An analysis of Recurrent Neural Networks for Botnet detection behavior

Torres, Pablo; Catania, Carlos; García, Sebastián Rubio; Garino, Carlos García

doi:10.1109/argencon.2016.7585247

Cited by 144 publications

(77 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…IoT devices generate large amounts of sequential data from several sources, such as network traffic flows, which are among the key features for detecting several potential network attacks. For example, a previous study [197] discussed the feasibility of an RNN in examining network traffic behaviour to detect potential attacks (malicious behaviour) and confirmed the usefulness of the RNN in classifying network traffic for accurate malicious behaviour detection. Thus, RNNs provide a practical solution in realworld scenarios.…”

Section: Figure 8 Illustration Of Cnn Working Principle For Iot Securmentioning

confidence: 87%

“…A previous study [197] discussed the viability of an RNN (i.e. large short-term memory [LSTM] network) in the analysis of network traffic behaviour to detect potential attacks (malicious behaviour) and confirmed the effectiveness of the RNN in precisely classifying network traffic to detect malicious behaviour; thus, the LSTM network can be adopted as a practical solution in real-world scenarios.…”

Section: B Network Layermentioning

confidence: 99%

“…RNNs can classify network traffic with high accuracy in detecting malicious behaviour [197]. RNNs and their variants show considerable potential in improving IoT system security, specifically for time series-based threats.…”

Section: Rnnsmentioning

confidence: 99%

See 2 more Smart Citations

A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security

Al-Garadi

Mohamed

Al-Ali

et al. 2020

IEEE Commun. Surv. Tutorials

838

333

View full text Add to dashboard Cite

The Internet of Things (IoT) integrates billions of smart devices that can communicate with one another with minimal human intervention. It is one of the fastest developing fields in the history of computing, with an estimated 50 billion devices by the end of 2020. On the one hand, IoT technologies play a crucial role in enhancing several real-life smart applications that can improve life quality. On the other hand, the crosscutting nature of IoT systems and the multidisciplinary components involved in the deployment of such systems have introduced new security challenges. Implementing security measures, such as encryption, authentication, access control, network security and application security, for IoT devices and their inherent vulnerabilities is ineffective. Therefore, existing security methods should be enhanced to secure the IoT ecosystem effectively. Machine learning and deep learning (ML/DL) have advanced considerably over the last few years, and machine intelligence has transitioned from laboratory curiosity to practical machinery in several important applications. The ability to monitor IoT devices intelligently provides a significant solution to new or zero-day attacks. ML/DL are powerful methods of data exploration for learning about 'normal' and 'abnormal' behaviour according to how IoT components and devices perform within the IoT environment. Consequently, ML/DL methods are important in transforming the security of IoT systems from merely facilitating secure communication between devices to security-based intelligence systems. The goal of this work is to provide a comprehensive survey of ML methods and recent advances in DL methods that can be used to develop enhanced security methods for IoT systems.IoT security threats that are related to inherent or newly introduced threats are presented, and various potential IoT system attack surfaces and the possible threats related to each surface are discussed. We then thoroughly review ML/DL methods for IoT security and present the opportunities, advantages and shortcomings of each method. We discuss the opportunities and challenges involved in applying ML/DL to IoT security. These opportunities and challenges can serve as potential future research directions.

show abstract

Section: Figure 8 Illustration Of Cnn Working Principle For Iot Securmentioning

confidence: 87%

Section: B Network Layermentioning

confidence: 99%

See 1 more Smart Citation

A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security

Al-Garadi

Mohamed

Al-Ali

et al. 2020

IEEE Commun. Surv. Tutorials

838

333

View full text Add to dashboard Cite

show abstract

“…They design a parallel detection framework for identifying both client-server and hybrid botnets, and demonstrate encouraging performance. Torres et al investigate the common behavior patterns that botnets exhibit across their life cycle, using LSTMs [423]. They employ both under-sampling and over-sampling to address the class imbalance between botnet and normal traffic in the dataset, which is common in anomaly detection problems.…”

Section: Infrastructure Level Securitymentioning

confidence: 99%

Deep Learning in Mobile and Wireless Networking: A Survey

Zhang

Patras

Haddadi

2019

IEEE Commun. Surv. Tutorials

1,377

838

View full text Add to dashboard Cite

The rapid uptake of mobile devices and the rising popularity of mobile applications and services pose unprecedented demands on mobile and wireless networking infrastructure. Upcoming 5G systems are evolving to support exploding mobile traffic volumes, real-time extraction of fine-grained analytics, and agile management of network resources, so as to maximize user experience. Fulfilling these tasks is challenging, as mobile environments are increasingly complex, heterogeneous, and evolving. One potential solution is to resort to advanced machine learning techniques, in order to help manage the rise in data volumes and algorithm-driven applications. The recent success of deep learning underpins new and powerful tools that tackle problems in this space.In this paper we bridge the gap between deep learning and mobile and wireless networking research, by presenting a comprehensive survey of the crossovers between the two areas. We first briefly introduce essential background and state-of-theart in deep learning techniques with potential applications to networking. We then discuss several techniques and platforms that facilitate the efficient deployment of deep learning onto mobile systems. Subsequently, we provide an encyclopedic review of mobile and wireless networking research based on deep learning, which we categorize by different domains. Drawing from our experience, we discuss how to tailor deep learning to mobile environments. We complete this survey by pinpointing current challenges and open future directions for research.

show abstract

“…More recently, deep neural network models (also generally referred to as deep learning models) have been embraced by the research community to tackle anomaly detection problem in networking setting. Existing supervised deep learning approaches include work by Tang et al [20] that utilizes a classical deep neural network for flow-based anomalies classification in a Software Defined Networking (SDN) environment, and use of the recurrent neural network (RNN) models for developing intrusion detection solution [21].…”

Section: Related Workmentioning

confidence: 99%

GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection

Nguyen

Lim

Divakaran³

et al. 2019

2019 IEEE Conference on Communications and Network Security (CNS)

120

View full text Add to dashboard Cite

This paper looks into the problem of detecting network anomalies by analyzing NetFlow records. While many previous works have used statistical models and machine learning techniques in a supervised way, such solutions have the limitations that they require large amount of labeled data for training and are unlikely to detect zero-day attacks. Existing anomaly detection solutions also do not provide an easy way to explain or identify attacks in the anomalous traffic. To address these limitations, we develop and present GEE, a framework for detecting and explaining anomalies in network traffic. GEE comprises of two components: (i) Variational Autoencoder (VAE) -an unsupervised deep-learning technique for detecting anomalies, and (ii) a gradient-based fingerprinting technique for explaining anomalies. Evaluation of GEE on the recent UGR dataset demonstrates that our approach is effective in detecting different anomalies as well as identifying fingerprints that are good representations of these various attacks.

show abstract

An analysis of Recurrent Neural Networks for Botnet detection behavior

Cited by 144 publications

References 3 publications

A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security

A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security

Deep Learning in Mobile and Wireless Networking: A Survey

GEE: A Gradient-based Explainable Variational Autoencoder for Network Anomaly Detection

Contact Info

Product

Resources

About