With the development of the Internet, cyber-attacks are changing rapidly and the cyber security situation is not optimistic. This survey report describes key literature surveys on machine learning (ML) and deep learning (DL) methods for network analysis of intrusion detection and provides a brief tutorial description of each ML/DL method. Papers representing each method were indexed, read, and summarized based on their temporal or thermal correlations. Because data are so important in ML/DL methods, we describe some of the commonly used network datasets used in ML/DL, discuss the challenges of using ML/DL for cybersecurity and provide suggestions for research directions.

Machine Learning and Deep Learning Methods for Cybersecurity

The future Internet of Things (IoT) will have a deep economical, commercial and social impact on our lives. The participating nodes in IoT networks are usually resource-constrained, which makes them luring targets for cyber attacks. In this regard, extensive efforts have been made to address the security and privacy issues in IoT networks primarily through traditional cryptographic approaches. However, the unique characteristics of IoT nodes render the existing solutions insufficient to encompass the entire security spectrum of the IoT networks. Machine Learning (ML) and Deep Learning (DL) techniques, which are able to provide embedded intelligence in the IoT devices and networks, can be leveraged to cope with different security problems. In this paper, we systematically review the security requirements, attack vectors, and the current security solutions for the IoT networks. We then shed light on the gaps in these security solutions that call for ML and DL approaches. Finally, we discuss in detail the existing ML and DL solutions for addressing different security problems in IoT networks. We also discuss several future research directions for ML- and DL-based IoT security.

Machine Learning in IoT Security: Current Solutions and Future Challenges

We propose two systematic methods to describe the differential property of an S-box with linear inequalities based on logical condition modelling and computational geometry respectively. In one method, inequalities are generated according to some conditional differential properties of the S-box; in the other method, inequalities are extracted from the H-representation of the convex hull of all possible differential patterns of the S-box. For the second method, we develop a greedy algorithm for selecting a given number of inequalities from the convex hull. Using these inequalities combined with Mixed-integer Linear Programming (MILP) technique, we propose an automatic method for evaluating the security of bit-oriented block ciphers against the (related-key) differential attack with several techniques for obtaining tighter security bounds, and a new tool for finding (related-key) differential characteristics automatically for bit-oriented block ciphers.

/pdf/automatic-security-evaluation-and-related-key-differential-5erle8kbwv.pdf

Automatic Security Evaluation and (Related-key) Differential Characteristic Search: Application to SIMON, PRESENT, LBlock, DES(L) and Other Bit-Oriented Block Ciphers

In a computing context, cybersecurity is undergoing massive shifts in technology and its operations in recent days, and data science is driving the change. Extracting security incident patterns or insights from cybersecurity data and building corresponding data-driven model, is the key to make a security system automated and intelligent. To understand and analyze the actual phenomena with data, various scientific methods, machine learning techniques, processes, and systems are used, which is commonly known as data science. In this paper, we focus and briefly discuss on cybersecurity data science, where the data is being gathered from relevant cybersecurity sources, and the analytics complement the latest data-driven patterns for providing more effective security solutions. The concept of cybersecurity data science allows making the computing process more actionable and intelligent as compared to traditional ones in the domain of cybersecurity. We then discuss and summarize a number of associated research issues and future directions. Furthermore, we provide a machine learning based multi-layered framework for the purpose of cybersecurity modeling. Overall, our goal is not only to discuss cybersecurity data science and relevant methods but also to focus the applicability towards data-driven intelligent decision making for protecting the systems from cyber-attacks.

/pdf/cybersecurity-data-science-an-overview-from-machine-learning-2g5zdq7ti3.pdf

Cybersecurity data science: an overview from machine learning perspective

Data preprocessing is widely recognized as an important stage in anomaly detection. This paper reviews the data preprocessing techniques used by anomaly-based network intrusion detection systems (NIDS), concentrating on which aspects of the network traffic are analyzed, and what feature construction and selection methods have been used. Motivation for the paper comes from the large impact data preprocessing has on the accuracy and capability of anomaly-based NIDS. The review finds that many NIDS limit their view of network traffic to the TCP/IP packet headers. Time-based statistics can be derived from these headers to detect network scans, network worm behavior, and denial of service attacks. A number of other NIDS perform deeper inspection of request packets to detect attacks against network services and network applications. More recent approaches analyze full service responses to detect attacks targeting clients. The review covers a wide range of NIDS, highlighting which classes of attack are detectable by each of these approaches.

Data preprocessing is found to predominantly rely on expert domain knowledge for identifying the most relevant parts of network traffic and for constructing the initial candidate set of traffic features. On the other hand, automated methods have been widely used for feature extraction to reduce data dimensionality, and feature selection to find the most relevant subset of features from this candidate set. The review shows a trend toward deeper packet inspection to construct more relevant features through targeted content parsing. These context sensitive features are required to detect current attacks.

