Marc Dacier's topic is: intrusion detection vs. detection of errors caused by intentionally malicious faults. Although research on intrusion detection has been carried out for more than two decades, it has recently received increased attention due to the success of the Internet. A recent survey conducted by the IBM Global Security Laboratory indicates that more than 20 intrusion-detection products are now available on the market, whereas two years ago there were only three. Despite this growth of product offerings, intrusion-detection solutions are still in their infancy. Not only is there a lack of understanding of what an intrusion really is, but also how it should be handled. Moreover, from a technical point of view, many critical issues remain unsolved.In this talk, Marc presents what has been done in the intrusion domain in the past, and highlights new research directions that need to be addressed. He will highlight the relationship between intrusion detection and fault tolerance, drawing on the body of knowledge that has been developed within the traditional dependability community, and noting the opportunities for these two communities to work together to solve this important problem.Sami Saydjari's topic is: the detection of novel, previously unseen attacks. Although intrusion detection is a field still in its infancy, two broad approaches have evolved: pattern-based detection and anomaly-based detection. Pattern-based detection, sometimes called misuse-based detection, relies on matching known patterns of attacks already suffered. Anomaly-based detection, on the other hand, relies on detecting behaviors that are abnormal with respect to some normal standard. An example is that of a masquerader trying to hide behind someone else's login; unless the masquerader is clever indeed, his activities will stand out as anomalous against a victim's profile of normal behavior. Anomaly-based detection techniques appear to hold the best hope of detecting new variants of attacks.Sami emphasizes that although there exist some low-level sensors that can detect known attacks, the research community must move quickly in learning how to detect novel attacks at much higher detection rates (state of the art is around 80%) while keeping the false positive rates very low (0.1% or better). Detecting novel attacks will require better anomaly detection algorithms. Achieving a 99.9% detection rate will require gaining a firm understanding of the "sweet spots" of various detection algorithms, as well as an understanding of how to fuse the results of the best of the best. There is also a need to better represent knowledge of attack patterns in a canonical form, to be able to share that knowledge across multiple detection tools, and to be able to judge tools on the basis of how effectively they use knowledge, as opposed to which tool can include the largest corpus of precompiled (pattern-based) knowledge into its on-line database.The session concludes with an open discussion of how research communities can work together to reduce undependability caused by intentionally malicious faults.

Intrusion Detection

The enormous increase in the use of the Internet in daily life has provided an opportunity for the intruder attempt to compromise the security principles of availability, confidentiality, and integrity. As a result, organizations are working to increase the level of security by using attack detection techniques such as Network Intrusion Detection System (NIDS), which monitors and analyzes network flow and attacks detection. There are a lot of researches proposed to develop the NIDS and depend on the dataset for the evaluation. Datasets allow evaluating the ability in detecting intrusion behavior. This paper introduces a detailed analysis of benchmark and recent datasets for NIDS. Specifically, we describe eight well-known datasets that include: KDD99, NSL-KDD, KYOTO 2006+, ISCX2012, UNSW-NB 15, CIDDS-001, CICIDS2017, and CSE-CIC-IDS2018. For each dataset, we provide a detailed analysis of its instances, features, classes, and the nature of the features. The main objective of this paper is to offer overviews of the datasets are available for the NIDS and what each dataset is comprised of. Furthermore, some recommendations were made to use network-based datasets.

/pdf/a-detailed-analysis-of-benchmark-datasets-for-network-3oi55q0g46.pdf

A Detailed Analysis of Benchmark Datasets for Network Intrusion Detection System

To accurately detect and identify whether there are abnormalities in the information of the expressway networking system, an information security event reasoning and traceability method based on deep learning is proposed to build a data security protection system that includes the data life periodicity of the expressway networking system. In this system, the information security event model based on intrusion detection message exchange format is established. The model uses the information risk event reasoning method based on a deep convolution neural network to infer the risk event during data sharing of the expressway networking system, reorganize and standardize the risk event information according to the format of the information security event standardization model, and store it in the risk event database in the form of Extensible Markup Language data document. The information risk event traceability method based on the electronic fingerprint takes all risk events in the database as the target. After designing the electronic fingerprint of risk events, the original network attack tree is constructed to realize risk event traceability combined with fingerprint information. Testing indicates that the reasoning and traceability results of this method to the information security events of the expressway networking system are consistent with those in reality and our method has good usability.

Reasoning and tracing of information security events in the expressway networking system based on deep learning

With the opportunity of the digital transformation of the vertical industry represented by the power grid in the 5G era, in order to meet the communication needs of all kinds of new services in the power grid application scene, in order to adapt to the comprehensive perception and intelligent interconnection development of the future power grid under the new situation, the intelligence of the power Internet of things supporting Yunbian collaboration needs to be improved urgently. Under the 5G architecture, how to effectively protect the business data of communication terminals has become the focus of relevant developers in the security industry. In order to solve the problem of illegal intrusion of equipment and secure data transmission, a big data security access processing device based on 5G is designed in this paper. In this device, the access terminal authentication module authenticates the user identity information through audio and video, two-dimensional code and other technologies; the data trust verification module confirms the data security through whitelist, data scanning and other methods; the data software and hardware encryption module encrypts the data through encryption chip and IPSEC protocol and other technologies. Combining these technologies, the secure transmission of network data is realized. In addition, by testing the throughput of the encryption algorithm, it is found that the smaller the key value of the encryption algorithm, the greater the throughput. 

A 5G-Based Big Data Security Access Processing Method and Device

Network traffic and logs are monitored by intrusion detection systems (IDS) for abnormal behavior that could indicate a security breach. Traditional IDS techniques require a considerable amount of time when processing big amounts of data. It also complicates the system and diminishes its effectiveness. In addition, the time required to analyze the data renders the system open to attack for an extended period of time before an alarm is generated. IDSs increasingly employ machine learning algorithms to enhance their ability to identify threats in the presence of massive volumes of data. This paper will introduce machine learning and IDS integration for big data. This connection will enhance the IDS system, increase its detection capabilities, and produce more accurate IDS results. A comprehensive survey of IDS that employ machine learning and big data is offered. Comparison is made between several machine learning algorithms used to improve IDS and the feature selection conducted on a specific dataset.

Machine Learning and Big Data Based IDS System Extensive Survey

This paper introduces Big data security analysis with the help of different techniques used in network intrusion detection system. The topic of how big data affects any intrusion detection system being used and how huge volume of the dataset, its specialized features that are heterogeneous in nature and what will happen if big data is processed at real time. Different attacks and intrusion detection methods such as intrusion detection and prevention systems (IDPS), signature-based detection (SD) and anomaly-based detection (AD) has been done. Challenges faced by intrusion detection systems (IDS), how they can be prevented and how machine learning, data mining techniques could be used in any general intrusion detection-based system has also been discussed. Also, how all the problem faced by IDPS can be solved by network simulator named NS-3.0. Its objectives, advantages, comparison with other networks and limitation have also been to be discussed. The recommendation is also given to improve faults. Also, results obtained after using NS-3 based svm classifier using KDD Cup 99 Dataset showed the accuracy of 99 percent.

/pdf/big-data-security-analysis-in-network-intrusion-detection-2ob99kd6ik.pdf

Hao Xiaoli

Papers

Big Data Security Analysis in Network Intrusion Detection System