There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

With exponential growth in the size of computer networks and developed applications, the significant increasing of the potential damage that can be caused by launching attacks is becoming obvious. Meanwhile, Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) are one of the most important defense tools against the sophisticated and ever-growing network attacks. Due to the lack of adequate dataset, anomaly-based approaches in intrusion detection systems are suffering from accurate deployment, analysis and evaluation. There exist a number of such datasets such as DARPA98, KDD99, ISC2012, and ADFA13 that have been used by the researchers to evaluate the performance of their proposed intrusion detection and intrusion prevention approaches. Based on our study over eleven available datasets since 1998, many such datasets are out of date and unreliable to use. Some of these datasets suffer from lack of traffic diversity and volumes, some of them do not cover the variety of attacks, while others anonymized packet information and payload which cannot reflect the current trends, or they lack feature set and metadata. This paper produces a reliable dataset that contains benign and seven common attack network flows, which meets real world criteria and is publicly avaliable. Consequently, the paper evaluates the performance of a comprehensive set of network traffic features and machine learning algorithms to indicate the best set of features for detecting the certain attack categories.

Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization

Machine learning techniques are being widely used to develop an intrusion detection system (IDS) for detecting and classifying cyberattacks at the network-level and the host-level in a timely and automatic manner. However, many challenges arise since malicious attacks are continually changing and are occurring in very large volumes requiring a scalable solution. There are different malware datasets available publicly for further research by cyber security community. However, no existing study has shown the detailed analysis of the performance of various machine learning algorithms on various publicly available datasets. Due to the dynamic nature of malware with continuously changing attacking methods, the malware datasets available publicly are to be updated systematically and benchmarked. In this paper, a deep neural network (DNN), a type of deep learning model, is explored to develop a flexible and effective IDS to detect and classify unforeseen and unpredictable cyberattacks. The continuous change in network behavior and rapid evolution of attacks makes it necessary to evaluate various datasets which are generated over the years through static and dynamic approaches. This type of study facilitates to identify the best algorithm which can effectively work in detecting future cyberattacks. A comprehensive evaluation of experiments of DNNs and other classical machine learning classifiers are shown on various publicly available benchmark malware datasets. The optimal network parameters and network topologies for DNNs are chosen through the following hyperparameter selection methods with KDDCup 99 dataset. All the experiments of DNNs are run till 1,000 epochs with the learning rate varying in the range [0.01-0.5]. The DNN model which performed well on KDDCup 99 is applied on other datasets, such as NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS 2017, to conduct the benchmark. Our DNN model learns the abstract and high-dimensional feature representation of the IDS data by passing them into many hidden layers. Through a rigorous experimental testing, it is confirmed that DNNs perform well in comparison with the classical machine learning classifiers. Finally, we propose a highly scalable and hybrid DNNs framework called scale-hybrid-IDS-AlertNet which can be used in real-time to effectively monitor the network traffic and host-level events to proactively alert possible cyberattacks.

/pdf/deep-learning-approach-for-intelligent-intrusion-detection-19gksnoeyl.pdf

Deep Learning Approach for Intelligent Intrusion Detection System

A Survey of Network-based Intrusion Detection Data Sets

In this paper, a new hybrid intrusion detection method that hierarchically integrates a misuse detection model and an anomaly detection model in a decomposition structure is proposed. First, a misuse detection model is built based on the C4.5 decision tree algorithm and then the normal training data is decomposed into smaller subsets using the model. Next, multiple one-class SVM models are created for the decomposed subsets. As a result, each anomaly detection model does not only use the known attack information indirectly, but also builds the profiles of normal behavior very precisely. The proposed hybrid intrusion detection method was evaluated by conducting experiments with the NSL-KDD data set, which is a modified version of well-known KDD Cup 99 data set. The experimental results demonstrate that the proposed method is better than the conventional methods in terms of the detection rate for both unknown and known attacks while it maintains a low false positive rate. In addition, the proposed method significantly reduces the high time complexity of the training and testing processes. Experimentally, the training and testing time of the anomaly detection model is shown to be only 50% and 60%, respectively, of the time required for the conventional models.

A novel hybrid intrusion detection method integrating anomaly detection with misuse detection

In order to utilize geographic web information for digital city applications, we have been developing a geographic web search system, KyotoSEARCH. When users retrieve geographic information on the web, specifying geographic location is an essential function. However, most current web search systems do not utilize location information sufficiently well to identify the user's intentions; available methods employ just keywords (for location names) and limited map functions. Furthermore, most map interfaces are used to select a determined geographic-hierarchy level or point to a specific location (sometimes specifying a radius). In this paper, we introduce two-dimensional range query processing for geographic web search, where users are able to specify a geographic area freely on a map interface. In order to handle such range queries more rapidly and efficiently, we adopt geometric operations to retrieve proper web pages. Without optimization techniques, however, the recall and precision of the search results become very low. Major problems come from erroneous extension of the computed geographic area due to i) same names for different geographic objects/locations (geowords), ii) redundant geographic hierarchy information, and iii) existence of non-important geowords. By resolving these problems, we can improve range query processing for geographic data. To that end, we propose an effective geographic scope optimization method for that supports geometric operations in geographic web search; experiments conducted on an implemented system are described.

Map-based range query processing for geographic web search systems

An information-processing device including a recording unit configured to record a plurality of types of content-data items to be recorded onto at least one predetermined recording medium, a determination unit configured to determine whether or not the plurality of types of content-data items recorded onto the recording medium by the recording unit includes at least one content-data item of which reproduction is difficult for a purpose-built reproduction device to perform, the purpose-built reproduction device supporting a predetermined format, and a notification unit configured to make a notification according to a predetermined method when the determination unit determines that the content-data item of which reproduction is difficult to perform is included, the notification indicating details on the determination is provided.

Information-processing device, content-reproduction-propriety-determination-notification method, and content-reproduction-propriety-determination-notification program

Tempfailing is widely used in many organizations as anti-spam technology. However, this technology causes a serious problem: it imposes long delays in mail delivery. To solve this problem, another technique called 5-Way Handshake was proposed, but its conventional implementation has a serious drawback. Based on the MX fallback mechanism defined by RFC5321, a legitimate sender must access MX hosts in order of their preferences. By making communication between primary and secondary MXs, the method examines whether a mail delivery follows the mechanism. This causes heavy communication overhead. In this paper, therefore, we propose modified mechanism of 5-Way Handshake for an anti-spam system in order to detect MX fallback in real-time.

Hiroki Takakura

Papers

Map-based range query processing for geographic web search systems

Information-processing device, content-reproduction-propriety-determination-notification method, and content-reproduction-propriety-determination-notification program

An anti-spam method via real-time retransmission detection

Implementation and Evaluation of an Anti-Spam Method via Real-Time Retransmission Detection

Proposal of a Network Control System to Detect, Analyze and Mitigate Targeted Cyber Attacks