Densely Connected Residual Network for Attack Recognition

Wu, Peilun; Moustafa, Nour; Yang, Shiyi; Guo, Hui

doi:10.1109/trustcom50675.2020.00042

Cited by 11 publications

(3 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Random forests then use the obtained prediction results for the final classification. The authors of [19] suggested a residual densely connected network (Densely-ResNet) to identify attacks. It was put together with the help of surviving core modules, each comprising several Conv-GRU subnets connected by wide links.…”

Section: Background and Related Workmentioning

confidence: 99%

Analysis of ToN-IoT, UNW-NB15, and Edge-IIoT Datasets Using DL in Cybersecurity for IoT

et al. 2022

View full text Add to dashboard Cite

The IoT’s quick development has brought up several security problems and issues that cannot be solved using traditional intelligent systems. Deep learning (DL) in the field of artificial intelligence (AI) has proven to be efficient, with many advantages that can be used to address IoT cybersecurity concerns. This study trained two models of intelligent networks—namely, DenseNet and Inception Time—to detect cyber-attacks based on a multi-class classification method. We began our investigation by measuring the performance of these two networks using three datasets: the ToN-IoT dataset, which consists of heterogeneous data; the Edge-IIoT dataset; and the UNSW2015 dataset. Then, the results were compared by identifying several cyber-attacks. Extensive experiments were conducted on standard ToN-IoT datasets using the DenseNet multicategory classification model. The best result we obtained was an accuracy of 99.9% for Windows 10 with DenseNet, but by using the Inception Time approach we obtained the highest result for Windows 10 with the network, with 100% accuracy. As for using the Edge-IIoT dataset with the Inception Time approach, the best result was an accuracy of 94.94%. The attacks were also assessed in the UNSW-NB15 database using the Inception Time approach, which had an accuracy rate of 98.4%. Using window sequences for the sliding window approach and a six-window size to start training the Inception Time model yielded a slight improvement, with an accuracy rate of 98.6% in the multicategory classification.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Analysis of ToN-IoT, UNW-NB15, and Edge-IIoT Datasets Using DL in Cybersecurity for IoT

et al. 2022

View full text Add to dashboard Cite

show abstract

“…However, as proved in our previous work [26], with the depth of the aforementioned plain networks increases, they will suffer from the problem of performance degradation, that is, a reduction in the detection accuracy of the model. Densely-ResNet [27] and DualNet [28] are two state-of-theart designs by reusing features to handle this issue. Densely-ResNet is a densely connected residual network.…”

Section: Supervised Machine Learning Approachesmentioning

confidence: 99%

“…In addition, a max-pooling (MP) layer is behind the DSC and a powerful regularizer dropout [33] is followed by the GRU to prevent overfitting and further reduce the computational cost, where MP is by down-sampling its inputs and dropout is by randomly removing several neurons. Besides, linear bridging (LB) [27] is appended to transform a series of nonlinear parameter layers into a linear space for stabilizing the learning process.…”

Section: Plain Blockmentioning

confidence: 99%

Hunter in the Dark: Discover Anomalous Network Activity Using Deep Ensemble Network

Yang¹,

Guo²,

Moustafa³

2021

Preprint

Self Cite

View full text Add to dashboard Cite

Machine learning (ML)-based network intrusion detection system (NIDS) plays a critical role in discovering unknown and novel threats in a large-scale cyberspace. It has been widely adopted as a mainstream hunting method in many organizations, such as financial institutes, manufacturing companies and government agencies. However, there are two challenging issues in the existing designs: 1) achieving excellent performance of threat detection is often at the cost of a large number of false positives, leading to the problem of alert fatigue and 2) the interpretability of detection results is low, making it difficult for the security analyst to obtain the insight of threats and take promptly actions against the attacks. To tackle the above issues, in this paper we propose a defense mechanism, DarkHunter, that includes three parts: stream processor, detection engine and incident analyzer. The stream processor converts raw network packet streams into data records of a set of statistical features that can be effectively used for learning; The detection engine leverages an efficient ensemble neural network (EnsembleNet) to identify anomalous network traffic; The incident analyzer applies a correlation analysis to filter out the mis-predictions from EnsembleNet, traces each detected threat from its statistical representation back to its source traffic flow to enhance its intelligibility and prioritizes the threats to be responded to minimize security risks. Our evaluations, based on the UNSW-NB15 testbed, show that DarkHunter significantly outperforms state-of-the-art ML-based NIDS designs by achieving higher accuracy, higher detection rate, higher precision, higher F 1 score while keeping lower false alarm rate.

show abstract