Over the past decades, researchers have been proposing different Intrusion Detection approaches to deal with the increasing number and complexity of threats for computer systems. In this context, Random Forest models have been providing a notable performance on their applications in the realm of the behaviour-based Intrusion Detection Systems. Specificities of the Random Forest model are used to provide classification, feature selection, and proximity metrics. This work provides a comprehensive review of the general basic concepts related to Intrusion Detection Systems, including taxonomies, attacks, data collection, modelling, evaluation metrics, and commonly used methods. It also provides a survey of Random Forest based methods applied in this context, considering the particularities involved in these models. Finally, some open questions and challenges are posed combined with possible directions to deal with them, which may guide future works on the area.

No abstract

No abstract

In this paper, we propose to apply multipath routing in optical networks for the emerging high-performance applications with extremely high bandwidth requirements, typically larger than the capacity of one wavelength. To this end, we present a novel Multipath Lightpath Provisioning mechanism and derive an optimal solution by an ILP (Integer Linear Programming) approach, with differential delay and bandwidth as constraints to multipath finding. Our mechanism can set up multiple lightpaths over multiple fiber-level paths not only to satisfy the extremely high bandwidth requirements, but also to reduce the minimum bandwidth required for backup paths as it reduces the amount of traffic affected by single fiber breaks. For comparison, we also present an ILP-based Single Path Lightpath Provisioning mechanism and show that its multipath counterpart performs better independently of the mesh topology under study. The performance results demonstrate that the proposed multipath lightpath provisioning mechanism outperforms the traditional single path routing by decreased bandwidth request blocking ratio, while reducing the amount of traffic that may be affected by single link failures.

Intrusion detection systems have been playing an important role in defeating treats in the Cyberspace. In this context, researchers have been proposing anomaly-based methods for intrusion detection, on which the "normal" behavior is defined and the deviations (anomalies) are pointed out as intrusions. In this case, profiling is a relevant procedure used to establish a baseline for the normal behavior. In this work, an adaptive approach based on genetic algorithm is used to select features for profiling and parameters for anomaly-based intrusion detection methods. Additionally, two anomaly-based methods are introduced to be coupled with the proposed approach. One is based on basic statistics and the other is based on a projected clustering procedure. In the presented experiments performed on the CICIDS2017 dataset, our methods achieved results as good as detection rate equals to 92.85% and false positive rate of 0.69%. The presented approach iteratively adapts to new attacks and to the environmental requirements, such as security staff's preferences and available computational resources. KEYWORDSadaptive intrusion detection systems, anomaly-based intrusion detection, apache spark, machine learning, profiling, projected clustering 1 Security Privacy. 2018;1:e36.wileyonlinelibrary.com/journal/spy2