Data preprocessing for anomaly based network intrusion detection : a review

This textbook teaches VHDL using system examples combined with programmable logic and supported by laboratory exercises. While other textbooks concentrate only on language features, Circuit Design with VHDL offers a fully integrated presentation of VHDL and design concepts by including a large number of complete design examples, illustrative circuit diagrams, a review of fundamental design concepts, fully explained solutions, and simulation results. The text presents the information concisely yet completely, discussing in detail all indispensable features of the VHDL synthesis. The book is organized in a clear progression, with the first part covering the circuit level, treating foundations of VHDL and fundamental coding, and the second part covering the system level (units that might be located in a library for code sharing, reuse, and partitioning), expanding upon the earlier chapters to discuss system coding. Part I, "Circuit Design," examines in detail the background and coding techniques of VHDL, including code structure, data types, operators and attributes, concurrent and sequential statements and code, objects (signals, variables, and constants), design of finite state machines, and examples of additional circuit designs. Part II, "System Design," builds on the material already presented, adding elements intended mainly for library allocation; it examines packages and components, functions and procedures, and additional examples of system design. Appendixes on programmable logic devices (PLDs/FPGAs) and synthesis tools follow Part II. The book's highly original approach of teaching through extensive system examples as well as its unique integration of VHDL and design make it suitable both for use by students in computer science and electrical engineering.

Circuit Design with VHDL

Nowadays, a significant part of all network accesses comes from embedded and battery-powered devices, which must be energy efficient. This paper demonstrates that a hardware (HW) implementation of network security algorithms can significantly reduce their energy consumption compared to an equivalent software (SW) version. The paper has four main contributions: (i) a new feature extraction algorithm, with low processing demands and suitable for hardware implementation; (ii) a feature selection method with two objectives—accuracy and energy consumption; (iii) detailed energy measurements of the feature extraction engine and three machine learning (ML) classifiers implemented in SW and HW—Decision Tree (DT), Naive-Bayes (NB), and k-Nearest Neighbors (kNN); and (iv) a detailed analysis of the tradeoffs in implementing the feature extractor and ML classifiers in SW and HW. The new feature extractor demands significantly less computational power, memory, and energy. Its SW implementation consumes only 22 percent of the energy used by a commercial product and its HW implementation only 12 percent. The dual-objective feature selection enabled an energy saving of up to 93 percent. Comparing the most energy-efficient SW implementation (new extractor and DT classifier) with an equivalent HW implementation, the HW version consumes only 5.7 percent of the energy used by the SW version.

Towards an Energy-Efficient Anomaly-Based Intrusion Detection Engine for Embedded Systems

Gates with input hysteresis are often necessary in circuits operating in noisy environments. Described is a very simple CMOS Schmitt trigger circuit, well suited for low-voltage and high-speed applications. The circuit also allows the construction of a very compact window comparator.

Low-voltage high-speed Schmitt trigger and compact window comparator

We present a parallel analog vector quantizer (VQ) in 2.0-/spl mu/m double-poly CMOS technology and analyze its energetic efficiency. The prototype chip contains an array of 16/spl times/16 charge-based distance estimation cells, implementing a 16 analog input, 4-b coded output VQ with a mean absolute difference (MAD) distance metric. The distance cell including dynamic template storage measures 60/spl times/78 /spl mu/m/sup 2/. The output code is produced by a 16-cell winner-take-all (WTA) output circuit of linear complexity which selects the winning template with constant power-decay product, independent of input levels and scale. Experimental results demonstrate 34 dB analog input dynamic range and 0.7 mW power dissipation at 3 /spl mu/s cycle.

/pdf/a-low-power-cmos-analog-vector-quantizer-27dkzb28fg.pdf

A low-power CMOS analog vector quantizer

This text offers a comprehensive treatment of VHDL and its applications to the design and simulation of real, industry-standard circuits. It focuses on the use of VHDL rather than solely on the language, showing why and how certain types of circuits are inferred from the language constructs and how any of the four simulation categories can be implemented. It makes a rigorous distinction between VHDL for synthesis and VHDL for simulation. The VHDL codes in all design examples are complete, and circuit diagrams, physical synthesis in FPGAs, simulation results, and explanatory comments are included with the designs. The text reviews fundamental concepts of digital electronics and design and includes a series of appendixes that offer tutorials on important design tools including ISE, Quartus II, and ModelSim, as well as descriptions of programmable logic devices in which the designs are implemented, the DE2 development board, standard VHDL packages, and other features. All four VHDL editions (1987, 1993, 2002, and 2008) are covered. This expanded second edition is the first textbook on VHDL to include a detailed analysis of circuit simulation with VHDL testbenches in all four categories (nonautomated, fully automated, functional, and timing simulations), accompanied by complete practical examples. Chapters 1--9 have been updated, with new design examples and new details on such topics as data types and code statements. Chapter 10 is entirely new and deals exclusively with simulation. Chapters 11--17 are also entirely new, presenting extended and advanced designs with theoretical and practical coverage of serial data communications circuits, video circuits, and other topics. There are many more illustrations, and the exercises have been updated and their number more than doubled.

Volnei A. Pedroni

Papers

Circuit Design with VHDL

Towards an Energy-Efficient Anomaly-Based Intrusion Detection Engine for Embedded Systems

Low-voltage high-speed Schmitt trigger and compact window comparator

A low-power CMOS analog vector quantizer

Circuit Design and Simulation with VHDL