This survey paper describes a literature review of deep learning (DL) methods for cyber security applications. A short tutorial-style description of each DL method is provided, including deep autoencoders, restricted Boltzmann machines, recurrent neural networks, generative adversarial networks, and several others. Then we discuss how each of the DL methods is used for security applications. We cover a broad array of attack types including malware, spam, insider threats, network intrusions, false data injection, and malicious domain names used by botnets.

https://www.mdpi.com/2078-2489/10/4/122/pdf

A Survey of Deep Learning Methods for Cyber Security

The proliferation in Internet of Things (IoT) devices, which routinely collect sensitive information, is demonstrated by their prominence in our daily lives. Although such devices simplify and automate every day tasks, they also introduce tremendous security flaws. Current insufficient security measures employed to defend smart devices make IoT the “weakest” link to breaking into a secure infrastructure, and therefore an attractive target to attackers. This paper proposes a three layer intrusion detection system (IDS) that uses a supervised approach to detect a range of popular network based cyber-attacks on IoT networks. The system consists of three main functions: 1) classify the type and profile the normal behavior of each IoT device connected to the network; 2) identifies malicious packets on the network when an attack is occurring; and 3) classifies the type of the attack that has been deployed. The system is evaluated within a smart home testbed consisting of eight popular commercially available devices. The effectiveness of the proposed IDS architecture is evaluated by deploying 12 attacks from 4 main network based attack categories, such as denial of service (DoS), man-in-the-middle (MITM)/spoofing, reconnaissance, and replay. Additionally, the system is also evaluated against four scenarios of multistage attacks with complex chains of events. The performance of the system’s three core functions result in an ${F}$ -measure of: 1) 96.2%; 2) 90.0%; and 3) 98.0%. This demonstrates that the proposed architecture can automatically distinguish between IoT devices on the network, whether network activity is malicious or benign, and detect which attack was deployed on which device connected to the network successfully.

/pdf/a-supervised-intrusion-detection-system-for-smart-home-iot-majw4av91v.pdf

A Supervised Intrusion Detection System for Smart Home IoT Devices

The era of artificial neural network (ANN) began with a simplified application in many fields and remarkable success in pattern recognition (PR) even in manufacturing industries. Although significant progress achieved and surveyed in addressing ANN application to PR challenges, nevertheless, some problems are yet to be resolved like whimsical orientation (the unknown path that cannot be accurately calculated due to its directional position). Other problem includes; object classification, location, scaling, neurons behavior analysis in hidden layers, rule, and template matching. Also, the lack of extant literature on the issues associated with ANN application to PR seems to slow down research focus and progress in the field. Hence, there is a need for state-of-the-art in neural networks application to PR to urgently address the above-highlights problems for more successes. The study furnishes readers with a clearer understanding of the current, and new trend in ANN models that effectively addresses PR challenges to enable research focus and topics. Similarly, the comprehensive review reveals the diverse areas of the success of ANN models and their application to PR. In evaluating the performance of ANN models, some statistical indicators for measuring the performance of the ANN model in many studies were adopted. Such as the use of mean absolute percentage error (MAPE), mean absolute error (MAE), root mean squared error (RMSE), and variance of absolute percentage error (VAPE). The result shows that the current ANN models such as GAN, SAE, DBN, RBM, RNN, RBFN, PNN, CNN, SLP, MLP, MLNN, Reservoir computing, and Transformer models are performing excellently in their application to PR tasks. Therefore, the study recommends the research focus on current models and the development of new models concurrently for more successes in the field.

/pdf/comprehensive-review-of-artificial-neural-network-4sb2zr5avn.pdf

Comprehensive Review of Artificial Neural Network Applications to Pattern Recognition

In this paper we propose deep learning models for the cyber security in IoT (Internet of Things) networks. IoT network is as a promising technology which connects the living and non-living things around the world. The implementation of IoT is growing fast but the cyber security is still a loophole, so it is susceptible to many cyber-attack and for the success of any network it most important that the network is completely secure, otherwise people could be reluctant to use this technology. DDoS (Distributed Denial of Service) attack has affected many IoT networks in recent past that has resulted in huge losses. We have proposed deep learning models and evaluated those using latest CICIDS2017 datasets for DDoS attack detection which has provided highest accuracy as 97.16% also proposed models are compared with machine learning algorithms. This paper also identifies open research challenges for usage of deep learning algorithm for IoT cyber security.

Deep Learning Models for Cyber Security in IoT Networks

Deep learning and big data technologies for IoT security

The recent growth of the Internet of Things (IoT) has resulted in a rise in IoT based DDoS attacks. This paper presents a solution to the detection of botnet activity within consumer IoT devices and networks. A novel application of Deep Learning is used to develop a detection model based on a Bidirectional Long Short Term Memory based Recurrent Neural Network (BLSTM-RNN). Word Embedding is used for text recognition and conversion of attack packets into tokenised integer format. The developed BLSTM-RNN detection model is compared to a LSTM-RNN for detecting four attack vectors used by the mirai botnet, and evaluated for accuracy and loss. The paper demonstrates that although the bidirectional approach adds overhead to each epoch and increases processing time, it proves to be a better progressive model over time. A labelled dataset was generated as part of this research, and is available upon request.

