The exponential growth in computer networks and network applications worldwide has been matched by a surge in cyberattacks. For this reason, datasets such as CSE-CIC-IDS2018 were created to train predictive models on network-based intrusion detection. These datasets are not meant to serve as repositories for signature-based detection systems, but rather to promote research on anomaly-based detection through various machine learning approaches. CSE-CIC-IDS2018 contains about 16,000,000 instances collected over the course of ten days. It is the most recent intrusion detection dataset that is big data, publicly available, and covers a wide range of attack types. This multi-class dataset has a class imbalance, with roughly 17% of the instances comprising attack (anomalous) traffic. Our survey work contributes several key findings. We determined that the best performance scores for each study, where available, were unexpectedly high overall, which may be due to overfitting. We also found that most of the works did not address class imbalance, the effects of which can bias results in a big data study. Lastly, we discovered that information on the data cleaning of CSE-CIC-IDS2018 was inadequate across the board, a finding that may indicate problems with reproducibility of experiments. In our survey, major research gaps have also been identified.

/pdf/a-survey-and-analysis-of-intrusion-detection-models-based-on-3w25rhafui.pdf

A survey and analysis of intrusion detection models based on CSE-CIC-IDS2018 Big Data

The hybrid technique for DDoS detection with supervised learning algorithms

The goal of securing a network is to protect the information flowing through the network and to ensure the security of intellectual as well as sensitive data for the underlying application. To accomplish this goal, security mechanism such as Intrusion Detection System (IDS) is used, that analyzes the network traffic and extract useful information for inspection. It identifies various patterns and signatures from the data and use them as features for attack detection and classification. Various Machine Learning (ML) techniques are used to design IDS for attack detection and classification. All the features captured from the network packets do not contribute in detecting or classifying attack. Therefore, the objective of our research work is to study the effect of various feature selection techniques on the performance of IDS. Feature selection techniques select relevant features and group them into subsets. This paper implements Chi-Square, Information Gain (IG), and Recursive Feature Elimination (RFE) feature selection techniques with ML classifiers namely Support Vector Machine, Naive Bayes, Decision Tree Classifier, Random Forest Classifier, k-nearest neighbours, Logistic Regression, and Artificial Neural Networks. The methods are experimented on NSL-KDD dataset and comparative analysis of results is presented.

Attack classification using feature selection techniques: a comparative study

The problem of identifying Distributed Denial of Service (DDos) attacks is fundamentally a classification problem in machine learning. In relevance to Cloud Computing, the task of identification of DDoS attacks is a significantly challenging problem because of computational complexity that has to be addressed. Fundamentally, a Denial of Service (DoS) attack is an intentional attack attempted by attackers from single source which has an implicit intention of making an application unavailable to the target stakeholder. For this to be achieved, attackers usually stagger the network bandwidth, halting system resources, thus causing denial of access for legitimate users. Contrary to DoS attacks, in DDoS attacks, the attacker makes use of multiple sources to initiate an attack. DDoS attacks are most common at network, transportation, presentation and application layers of a seven-layer OSI model. In this paper, the research objective is to study the problem of DDoS attack detection in a Cloud environment by considering the most popular CICIDS 2017 benchmark dataset and applying multiple regression analysis for building a machine learning model to predict DDoS and Bot attacks through considering a Friday afternoon traffic logfile.

A Machine Learning Approach for DDoS (Distributed Denial of Service) Attack Detection Using Multiple Linear Regression

DDoS (Distributed Denial of Service) attacks have become a pressing threat to the security and integrity of computer networks and information systems, which are indispensable infrastructures of modern times. The detection of DDoS attacks is a challenging issue before any mitigation measures can be taken. ML/DL (Machine Learning/Deep Learning) has been applied to the detection of DDoS attacks with satisfactory achievement. However, full-scale success is still beyond reach due to an inherent problem with ML/DL-based systems—the so-called Open Set Recognition (OSR) problem. This is a problem where an ML/DL-based system fails to deal with new instances not drawn from the distribution model of the training data. This problem is particularly profound in detecting DDoS attacks since DDoS attacks’ technology keeps evolving and has changing traffic characteristics. This study investigates the impact of the OSR problem on the detection of DDoS attacks. In response to this problem, we propose a new DDoS detection framework featuring Bi-Directional Long Short-Term Memory (BI-LSTM), a Gaussian Mixture Model (GMM), and incremental learning. Unknown traffic captured by the GMM are subject to discrimination and labeling by traffic engineers, and then fed back to the framework as additional training samples. Using the data sets CIC-IDS2017 and CIC-DDoS2019 for training, testing, and evaluation, experiment results show that the proposed BI-LSTM-GMM can achieve recall, precision, and accuracy up to 94%. Experiments reveal that the proposed framework can be a promising solution to the detection of unknown DDoS attacks.

