In this article, a Host-Based Intrusion Detection System (HIDS) using a Modified Vector Space Representation (MVSR) N-gram and Multilayer Perceptron (MLP) model for securing the Internet of Things (IoT), based on lightweight techniques and using Fog Computing devices, is proposed. The Australian Defence Force Academy Linux Dataset (ADFA-LD), which contains exploits and attacks on various applications, is employed for the analysis. The proposed method is divided into the feature extraction stage, the feature selection stage, and classification modeling. To maintain the lightweight criteria, the feature extraction stage considers a combination of 1-gram and 2-gram for the system call encoding. In addition, a Sparse Matrix is used to reduce the space by keeping only the weight of the features that appear in the trace, thus ignoring the zero weights. Subsequently, Linear Correlation Coefficient (LCC) is utilized to compensate for any missing N-gram in the test data. In the feature selection stage, the Mutual Information (MI) method and Principle Component Analysis (PCA) are utilized and then compared to reduce the number of input features. Following the feature selection stage, the modeling and performance evaluation of various Machine Learning classifiers are conducted using a Raspberry Pi IoT device. Further analysis of the effect of MLP parameters, such as the number of nodes, number of features, activation, solver, and regularization parameters, is also conducted. From the simulation, it can be seen that different parameters affect the accuracy and lightweight evaluation. By using a single hidden layer and four nodes, the proposed method with MI can achieve 96% accuracy, 97% recall, 96% F1-Measure, 5% False Positive Rate (FPR), highest curve of Receiver Operating Characteristic (ROC), and 96% Area Under the Curve (AUC). It also achieved low CPU time usage of 4.404 (ms) milliseconds and low energy consumption of 8.809 (mj) millijoules.

Classifier Performance Evaluation for Lightweight IDS Using Fog Computing in IoT Security

The article considers the concept and features of Big Data management systems and their differences from traditional DBMS’s. The authors describe changes in the intruder model and new vulnerabilities in data management systems. A new threat model is developed. The article presents new problems of information security in a distributed Big Data processing and storage system.

Big Data Management System Security Threat Model

In order to provide an accurate and timely response to different types of the attacks, intrusion and anomaly detection systems collect and analyze a lot of data that may include personal and other sensitive data. These systems could be considered a source of privacy-aware risks. Application of the federated learning paradigm for training attack and anomaly detection models may significantly decrease such risks as the data generated locally are not transferred to any party, and training is performed mainly locally on data sources. Another benefit of the usage of federated learning for intrusion detection is its ability to support collaboration between entities that could not share their dataset for confidential or other reasons. While this approach is able to overcome the aforementioned challenges it is rather new and not well-researched. The challenges and research questions appear while using it to implement analytical systems. In this paper, the authors review existing solutions for intrusion and anomaly detection based on the federated learning, and study their advantages as well as open challenges still facing them. The paper analyzes the architecture of the proposed intrusion detection systems and the approaches used to model data partition across the clients. The paper ends with discussion and formulation of the open challenges.

/pdf/comparative-review-of-the-intrusion-detection-systems-based-2s0jmc2l.pdf

Comparative Review of the Intrusion Detection Systems Based on Federated Learning: Advantages and Open Challenges

One of the reasons for the implementation of information security threats in organizations is the insider activity of its employees. There is a big challenge to detect stego-insiders-employees who create stego-channels to secretly receive malicious information and transfer confidential information across the organization’s perimeter. Especially presently, with great popularity of wireless sensor networks (WSNs) and Internet of Things (IoT) devices, there is a big variety of information that could be gathered and processed by stego-insiders. Consequently, the problem arises of identifying such intruders and their transmission channels. The paper proposes an approach to solving this problem. The paper provides a review of the related works in terms of insider models and methods of their identification, including techniques for handling insider attacks in WSN, as well methods of embedding and detection of stego-embeddings. This allows singling out the basic features of stego-insiders, which could be determined by their behavior in the network. In the interests of storing these attributes of user behavior, as well as storing such attributes from large-scale WSN, a hybrid NoSQL database is created based on graph and document-oriented approaches. The algorithms for determining each of the features using the NoSQL database are specified. The general scheme of stego-insider detection is also provided. To confirm the efficiency of the approach, an experiment was carried out on a real network. During the experiment, a database of user behavior was collected. Then, user behavior features were retrieved from the database using special SQL queries. The analysis of the results of SQL queries is carried out, and their applicability for determining the attribute is justified. Weak points of the approach and ways to improve them are indicated.

An Approach for Stego-Insider Detection Based on a Hybrid NoSQL Database

This article considers the solution to the problem of building secure Big Data management systems using a consistent approach. The concept and features of Big Data management systems and their differences from traditional DBMS’s are presented. The principles of a new, consistent approach to building secure Big Data management systems are given and substantiated. The security subsystem architecture is proposed.

A Consistent Approach to Building Secure Big Data Processing and Storage Systems

The protection of modern distributed information networks from external and internal intruders continues to be of great importance due to the development of data transmission and processing technology. The article describes a model of data processing in the distributed intrusion detection system (DIDS) and method of using of hidden agents to protect from an internal intruder. The distribution of the functions on data processing between the DIDS local agent and central data processing node is presented. We describe a method of hiding of presence of the agent from the system user while retaining control of it from the part of the operator.

A Distributed Intrusion Detection System with Protection from an Internal Intruder

Relevance. It is known that the method of electroretinography (hereinafter – ERG) in ophthalmology, which works on the key registration of changes in the bioelectric potential of the retina, uses the potential of exposure to light passing through the optical media of the eye. A similar method is conditionally applicable to the transmission of a light pulse over a fiber-optic cable, during which the correct transmission of information is carried out. If there is a violation or change in the electrical potential, there is every reason to believe that a person has any diseases. Purpose. To develop a technology for creating intellectual information security systems (IISS) is of a complex nature in which a quasi-biological paradigm is put in the first place, where the form of programming information processes, machine learning systems (MLS) and the construction of neural systems and ending with an AI architecture with built – in mechanisms for ensuring information security. Material and methods. In this article, a methodology for using a new artificial intelligence system (hereinafter referred to as AI) in a protected version for working with corrective devices for electroretinography in ophthalmology is compiled. Results. A set of methodological and scientific and technical solutions for the artificial intelligence system has been developed in order to ensure its «viability» and resistance to computer attacks aimed at violating the integrity. Conclusion. The article raises a key issue – the need to develop software architectural solutions for AI and adaptive neuro-fuzzy AI, which have «neurons» built into the software and hardware information protection systems with a universal set of commands for EG devices. Keywords: artificial intelligence, multi-agent system, electroretinography, neural network, integrity control, information security

S. I. Shterenberg

Papers

A Distributed Intrusion Detection System with Protection from an Internal Intruder

Methodology for building secure artificial intelligence systems for electroretinography in ophthalmology