Anomaly Detection of Cyber Physical Network Data Using 2D Images

Moore, Michael R.; Vann, Jason M.

doi:10.1109/icce.2019.8662084

Cited by 13 publications

(5 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Similar to [165] in image feature-based methods, Moore et al [178] also proposed an intrusion detection system for cyberphysical systems, that maps the controller area network (CAN) data to 2D images. The method extracts network features (e.g.…”

Section: Neural Network-based Methodsmentioning

confidence: 99%

A Review of Computer Vision Methods in Network Security

Zhao

Masood

Seneviratne

2021

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

Network security has become an area of significant importance more than ever as highlighted by the eye-opening numbers of data breaches, attacks on critical infrastructure, and malware/ransomware/cryptojacker attacks that are reported almost every day. Increasingly, we are relying on networked infrastructure and with the advent of IoT, billions of devices will be connected to the internet, providing attackers with more opportunities to exploit. Traditional machine learning methods have been frequently used in the context of network security. However, such methods are more based on statistical features extracted from sources such as binaries, emails, and packet flows.On the other hand, recent years witnessed a phenomenal growth in computer vision mainly driven by the advances in the area of convolutional neural networks. At a glance, it is not trivial to see how computer vision methods are related to network security. Nonetheless, there is a significant amount of work that highlighted how methods from computer vision can be applied in network security for detecting attacks or building security solutions. In this paper, we provide a comprehensive survey of such work under three topics; i) phishing attempt detection, ii) malware detection, and iii) traffic anomaly detection. Next, we review a set of such commercial products for which public information is available and explore how computer vision methods are effectively used in those products. Finally, we discuss existing research gaps and future research directions, especially focusing on how network security research community and the industry can leverage the exponential growth of computer vision methods to build much secure networked systems.

show abstract

Section: Neural Network-based Methodsmentioning

confidence: 99%

A Review of Computer Vision Methods in Network Security

Zhao

Masood

Seneviratne

2021

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

show abstract

“…Image Conversion: In [16], the authors convert the feature extracted from the physical layer signal of the CAN bus into an image. A convolutional neural network (CNN) model is built for the feature image.…”

Section: Dnn-enabled Ivn Intrusion Detectionmentioning

confidence: 99%

“…. , T s is the trajectory of actor i running policy π θ k in the environment for T s timesteps, where the reward r t collected for choosing action a t providing state s t is determined by (16). Γ k is the set of trajectories.…”

mentioning

confidence: 99%

Federated AI-Enabled In-Vehicle Network Intrusion Detection for Internet of Vehicles

Yang

2022

Electronics

View full text Add to dashboard Cite

The integration of artificial intelligence (AI) technology into the Internet of Vehicles (IoV) has provided smart services for intelligent connected vehicles (ICVs). However, due to gradually upgrading to ICVs, an increasing number of external communications interfaces exposes the in-vehicle networks (IVNs) to malicious network intrusion. The malicious intruders can take over the compromised ICVs and mediately intrude into the ICVs connected through IoV. Therefore, it is urgent to develop IVN intrusion detection methods for IoV security protection. In this paper, a ConvLSTM-based IVN intrusion detection method is developed by leveraging the periodicity of the network message ID. For training the ConvLSTM model, a federated learning (FL) framework with client selection is proposed. The fundamental FL framework works in the client-server mode. ICVs are the local clients, and mobile edge computing (MEC) servers connected to base stations (BSs) function as the parameter servers. Based on the framework, a proximal policy optimization (PPO)-based federated client selection (FCS) scheme is further developed to optimize the model accuracy and system overhead of federated ConvLSTM model training. Simulations are conducted by the exploitation of real-world IoV scenario settings and IVN datasets. The results indicate that by exploiting the ConvLSTM, the model size and convergence time are dramatically reduced, and the 95%-beyond detection accuracy is maintained. The results also unveil that the PPO-based FCS scheme outperforms the benchmarks on the convergence rate, model accuracy, and system overhead.

show abstract

“…[514] proposed a NN architecture for ID. In [517], the authors have proposed a CNN based IDS where the controller area network (CAN) data is preprocessed and mapped to 2D images and fed into CNN. The CNN models extracts the useful features and learns to detect malicious ECU attacks with an accuracy of more than 90% using limited data.…”

Section: A Deep Learning In Intrusion Detectionmentioning

confidence: 99%