There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

With exponential growth in the size of computer networks and developed applications, the significant increasing of the potential damage that can be caused by launching attacks is becoming obvious. Meanwhile, Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) are one of the most important defense tools against the sophisticated and ever-growing network attacks. Due to the lack of adequate dataset, anomaly-based approaches in intrusion detection systems are suffering from accurate deployment, analysis and evaluation. There exist a number of such datasets such as DARPA98, KDD99, ISC2012, and ADFA13 that have been used by the researchers to evaluate the performance of their proposed intrusion detection and intrusion prevention approaches. Based on our study over eleven available datasets since 1998, many such datasets are out of date and unreliable to use. Some of these datasets suffer from lack of traffic diversity and volumes, some of them do not cover the variety of attacks, while others anonymized packet information and payload which cannot reflect the current trends, or they lack feature set and metadata. This paper produces a reliable dataset that contains benign and seven common attack network flows, which meets real world criteria and is publicly avaliable. Consequently, the paper evaluates the performance of a comprehensive set of network traffic features and machine learning algorithms to indicate the best set of features for detecting the certain attack categories.

Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization

Machine learning techniques are being widely used to develop an intrusion detection system (IDS) for detecting and classifying cyberattacks at the network-level and the host-level in a timely and automatic manner. However, many challenges arise since malicious attacks are continually changing and are occurring in very large volumes requiring a scalable solution. There are different malware datasets available publicly for further research by cyber security community. However, no existing study has shown the detailed analysis of the performance of various machine learning algorithms on various publicly available datasets. Due to the dynamic nature of malware with continuously changing attacking methods, the malware datasets available publicly are to be updated systematically and benchmarked. In this paper, a deep neural network (DNN), a type of deep learning model, is explored to develop a flexible and effective IDS to detect and classify unforeseen and unpredictable cyberattacks. The continuous change in network behavior and rapid evolution of attacks makes it necessary to evaluate various datasets which are generated over the years through static and dynamic approaches. This type of study facilitates to identify the best algorithm which can effectively work in detecting future cyberattacks. A comprehensive evaluation of experiments of DNNs and other classical machine learning classifiers are shown on various publicly available benchmark malware datasets. The optimal network parameters and network topologies for DNNs are chosen through the following hyperparameter selection methods with KDDCup 99 dataset. All the experiments of DNNs are run till 1,000 epochs with the learning rate varying in the range [0.01-0.5]. The DNN model which performed well on KDDCup 99 is applied on other datasets, such as NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS 2017, to conduct the benchmark. Our DNN model learns the abstract and high-dimensional feature representation of the IDS data by passing them into many hidden layers. Through a rigorous experimental testing, it is confirmed that DNNs perform well in comparison with the classical machine learning classifiers. Finally, we propose a highly scalable and hybrid DNNs framework called scale-hybrid-IDS-AlertNet which can be used in real-time to effectively monitor the network traffic and host-level events to proactively alert possible cyberattacks.

/pdf/deep-learning-approach-for-intelligent-intrusion-detection-19gksnoeyl.pdf

Deep Learning Approach for Intelligent Intrusion Detection System

A Survey of Network-based Intrusion Detection Data Sets

In this paper, a new hybrid intrusion detection method that hierarchically integrates a misuse detection model and an anomaly detection model in a decomposition structure is proposed. First, a misuse detection model is built based on the C4.5 decision tree algorithm and then the normal training data is decomposed into smaller subsets using the model. Next, multiple one-class SVM models are created for the decomposed subsets. As a result, each anomaly detection model does not only use the known attack information indirectly, but also builds the profiles of normal behavior very precisely. The proposed hybrid intrusion detection method was evaluated by conducting experiments with the NSL-KDD data set, which is a modified version of well-known KDD Cup 99 data set. The experimental results demonstrate that the proposed method is better than the conventional methods in terms of the detection rate for both unknown and known attacks while it maintains a low false positive rate. In addition, the proposed method significantly reduces the high time complexity of the training and testing processes. Experimentally, the training and testing time of the anomaly detection model is shown to be only 50% and 60%, respectively, of the time required for the conventional models.

