<p>With the expanded applications of modern-day networking, network infrastructures are at risk from cyber attacks and intrusions. Multiple datasets have been proposed in literature that can be used to create Machine Learning (ML) based Network Intrusion Detection Systems (NIDS). However, many of these datasets suffer from sub-optimal performance and do not adequately represent all types of intrusions in an effective manner. Another problem with these datasets is the low accuracy of tail classes. To address these issues, in this paper, we propose the University of Nevada - Reno Intrusion Detection Dataset (UNR-IDD) that provides researchers with a wider range of samples and scenarios. The proposed dataset utilizes network port statistics for more fine-grained control and analysis of intrusions. We provide a benchmark to show efficient performance for both binary and multi-class classification tasks using different ML algorithms. The paper further explains the intrusion detection activities rather than providing a generic black-box output of the ML algorithms. In comparison with the other established NIDS datasets, we obtain better performance with an Fµ score of 94% and a minimum F score of 86%. This performance can be credited to prioritizing high scoring average and minimum F-Measure scores for modeled intrusions.</p>

No abstract

No abstract

<div>With the expanded applications of modern-day networking, network infrastructures are at risk from cyber attacks and intrusions. Multiple datasets have been proposed in literature that can be used to create Machine Learning (ML) based Network Intrusion Detection Systems (NIDS). However, many of these datasets suffer from sub-optimal performance and do not adequately represent all types of intrusions in an effective manner. Another problem with these datasets is the low accuracy of tail classes. To address these issues, in this paper, we propose the University of Nevada - Reno Intrusion Detection Dataset (UNR-IDD) that provides researchers with a wider range of samples and scenarios. The proposed dataset utilizes network port statistics for more fine-grained control and analysis of intrusions. We provide a benchmark to show efficient performance for both binary and multi-class classification tasks using different ML algorithms. The paper further explains the intrusion detection activities rather than providing a generic black-box output of the ML algorithms. In comparison with the other established NIDS datasets, we obtain better performance with an Fµ score of 96% and a minimum F score of 93%. This performance can be credited to prioritizing high scoring average and minimum F-Measure scores for modeled intrusions.</div>

In recent years, integrated circuits (ICs) have become<br>significant for various industries and their security has<br>been given greater priority, specifically in the supply chain.<br>Budgetary constraints have compelled IC designers to offshore manufacturing to third-party companies. When the designer gets the manufactured ICs back, it is imperative to test for potential threats like hardware trojans (HT). In this paper, a novel multilevel game-theoretic framework is introduced to analyze the interactions between a malicious IC manufacturer and the tester. In particular, the game is formulated as a non-cooperative, zerosum, repeated game using prospect theory (PT) that captures different players’ rationalities under uncertainty. The repeated game is separated into a learning stage, in which the defender<br><div>learns about the attacker’s tendencies, and an actual game stage, where this learning is used. Experiments show great incentive for the attacker to deceive the defender about their actual rationality by “playing dumb” in the learning stage (deception). This scenario is captured using hypergame theory to model the attacker’s view of the game. The optimal deception rationality of the attacker is analytically derived to maximize utility gain. For the defender, a first-step deception mitigation process is proposed to thwart the effects of deception. Simulation results show that the attacker can profit from the deception as it can successfully insert HTs in the manufactured ICs without being detected.</div><div><br></div><div>This paper has been accepted for publication in <b>IEEE Cyber Science Conference 2020</b><br></div>