There is, I think, something ethereal about i —the square root of minus one. I remember first hearing about it at school. It seemed an odd beast at that time—an intruder hovering on the edge of reality.

Usually familiarity dulls this sense of the bizarre, but in the case of i it was the reverse: over the years the sense of its surreal nature intensified. It seemed that it was impossible to write mathematics that described the real world in …

I and i

With exponential growth in the size of computer networks and developed applications, the significant increasing of the potential damage that can be caused by launching attacks is becoming obvious. Meanwhile, Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) are one of the most important defense tools against the sophisticated and ever-growing network attacks. Due to the lack of adequate dataset, anomaly-based approaches in intrusion detection systems are suffering from accurate deployment, analysis and evaluation. There exist a number of such datasets such as DARPA98, KDD99, ISC2012, and ADFA13 that have been used by the researchers to evaluate the performance of their proposed intrusion detection and intrusion prevention approaches. Based on our study over eleven available datasets since 1998, many such datasets are out of date and unreliable to use. Some of these datasets suffer from lack of traffic diversity and volumes, some of them do not cover the variety of attacks, while others anonymized packet information and payload which cannot reflect the current trends, or they lack feature set and metadata. This paper produces a reliable dataset that contains benign and seven common attack network flows, which meets real world criteria and is publicly avaliable. Consequently, the paper evaluates the performance of a comprehensive set of network traffic features and machine learning algorithms to indicate the best set of features for detecting the certain attack categories.

Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization

Machine learning techniques are being widely used to develop an intrusion detection system (IDS) for detecting and classifying cyberattacks at the network-level and the host-level in a timely and automatic manner. However, many challenges arise since malicious attacks are continually changing and are occurring in very large volumes requiring a scalable solution. There are different malware datasets available publicly for further research by cyber security community. However, no existing study has shown the detailed analysis of the performance of various machine learning algorithms on various publicly available datasets. Due to the dynamic nature of malware with continuously changing attacking methods, the malware datasets available publicly are to be updated systematically and benchmarked. In this paper, a deep neural network (DNN), a type of deep learning model, is explored to develop a flexible and effective IDS to detect and classify unforeseen and unpredictable cyberattacks. The continuous change in network behavior and rapid evolution of attacks makes it necessary to evaluate various datasets which are generated over the years through static and dynamic approaches. This type of study facilitates to identify the best algorithm which can effectively work in detecting future cyberattacks. A comprehensive evaluation of experiments of DNNs and other classical machine learning classifiers are shown on various publicly available benchmark malware datasets. The optimal network parameters and network topologies for DNNs are chosen through the following hyperparameter selection methods with KDDCup 99 dataset. All the experiments of DNNs are run till 1,000 epochs with the learning rate varying in the range [0.01-0.5]. The DNN model which performed well on KDDCup 99 is applied on other datasets, such as NSL-KDD, UNSW-NB15, Kyoto, WSN-DS, and CICIDS 2017, to conduct the benchmark. Our DNN model learns the abstract and high-dimensional feature representation of the IDS data by passing them into many hidden layers. Through a rigorous experimental testing, it is confirmed that DNNs perform well in comparison with the classical machine learning classifiers. Finally, we propose a highly scalable and hybrid DNNs framework called scale-hybrid-IDS-AlertNet which can be used in real-time to effectively monitor the network traffic and host-level events to proactively alert possible cyberattacks.

/pdf/deep-learning-approach-for-intelligent-intrusion-detection-19gksnoeyl.pdf

Deep Learning Approach for Intelligent Intrusion Detection System

A Survey of Network-based Intrusion Detection Data Sets

In this paper, a new hybrid intrusion detection method that hierarchically integrates a misuse detection model and an anomaly detection model in a decomposition structure is proposed. First, a misuse detection model is built based on the C4.5 decision tree algorithm and then the normal training data is decomposed into smaller subsets using the model. Next, multiple one-class SVM models are created for the decomposed subsets. As a result, each anomaly detection model does not only use the known attack information indirectly, but also builds the profiles of normal behavior very precisely. The proposed hybrid intrusion detection method was evaluated by conducting experiments with the NSL-KDD data set, which is a modified version of well-known KDD Cup 99 data set. The experimental results demonstrate that the proposed method is better than the conventional methods in terms of the detection rate for both unknown and known attacks while it maintains a low false positive rate. In addition, the proposed method significantly reduces the high time complexity of the training and testing processes. Experimentally, the training and testing time of the anomaly detection model is shown to be only 50% and 60%, respectively, of the time required for the conventional models.

