Learning Representations for Log Data in Cybersecurity

Arnaldo, Ignacio; Cuesta-Infante, Alfredo; Arun, Ankit; Lam, Mei; Bassias, Costas; Veeramachaneni, Kalyan

doi:10.1007/978-3-319-60080-2_19

Cited by 25 publications

(22 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Each autoencoder had an input layer whose dimension is equal to the number of features in the dataset (i.e., 115). As noted by [16] and [15], autoencoders effectively perform dimensionality reduction internally, such that the code layer between the encoder(s) and decoder(s) efficiently compresses the input layer and reflects its essential characteristics. In our experiments, four hidden layers of encoders were set at decreasing sizes of 75%, 50%, 33%, and 25% of the input layer's dimension.…”

Section: Empirical Evaluationmentioning

confidence: 99%

“…1) To the best of our knowledge, we are the first to apply autoencoders to IoT network traffic for anomaly detection, as a complete means of detecting botnet attacks. Even in the larger domain of network traffic analysis, autoencoders have not been used as fully automated standalone malware detectors, but rather as preliminary tools for either feature learning [15] or dimensionality reduction [16], or at most as semimanual outlier detectors which substantially depend on human labeling for subsequent classification [17] or further inspection by security analysts [13]. 2) Unlike previous experimental studies on the detection of IoT botnets or IoT traffic anomalies which relied on emulated or simulated data ( [4], [7], [8], [10]), we perform empirical evaluation with real traffic data, gathered from nine commercial IoT devices infected by authentic botnets from two families.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

Meidan

Bohadana

Mathov

et al. 2018

IEEE Pervasive Comput.

1,067

518

View full text Add to dashboard Cite

The proliferation of IoT devices which can be more easily compromised than desktop computers has led to an increase in the occurrence of IoT-based botnet attacks. In order to mitigate this new threat there is a need to develop new methods for detecting attacks launched from compromised IoT devices and differentiate between hour and millisecond long IoT-based attacks. In this paper we propose and empirically evaluate a novel network-based anomaly detection method which extracts behavior snapshots of the network and uses deep autoencoders to detect anomalous network traffic emanating from compromised IoT devices. To evaluate our method, we infected nine commercial IoT devices in our lab with two of the most widely known IoT-based botnets, Mirai and BASHLITE. Our evaluation results demonstrated our proposed method's ability to accurately and instantly detect the attacks as they were being launched from the compromised IoT devices which were part of a botnet.

show abstract

Section: Empirical Evaluationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

Meidan

Bohadana

Mathov

et al. 2018

IEEE Pervasive Comput.

1,067

518

View full text Add to dashboard Cite

show abstract

“…They have proposed a method based on a neural language model that has promisingly outperformed the current signature extraction techniques. [51] has developed an enterprise-grade framework that uses a divide and conquer strategy combing the analytics of behavior and modeling of time series. This approach has achieved an area under the curve receiver operating characteristics curve of 0.943.…”

Section: Organizationmentioning

confidence: 99%

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Ravi¹,

Alazab²,

Sriram³

et al. 2020

Preprint

View full text Add to dashboard Cite

show abstract

“…In this context, in order to provide embedded intelligence in the IoT environment, we can consider Machine Learning (ML) as one of the most effective computational models. Machine learning approaches have been used for different network security tasks such as network traffic analysis [3], [4], [5], intrusion detection [6], and botnet detection [7]. Machine Learning can be described as an intelligent device's ability to modify or automate a knowledge-based state or behavior, which is considered a critical part of an IoT solution.…”

Section: Introductionmentioning

confidence: 99%

“…One of the advantages of this class of detection technique is its ability to detect all known attacks effectively without generating an overwhelming number of false alarms. In the literature, some works use signature-based techniques to detect attacks [3], [7]; for instance, in the domain of network traffic analysis, [3] applied four different machine learning techniques as preliminary tools to learn the features of some known attacks. Signature-based techniques were also used in [7] to identify compromised machines by identifying botnet network traffic patterns.…”

Section: Introductionmentioning

confidence: 99%

Internet of Things Cyber Attacks Detection using Machine Learning

Alsamiri¹,

Alsubhi²

2019

IJACSA

View full text Add to dashboard Cite

The Internet of Things (IoT) combines hundreds of millions of devices which are capable of interaction with each other with minimum user interaction. IoT is one of the fastest-growing areas in of computing; however, the reality is that in the extremely hostile environment of the internet, IoT is vulnerable to numerous types of cyberattacks. To resolve this, practical countermeasures need to be established to secure IoT networks, such as network anomaly detection. Regardless that attacks cannot be wholly avoided forever, early detection of an attack is crucial for practical defense. Since IoT devices have low storage capacity and low processing power, traditional high-end security solutions to protect an IoT system are not appropriate. Also, IoT devices are now connected without human intervention for longer periods. This implies that intelligent network-based security solutions like machine learning solutions must be developed. Although many studies in recent years have discussed the use of Machine Learning (ML) solutions in attack detection problems, little attention has been given to the detection of attacks specifically in IoT networks. In this study, we aim to contribute to the literature by evaluating various machine learning algorithms that can be used to quickly and effectively detect IoT network attacks. A new dataset, Bot-IoT, is used to evaluate various detection algorithms. In the implementation phase, seven different machine learning algorithms were used, and most of them achieved high performance. New features were extracted from the Bot-IoT dataset during the implementation and compared with studies from the literature, and the new features gave better results.

show abstract

Learning Representations for Log Data in Cybersecurity

Cited by 25 publications

References 14 publications

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

N-BaIoT—Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Internet of Things Cyber Attacks Detection using Machine Learning

Contact Info

Product

Resources

About