A novel hybrid intrusion detection method integrating anomaly detection with misuse detection

Science Information Network (SINET) is a Japanese academic backbone network for more than 800 research institutions and universities. In this paper, we present a multi-GPU-driven pipeline for handling huge session data of SINET. Our pipeline consists of ELK stack, multi-GPU server, and Splunk. A multi-GPU server is responsible for two procedures: discrimination and histogramming. Discrimination is dividing session data into ingoing/outgoing with subnet mask calculation and network address matching. Histogramming is grouping ingoing/outgoing session data into bins with map-reduce. In our architecture, we use GPU for the acceleration of ingress/egress discrimination of session data. Also, we use a tiling design pattern for building a two-stage map-reduce of CPU and GPU. Our multi-GPU-driven pipeline has succeeded in processing huge workloads of about 1.2 to 1.6 billion session streams (500GB-650GB) within 24 hours.

Choice of Parallelism: Multi-GPU Driven Pipeline for Huge Academic Backbone Network

A file transfer system includes a source apparatus and a destination apparatus connected to each other via a predetermined transmission path. The source apparatus includes a source-list generating unit generating a first list, a file storing unit, a list rewriting unit, and a file transmitting unit. The destination apparatus includes a destination-list generating unit generating a second list, a destination-list storing unit, a source-list obtaining unit, a determining unit, a transferred-file storing unit, and a destination-list rewriting unit. The destination apparatus obtains the first list held in the source apparatus, compares the first list with the second list to distinguish an untransferred file from files in the source apparatus, and obtains the untransferred file from the source apparatus while the source apparatus does not rewrite the second list.

File transfer system, file storage apparatus, method for storing file, and program

Recent targeted attacks have affected large networks, including those made up of multiple locations. Since branch offices are less secure than the headquarters (HQ), it is difficult to completely prevent malware from entering the network through these attacks. Therefore, it is important to quickly detect and respond to these attacks to prevent them from spreading to other locations. However, under the current management system, managers at each site must respond to incidents without sharing information from other sites, and the manager at the HQ cannot obtain enough information to estimate the relationship between the incidents. We propose a management system that refers to all of incident information archived by the organization, generates recommendations on the basis of the similarity between the ongoing incident and archived ones, and notifies each administrator to respond to the incident that occurred in his/her network regardless of resolved or unresolved incidents. The proposed system also notifies the administrators at HQ of the entirety of the attack on the basis of the relationship among recent and ongoing incidents.

Incident Response Support System for Multi-Located Network by Correlation Analysis of Individual Events

名古屋大学安否確認システムの現状と東日本大震災からの教訓 ; Current Status of Nagoya University Survivor Confirmation System and Lessons Learned from Great East Japan Earthquake

With remarkable advances of portable computers, users can move around various places with computers in order to achieve their objectives. This paper discusses a dynamic route navigation system which can cope with various kinds of users’ situations, e.g., objectives, profiles, current locations, histories of activities and surrounding status of users. Based on these situations, the system continuously generates users’ action plans in order to navigate to places where the users should visit. In order to obtain the situations effectively, a hierarchical wireless network model is proposed. By utilizing the mobile network, users can acquire information around them and interact with their surroundings. Functions of geographic database systems are employed to visualize the action plans effectively on the small sized display of portable computers. As an example of proposed system, this paper shows navigation system for shopping district where various kinds of shops and many people exist. How to cope with dynamic change of user’s situations in shown for this particular example.

Hiroki Takakura

Papers

Choice of Parallelism: Multi-GPU Driven Pipeline for Huge Academic Backbone Network

File transfer system, file storage apparatus, method for storing file, and program

Incident Response Support System for Multi-Located Network by Correlation Analysis of Individual Events

名古屋大学安否確認システムの現状と東日本大震災からの教訓 ; Current Status of Nagoya University Survivor Confirmation System and Lessons Learned from Great East Japan Earthquake

A Dynamic Navigation System Based on User's Geographical Situation