection and Mitigation in SD-IoT Networks Using Machine Learning, Stateful P4, and Distributed Multi-Controller Architecture

by Walid I. Khedr, Ameer E. Gouda and Ehab R. Mohamed

Mathematics 2023, 11(16), 3552; https://doi.org/10.3390/math11163552 - 17 Aug 2023

Cited by 7 | Viewed by 2247

Abstract

Distributed Denial of Service (DDoS) and Address Resolution Protocol (ARP) attacks pose significant threats to the security of Software-Defined Internet of Things (SD-IoT) networks. The standard Software-Defined Networking (SDN) architecture faces challenges in effectively detecting, preventing, and mitigating these attacks due to its [...] Read more.

Distributed Denial of Service (DDoS) and Address Resolution Protocol (ARP) attacks pose significant threats to the security of Software-Defined Internet of Things (SD-IoT) networks. The standard Software-Defined Networking (SDN) architecture faces challenges in effectively detecting, preventing, and mitigating these attacks due to its centralized control and limited intelligence. In this paper, we present P4-HLDMC, a novel collaborative secure framework that combines machine learning (ML), stateful P4, and a hierarchical logically distributed multi-controller architecture. P4-HLDMC overcomes the limitations of the standard SDN architecture, ensuring scalability, performance, and an efficient response to attacks. It comprises four modules: the multi-controller dedicated interface (MCDI) for real-time attack detection through a distributed alert channel (DAC), the MSMPF, a P4-enabled stateful multi-state matching pipeline function for analyzing IoT network traffic using nine state tables, the modified ensemble voting (MEV) algorithm with six classifiers for enhanced detection of anomalies in P4-extracted traffic patterns, and an attack mitigation process distributed among multiple controllers to effectively handle larger-scale attacks. We validate our framework using diverse test cases and real-world IoT network traffic datasets, demonstrating high detection rates, low false-alarm rates, low latency, and short detection times compared to existing methods. Our work introduces the first integrated framework combining ML, stateful P4, and SDN-based multi-controller architecture for DDoS and ARP detection in IoT networks. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

14 pages, 2294 KiB

Open AccessArticle

Heterogeneous Blockchain-Based Secure Framework for UAV Data

by Abdullah Aljumah, Tariq Ahamed Ahanger and Imdad Ullah

Mathematics 2023, 11(6), 1348; https://doi.org/10.3390/math11061348 - 10 Mar 2023

Cited by 7 | Viewed by 1935

Abstract

Unmanned aerial vehicles, drones, and internet of things (IoT) based devices have acquired significant traction due to their enhanced usefulness. The primary use is aerial surveying of restricted or inaccessible locations. Based on the aforementioned aspects, the current study provides a method based [...] Read more.

Unmanned aerial vehicles, drones, and internet of things (IoT) based devices have acquired significant traction due to their enhanced usefulness. The primary use is aerial surveying of restricted or inaccessible locations. Based on the aforementioned aspects, the current study provides a method based on blockchain technology for ensuring the safety and confidentiality of data collected by virtual circuit-based devices. To test the efficacy of the suggested technique, an IoT-based application is integrated with a simulated vehicle monitoring system. Pentatope-based elliptic curve encryption and secure hash algorithm (SHA) are employed to provide anonymity in data storage. The cloud platform stores technical information, authentication, integrity, and vehicular responses. Additionally, the Ethbalance MetaMask wallet is used for BCN-based transactions. Conspicuously, the suggested technique aids in the prevention of several attacks, including plaintext attacks and ciphertext attacks, on sensitive information. When compared to the state-of-the-art techniques, the outcomes demonstrate the effectiveness and safety of the suggested method in terms of operational cost (2.95 units), scalability (14.98 units), reliability (96.07%), and stability (0.82). Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

24 pages, 340 KiB

Open AccessArticle

eIDAS Interoperability and Cross-Border Compliance Issues

by Marko Hölbl, Boštjan Kežmah and Marko Kompara

Mathematics 2023, 11(2), 430; https://doi.org/10.3390/math11020430 - 13 Jan 2023

Cited by 3 | Viewed by 2473

Abstract

The eIDAS Regulation provides a common foundation for secure electronic interaction between citizens, businesses, and public authorities. We investigated and identified interoperability and cross-border compliance issues in this paper. We have identified the following weaknesses: Organizational independence, remote access to banking services, remote [...] Read more.