Detection of Unknown DDoS Attacks with Deep Learning and Gaussian Mixture Model

Di s tributed Denial of Service (DDoS) is a type of attack using the volume, intensity, and m ore costs m itigation to increase in this era . A ttack ers used many zombie computers to exhaust the resources available to a network, application or service so that authorize users cannot gain access or the network service is down, and it is a great loss for Internet users in computer networks affected by DDoS attacks. In the Network Forensic, a crime that occurs in the system network services can be sued in the court and the attackers will be punished in accordance with law. This research has the goal to develop a new approach to detect DDoS attacks based on network traffic activity were statistically analyzed using Naive Bayes method. Data were taken from the training and testing of network traffic in a core router in Master of Information Technology Research Laboratory University of Ahmad Dahlan Yogyakarta. The new approach in detecting DDoS attacks is expected to be a relation with Intrusion Detection System (IDS) to predict the existence of DDoS attacks.

http://journal.portalgaruda.org/index.php/EEI/article/download/605/914

Review of Detection DDOS Attack Detection Using Naive Bayes Classifier for Network Forensics

Cyber attacks by sending large data packets that deplete computer network service resources by using multiple computers when attacking are called Distributed Denial of Service (DDoS) attacks. Total Data Packet and important information in the form of log files sent by the attacker can be observed and captured through the port mirroring of the computer network service. The classification system is required to distinguish network traffic into two conditions, first normal condition, and second attack condition. The Gaussian Naive Bayes classification is one of the methods that can be used to process numeric attribute as input and determine two decisions of access that occur on the computer network service that is “normal” access or access under “attack” by DDoS as output. This research was conducted in Ahmad Dahlan University Networking Laboratory (ADUNL) for 60 minutes with the result of classification of 8 IP Address with normal access and 6 IP Address with DDoS attack access.

/pdf/ddos-attacks-classification-using-numeric-attribute-based-2gyvgsss7c.pdf

DDoS Attacks Classification using Numeric Attribute-based Gaussian Naive Bayes

Ilmu pengetahuan tentang keamanan komputer yang terkait dengan penyelidikan untuk menentukan sumber serangan jaringan berdasarkan data log bukti, identifikasi, analisis, dan rekonstruksi kejadian adalah Forensik Jaringan yang merupakan cabang dari Forensik Digital. Sedangkan jenis serangan terhadap suatu komputer atau server di dalam jaringan dengan cara menghabiskan sumber daya (resources) yang dimiliki oleh komputer sampai komputer tersebut tidak dapat menjalankan fungsinya dengan benar, sehingga secara tidak langsung mencegah pengguna lain untuk memperoleh akses dari layanan jaringan yang diserang disebut dengan serangan Distributed Denial of Service (DDoS). Riset Forensik Jaringan dilakukan dalam Laboratorium Riset Magister Teknik Informatika Universitas Ahmad Dahlan Yogyakarta. Deteksi serangan dilakukan oleh Winbox RouterOS v3,7 dimana software tersebut menunjukan resources, data penyerang (IP Address), jumlah paket data, dan kapan terjadi serangan. Sedangkan simulasi serangan dilakukan dengan software LOIC untuk mengetahui kinerja sistem pengaman jaringan komputer. Sedangkan sistem pengaman jaringan komputer berupa antisipasi terhadap bentuk serangan DDoS.

/pdf/pengembangan-sistem-pengaman-jaringan-komputer-berdasarkan-30gyq2t9w0.pdf

Pengembangan Sistem Pengaman Jaringan Komputer Berdasarkan Analisis Forensik Jaringan

On-device Resilient Android Malware Detection using Incremental Learning

As technology is increasingly advanced and developing, shopping that was originally done in supermarkets is now done online. The COVID pandemic has also made people switch to shopping online, as in e-commerce. Research also shows that e-commerce in Indonesia has increased by 5–10 times during the pandemic. Ecommerce has always been associated with simple and convenient purchasing and payment methods. Ijabqabul.id is an e- commerce platform that provides a variety of product categories. In order to improve services for the development of ijabqabul.id e-commerce, particularly in terms of payment transactions, a payment gateway system as an online payment system is required. This research will result in a web service-based payment gateway system with JSON output. A payment gateway system is built using the Python programming language and the Flask framework. The Postman application is used to test a payment gateway system that is based on web services. Agile Development is the method used in the development of the payment gateway system. This method is carried out through brainstorming with researchers from the sharia study program. The developed payment gateway system generates a virtual account number, making the transaction process simpler, safer, and more convenient

Sukma Aji

Papers

Review of Detection DDOS Attack Detection Using Naive Bayes Classifier for Network Forensics

DDoS Attacks Classification using Numeric Attribute-based Gaussian Naive Bayes

Pengembangan Sistem Pengaman Jaringan Komputer Berdasarkan Analisis Forensik Jaringan

On-device Resilient Android Malware Detection using Incremental Learning

Design and Build Payment Gateways in Sharia-Based E-Commerce (Case Study: Murabahah Ijabqabul.Id Contract)