/pdf/botnet-detection-in-the-internet-of-things-using-deep-46g708gu2o.pdf

Botnet Detection in the Internet of Things using Deep Learning Approaches

An IoT botnet detection model is designed to detect anomalous attack traffic utilised by the mirai botnet malware. The model uses a novel application of Deep Bidirectional Long Short Term Memory based Recurrent Neural Network (BLSTM-RNN), in conjunction with Word Embedding, to convert string data found in captured packets, into a format usable by the BLSTM-RNN. In doing so, this paper presents a solution to the problem of detecting and making consumers situationally aware when their IoT devices are infected, and forms part of a botnet. The proposed model addresses the issue of detection, and returns high accuracy and low loss metrics for four attack vectors used by the mirai botnet malware, with only one attack vector shown to be difficult to detect and predict. A labelled dataset was generated and used for all experiments, to test and validate the accuracy and data loss in the detection model. This dataset is available upon request.

/pdf/towards-situational-awareness-of-botnet-activity-in-the-4pxm2m3e5o.pdf

Towards Situational Awareness of Botnet Activity in the Internet of Things

An adaptive multi-tiered framework, that can be utilised for designing a context-aware cyber physical system to carry out smart data acquisition and processing, while minimising the amount of necessary human intervention is proposed and applied. The proposed framework is applied within the domain of offshore asset integrity assurance. The suggested approach segregates processing of the input stream into three distinct phases of Processing, Prediction and Anomaly detection. The Processing phase minimises the data volume and processing cost by analysing only inputs from easily obtainable sources using context identification techniques for finding anomalies in the acquired data. During the Prediction phase, future values of each of the gas turbine’s sensors are estimated using a linear regression model. The final step of the process— Anomaly Detection—classifies the significant discrepancies between the observed and predicted values to identify potential anomalies in the operation of the cyber physical system under monitoring and control. The evolving component of the framework is based on an Artificial Neural Network with error backpropagation. Adaptability is achieved through the combined use of machine learning and computational intelligence techniques. The proposed framework has the generality to be applied across a wide range of problem domains requiring processing, analysis and interpretation of data obtained from heterogeneous resources.

/pdf/evolving-ann-based-sensors-for-a-context-aware-cyber-1wc5g38atc.pdf

Evolving ANN-based sensors for a context-aware cyber physical system of an offshore gas turbine

The need for computer-assisted real-time anomaly detection in engineering data used for condition monitoring is apparent in various applications, including the oil and gas, automotive industries and many other engineering domains To reduce the reliance on domain-specific experts’ knowledge, this paper proposes a deep learning framework that can assist in building a versatile anomaly detection tool needed for effective condition monitoring The framework enables building a computational anomaly detection model using different types of neural networks and supervised learning While building such a model, three types of ANN units were compared: a recurrent neural network, a long short-term memory network, and a gated recurrent unit Each of these units has been evaluated on two benchmark public datasets The experimental results of this comparative study revealed that the LSTM network unit that uses the sigmoid activation function, the Mean Absolute Error as the objective Loss function and the Adam optimizer as the output layer showed the best performance and attained the accuracy of over 77 % in detecting anomalous values in the datasets Having determined the best performing combination of the neural network components, a computational anomaly detection model was built within the framework, which was successfully evaluated on real-life engineering datasets comprising the timeseries datasets from an offshore installation in North Sea and another dataset from the automotive industry, which enabled exploring the anomaly classification capability of the proposed framework

/pdf/generic-application-of-deep-learning-framework-for-real-time-26on61gnnr.pdf

Generic Application of Deep Learning Framework for Real-Time Engineering Data Analysis

An adaptive multi-tiered framework, which can be utilised for designing a context-aware cyber physical system is proposed and applied within the context of assuring offshore asset integrity. Adaptability is achieved through the combined use of machine learning and computational intelligence techniques. The proposed framework has the generality to be applied across a wide range of problem domains requiring processing, analysis and interpretation of data obtained from heterogeneous resources.

/pdf/designing-a-context-aware-cyber-physical-system-for-smart-2i0o2wb5b0.pdf

Farzan Majdani

Papers

Botnet Detection in the Internet of Things using Deep Learning Approaches

Towards Situational Awareness of Botnet Activity in the Internet of Things

Evolving ANN-based sensors for a context-aware cyber physical system of an offshore gas turbine

Generic Application of Deep Learning Framework for Real-Time Engineering Data Analysis

Designing a context-aware cyber physical system for smart conditional monitoring of platform equipment.