A robust intelligent zero-day cyber-attack detection technique

Abstract

With the introduction of the Internet to the mainstream like e-commerce, online banking, health system and other day-to-day essentials, risk of being exposed to various are increasing exponentially. Zero-day attack(s) targeting unknown vulnerabilities of a software or system opens up further research direction in the field of cyber-attacks. Existing approaches either uses ML/DNN or anomaly-based approach to protect against these attacks. Detecting zero-day attacks through these techniques miss several parameters like frequency of particular byte streams in network traffic and their correlation. Covering attacks that produce lower traffic is difficult through neural network models because it requires higher traffic for correct prediction. This paper proposes a novel robust and intelligent cyber-attack detection model to cover the issues mentioned above using the concept of heavy-hitter and graph technique to detect zero-day attacks. The proposed work consists of two phases (a) Signature generation and (b) Evaluation phase. This model evaluates the performance using generated signatures at the training phase. The result analysis of the proposed zero-day attack detection shows higher performance for accuracy of 91.33% for the binary classification and accuracy of 90.35% for multi-class classification on real-time attack data. The performance against benchmark data set CICIDS18 shows a promising result of 91.62% for binary-class classification on this model. Thus, the proposed approach shows an encouraging result to detect zero-day attacks.

Zero-Day Malware Detection and Effective Malware Analysis Using Shapley Ensemble Boosting and Bagging Approach

“…A zero-day attack refers to a new network signature for Denial of Service (DOS) or Distributed Denial of Service (DDOS). Kumar et al [ 26 ] stated that zero-day attacks are a comparison between genuine network data to find heavy hitters in attack data. A heavy hitter is to find a new signature responsible for DOS or DDOS in network traffic data.…”

Soteria: An Approach for Detecting Multi-Institution Attacks

“…that security systems have no awareness of existing. The current approach [24,6,12] for detecting these attacks requires consistently analyzing incoming traffic using a plethora of models and artificial intelligence techniques that are designed to detect any anomalies or suspicious activity not present in any up-to-date attack-signature databases.…”

“…Kumar et al [24] proposes a framework to detect unknown cyber-attacks by introducing a robust intelligent, novel approach following a multi-phase approach to distinguish attacks of both high volumes (HVA), e.g. DoS and DDos, and low volumes (LVA), e.g.…”

Cyber security: performance analysis and challenges for cyber attacks detection

“…In 2021 Kumar and Sinha [104], suggested a novel robust intelligent cyber-attack detection method. The ML and DNN approach are used to defend against anomaly attacks, which are zero-day attacks that target unknown vulnerabilities in systems.…”