The eIDAS Regulation provides a common foundation for secure electronic interaction between citizens, businesses, and public authorities. We investigated and identified interoperability and cross-border compliance issues in this paper. We have identified the following weaknesses: Organizational independence, remote access to banking services, remote video identification, use of electronic signatures in public administration, commercial access to the eIDAS network, biometric authentication mechanisms, and, finally, some technical issues with the mechanisms used to provide security and authentication in eIDAS nodes. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

19 pages, 2985 KiB

Open AccessArticle

Cyber Security for Detecting Distributed Denial of Service Attacks in Agriculture 4.0: Deep Learning Model

by Theyazn H. H. Aldhyani and Hasan Alkahtani

Mathematics 2023, 11(1), 233; https://doi.org/10.3390/math11010233 - 3 Jan 2023

Cited by 56 | Viewed by 6480

Abstract

Attackers are increasingly targeting Internet of Things (IoT) networks, which connect industrial devices to the Internet. To construct network intrusion detection systems (NIDSs), which can secure Agriculture 4.0 networks, powerful deep learning (DL) models have recently been deployed. An effective and adaptable intrusion [...] Read more.

Attackers are increasingly targeting Internet of Things (IoT) networks, which connect industrial devices to the Internet. To construct network intrusion detection systems (NIDSs), which can secure Agriculture 4.0 networks, powerful deep learning (DL) models have recently been deployed. An effective and adaptable intrusion detection system may be implemented by using the architectures of long short-term memory (LSTM) and convolutional neural network combined with long short-term memory (CNN–LSTM) for detecting DDoS attacks. The CIC-DDoS2019 dataset was used to design a proposal for detecting different types of DDoS attacks. The dataset was developed using the CICFlowMeter-V3 network. The standard network traffic dataset, including NetBIOS, Portmap, Syn, UDPLag, UDP, and normal benign packets, was used to test the development of deep learning approaches. Precision, recall, F1-score, and accuracy were among the measures used to assess the model’s performance. The suggested technology was able to reach a high degree of precision (100%). The CNN–LSTM has a score of 100% with respect to all the evaluation metrics. We used a deep learning method to build our model and compare it to existing systems to determine how well it performs. In addition, we believe that this proposed model has highest possible levels of protection against any cyber threat to Agriculture 4.0. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

30 pages, 1763 KiB

Open AccessArticle

Tackling Verification and Validation Techniques to Evaluate Cyber Situational Awareness Capabilities

by Salvador Llopis Sanchez, David Sandoval Rodriguez-Bermejo, Roumen Daton Medenou, Ramis Pasqual de Riquelme, Francesco Torelli and Jorge Maestre Vidal

Mathematics 2022, 10(15), 2617; https://doi.org/10.3390/math10152617 - 27 Jul 2022

Viewed by 2640

Abstract

Since cyberspace was identified as a domain of operations, defence practitioners started a race with academy, researchers, and industry and military organizations working together towards defining related lines of capability development (e.g., DOTMLPFI) and exploring the needs and opportunities they entail. An essential [...] Read more.

Since cyberspace was identified as a domain of operations, defence practitioners started a race with academy, researchers, and industry and military organizations working together towards defining related lines of capability development (e.g., DOTMLPFI) and exploring the needs and opportunities they entail. An essential cornerstone of adapting to the convergence of the cyber domain with conventional theaters of operation is the need for producing tools for easing to acquire cyber situational awareness (CSA), from which human operators shall be able to perceive, reason and project situations and events observed in cyberspace that may vertically/horizontally propagate from technological to tactical, operational and strategic planes. Benefiting from the higher maturity level of civilian capabilities for cybersecurity, the military sector has embraced the challenge of creating related beyond state-of-the-art CSA enablers that comprise the existing technological background while adopting concepts such as operations, missions or courses of action (CoAs), properly aligning them with military doctrine. Beyond ongoing development efforts, there is a wide methodological gap in the lack of suitable CSA verification and validation (V&V) frameworks, which are expected to analyze if related capabilities meet the requirements to operate in the military context; at the same time supporting the thorough development life-cycle of brand new cyber defence technologies. With the motivation of closing the identified gap, this research introduces a novel V&V framework able to guide the evaluation of CSA-related tools, which makes converge purely military aspects with dual-use state-of-the-art V&V approaches. Three core CSA evaluation concepts are discussed in-depth: software, operational and application tests. They range from the daily application of new capabilities to their ability to enable the acquisition of a joint operational picture understandable by human decision makers. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

25 pages, 3490 KiB

Open AccessFeature PaperArticle

Towards Trustworthy Safety Assessment by Providing Expert and Tool-Based XMECA Techniques

by Ievgen Babeshko, Oleg Illiashenko, Vyacheslav Kharchenko and Kostiantyn Leontiev

Mathematics 2022, 10(13), 2297; https://doi.org/10.3390/math10132297 - 30 Jun 2022

Cited by 13 | Viewed by 2019

Abstract

Safety assessment of modern critical instrumentation and control systems is a complicated process considerably dependent on expert techniques, single/multiple faults consideration scope, other assumptions, invoked limitations, and support tools used during the assessment process. Ignoring these assumptions, as well as the significance of [...] Read more.