A novel hybrid intrusion detection method integrating anomaly detection with misuse detection

A communication device including: a communication unit; and a control unit controlling the communication unit to inquire if one upload service allows direct upload to a server storing service information of each of a plurality of upload services, to have the communication unit obtain desired information from the server for directly uploading data to the one upload service when the one upload service allows direct upload, and to have the communication unit directly upload data to the one upload service according to the desired information.

Communication device, server, program, and communication system

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it still suffers from detecting an unknown attack, i.e., 0-day attack, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack. Unlike the existing approaches that investigate raw traffic data, we introduced a feature extraction method in order to detect such an attack from IDS alerts [J. Song et al., 2007]. However, there is a problem that it can be only applied to limited IDS products. In this paper, we present a generalized version of the feature extraction method. To this end, we define new 7 features using only the basic 6 features of IDS alerts; detection time, source address and port, destination address and port, and signature name. In order to detect 0-day attack from IDS alerts with new 7 features, we apply an unsupervised learning technique, One-class SVM, to them. We evaluated our method over the log data of IDS that is deployed in Kyoto University, and our experimental results show that it has capability to detect not only a type of 0-day attack detected in our previous study, but also several different types of 0-day attack.

A Generalized Feature Extraction Scheme to Detect 0-Day Attacks via IDS Alerts

A system makes it possible to use services offered by a plurality of servers different from one another is realized with the use of a common API. The system includes a plurality of service-offering servers, a client that uses services offered by the plurality of service-offering servers, and an interchange server that performs intermediary processing when the client uses a service. The client performs communication with the interchange server while using a common API when using any service among a plurality of services offered by the plurality of service-offering servers. The interchange server uses a unique API, which is unique to the service-offering server that offers the service selected by the client, to execute a processing sequence that is unique to the service-offering server. The client may use any service among services offered by the plurality of service-offering servers with the use of a common API without any need to use a unique API, which is unique to each of the plurality of service-offering servers.

Client device and associated methodology of accessing networked services

Intrusion detection system (IDS) has played an important role as a device to defend our networks from cyber attacks. However, since it is unable to detect unknown attacks, i.e., 0-day attacks, the ultimate challenge in intrusion detection field is how we can exactly identify such an attack by an automated manner. Over the past few years, several studies on solving these problems have been made on anomaly detection using unsupervised learning techniques such as clustering, one-class support vector machine (SVM), etc. Although they enable one to construct intrusion detection models at low cost and effort, and have capability to detect unforeseen attacks, they still have mainly two problems in intrusion detection: a low detection rate and a high false positive rate. In this paper, we propose a new anomaly detection method based on clustering and multiple one-class SVM in order to improve the detection rate while maintaining a low false positive rate. We evaluated our method using KDD Cup 1999 data set. Evaluation results show that our approach outperforms the existing algorithms reported in the literature; especially in detection of unknown attacks.

Unsupervised Anomaly Detection Based on Clustering and Multiple One-Class SVM

A 2-month-old Japanese girl exhibited tonic seizure, agenesis of the corpus callosum, lacunar chorioretinopathy, vertebral anomalies, electroencephalographic abnormalities and a malignant tumor. Autopsy revealed a hepatoblastoma and severe brain malformations consisting of callosal agenesis, arhinencephaly, marked polymicrogyria and optic nerve anomalies. It was thought that the pathogenic factor in this case may exert its effect during the fourth or fifth week of intrauterine life, and then may continue until the beginning of neuronal migration (about 3 months). This is the first reported case of Aicardi syndrome associated with hepatoblastoma, and may provide a link between teratogenicity and oncogenicity.

Hiroki Takakura

Papers

Communication device, server, program, and communication system

A Generalized Feature Extraction Scheme to Detect 0-Day Attacks via IDS Alerts

Client device and associated methodology of accessing networked services

Unsupervised Anomaly Detection Based on Clustering and Multiple One-Class SVM

A rare case of aicardi syndrome with severe brain malformation and hepatoblastoma