Safety assessment of modern critical instrumentation and control systems is a complicated process considerably dependent on expert techniques, single/multiple faults consideration scope, other assumptions, invoked limitations, and support tools used during the assessment process. Ignoring these assumptions, as well as the significance of expert and tool influence, could lead to such effects as functional safety underestimation or overestimation in such a manner that functional safety assessment correctness and accuracy are affected. This paper introduces XMECA (x modes, effects, and criticality analysis, where x could be from different known techniques and domains—failures in functional safety, vulnerabilities and intrusions regarding cybersecurity, etc.) as a key technique of safety assessment. To verify the results obtained as XMECA deliverables, expert and uncertainty modes, effects, and criticality analysis (EUMECA) is performed, in particular focusing on decisions and judgments made by experts. Scenarios for processing verbal and quantitative information of XMECA tables from experts are offered. A case study of a possible functional safety assessment approach that considers the above-mentioned techniques and a supporting tool is provided. To assess the trustworthiness of safety analysis and estimation using XMECA, a set of the metrics is suggested. Features of adapting the suggested method for security assessment considering intrusions, vulnerabilities, and effects analysis (IMECA technique) are discussed. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

25 pages, 1375 KiB

Open AccessArticle

Mapping Tools for Open Source Intelligence with Cyber Kill Chain for Adversarial Aware Security

by Muhammad Mudassar Yamin, Mohib Ullah, Habib Ullah, Basel Katt, Mohammad Hijji and Khan Muhammad

Mathematics 2022, 10(12), 2054; https://doi.org/10.3390/math10122054 - 14 Jun 2022

Cited by 5 | Viewed by 5446

Abstract

Open-source intelligence (OSINT) tools are used for gathering information using different publicly available sources. With the rapid advancement in information technology and excessive use of social media in our daily lives, more public information sources are available than ever before. The access to [...] Read more.

Open-source intelligence (OSINT) tools are used for gathering information using different publicly available sources. With the rapid advancement in information technology and excessive use of social media in our daily lives, more public information sources are available than ever before. The access to public information from different sources can be used for unlawful purposes. Extracting relevant information from pools of massive public information sources is a large task. Multiple tools and techniques have been developed for this task, which can be used to identify people, aircraft, ships, satellites, and more. In this paper, we identify the tools used for extracting the OSINT information and their effectiveness concerning each other in different test cases. We mapped the identified tools with Cyber Kill Chain and used them in realistic cybersecurity scenarios to check their effusiveness in gathering OSINT. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

24 pages, 785 KiB

Open AccessArticle

Ciphertext-Policy Attribute-Based Encryption for Cloud Storage: Toward Data Privacy and Authentication in AI-Enabled IoT System

by P. Chinnasamy, P. Deepalakshmi, Ashit Kumar Dutta, Jinsang You and Gyanendra Prasad Joshi

Mathematics 2022, 10(1), 68; https://doi.org/10.3390/math10010068 - 26 Dec 2021

Cited by 37 | Viewed by 5024

Abstract

People can store their data on servers in cloud computing and allow public users to access data via data centers. One of the most difficult tasks is to provide security for the access policy of data, which is also needed to be stored [...] Read more.

People can store their data on servers in cloud computing and allow public users to access data via data centers. One of the most difficult tasks is to provide security for the access policy of data, which is also needed to be stored at cloud servers. The access structure (policy) itself may reveal partial information about what the ciphertext contains. To provide security for the access policy of data, a number of encryption schemes are available. Among these, CP-ABE (Ciphertext-Policy Attribute-Based Encryption) scheme is very significant because it helps to protect, broadcast, and control the access of information. The access policy that is sent as plaintext in the existing CP-ABE scheme along with a ciphertext may leak user privacy and data privacy. To resolve this problem, we hereby introduce a new technique, which hides the access policy using a hashing algorithm and provides security against insider attack using a signature verification scheme. The proposed system is compared with existing CP-ABE schemes in terms of computation and expressive policies. In addition, we can test the functioning of any access control that could be implemented in the Internet of Things (IoT). Additionally, security against indistinguishable adaptive chosen ciphertext attacks is also analyzed for the proposed work. Full article

(This article belongs to the Special Issue Analytical Frameworks and Methods for Cybersecurity)

► Show Figures

Figure 1

Journal Menu

Journal Browser

Analytical Frameworks and Methods for Cybersecurity

Share This Special Issue

Special Issue Editor

Special Issue Information

Keywords

Benefits of Publishing in a Special Issue

Published Papers (13 papers)

Research

Further Information

Guidelines

MDPI Initiatives

Follow MDPI