Unsupervised Protocol-based Intrusion Detection for Real-world Networks

Labonne, Maxime; Olivereau, Alexis; Polve, Baptise; Zeghlache, Djamal

doi:10.1109/icnc47757.2020.9049796

Cited by 11 publications

(13 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore, IPTABLES relies on a threshold to count the number of active connections, which can create false positive errors. An advanced policy firewall (APF) [19] can also be used to counter this attack, but like IPTABLES, its constraints can also lead to false positive errors [20]. The combination of Apache modules and detection tools can also be used in a cloud computing environment [21].…”

Section: Related Workmentioning

confidence: 99%

SDToW: A Slowloris Detecting Tool for WMNs

et al. 2020

View full text Add to dashboard Cite

Denial of service (DoS) attacks play a significant role in contemporary cyberspace scenarios. A variety of different DoS attacks pollute networks by exploring various vulnerabilities. A group of DoS called application DoS attacks explore application vulnerabilities. This work presents a tool that detects and blocks an application DoS called Slowloris on wireless mesh networks (WMNs). Our tool, called SDToW, is designed to effectively use the structure of the WMNs to block the Slowloris attack. SDToW uses three different modules to detect and block the attack. Each module has its specific tasks and thus optimizes the overall detection and block efficiency. Our solution blocks the attacker on its first WMN hop, reducing the malicious traffic on the network and avoiding further attacks from the blocked user. The comparison results show that SDToW performs with 66.7% less processing consumption and 89.1% less memory consumption than Snort. Our solution does not limit the number of parallel connections per user. Hence, by avoiding this limitation, SDToW has a lower incidence of false positive errors than Snort.

show abstract

Section: Related Workmentioning

confidence: 99%

SDToW: A Slowloris Detecting Tool for WMNs

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Any malicious intrusion or attack on network vulnerabilities, computers or information systems may result in a serious predicament and violate the confidentiality, integrity and availability of the systems [155]. The examined primary studies are mainly focused on network intrusion detection [110,117,119,121,106,128,129,83,87,131]. However, other applications of GANs in intrusion detection are smartphone lock pattern intrusion detection [112], presentation attack detection [82], phishing detection [114], cognitive radio intrusion detection [76], cyber-physical system intrusion detection [93], and IoT security [19,46].…”

Section: Rq2: What Are the Application Domains Of Anomaly Detection W...mentioning

confidence: 99%

“…As reported in almost all primary studies, it takes a long time and powerful GPUs to train GANs to the point of satisfactory performance. Consequently, future studies need to explore GAN architectures that are lightweight and efficient in terms of resource consumption [22,28,127,89,83]. For instance, the effects of selecting GAN hyperparameters on the anomaly detection performance have not been studied in the literature.…”

Section: Future Research Directionsmentioning

confidence: 99%

“…, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105] Normal and Abnormal [106, 107, 108, 109] Representation learning with GANs Type of GAN List of references DCGAN [22, 25, 31, 32, 33, 35, 40, 44, 49, 53, 55, 60, 69, 77, 81, 86, 88, 92, 95, 97, 109, 103, 104, 105, 18, 30, 66, 78, 84, 99, 108, 96] Standard GAN[16,21,24,36,38,43,45,46,51,52,54,58,59,61,70,75,79,83,87,93,94,100,107] cGAN[23,26,37,39,56,57,64,65,72,73,74,76,85,90] …”

mentioning

confidence: 99%

See 1 more Smart Citation

Applications of Generative Adversarial Networks in Anomaly Detection: A Systematic Literature Review

Sabuhi¹,

Zhou²,

Bezemer³

et al. 2021

Preprint

View full text Add to dashboard Cite

Anomaly detection has become an indispensable tool for modern society, applied in a wide range of applications, from detecting fraudulent transactions to malignant brain tumours. Over time, many anomaly detection techniques have been introduced. However, in general, they all suffer from the same problem: a lack of data that represents anomalous behaviour. As anomalous behaviour is usually costly (or dangerous) for a system, it is difficult to gather enough data that represents such behaviour. This, in turn, makes it difficult to develop and evaluate anomaly detection techniques. Recently, generative adversarial networks (GANs) have attracted a great deal of attention in anomaly detection research, due to their unique ability to generate new data. In this paper, we present a systematic literature review of the applications of GANs in anomaly detection, covering 128 papers on the subject. The goal of this review paper is to analyze and summarize: (1) which anomaly detection techniques can benefit from certain types of GANs, and how, (2) in which application domains GAN-assisted anomaly detection techniques have been applied, and (3) which datasets and performance metrics have been used to evaluate these techniques. Our study helps researchers and practitioners to find the most suitable GAN-assisted anomaly detection technique for their application. In addition, we present a research roadmap for future studies in this area.

show abstract

“…Labonne and colleagues also used a deep autoencoder [43], alongside four other neural network architectures, on the CICIDS2017 dataset, comparing the respective anomaly scores. They note that there is an often-missed distinction between traffic classification and attack detection, so they correlate anomaly scores to estimate the probability of a sequence being an attack.…”

Section: Literature Reviewmentioning

confidence: 99%

Intruder Alert: Dimension Reduction and Density-Based Clustering for a Cybersecurity Application

Burr¹

View full text Add to dashboard Cite

This thesis examines the use of Principal Component Analysis, Robust Principal Component Analysis, and simple autoencoders for dimension reduction on a synthetic cybersecurity dataset. Each is tested as a precursor to Independent Component Analysis. Stable independent components are obtained by iterative randomized starts to FastICA and selecting the centroids of the hierarchically clustered components. A density-based clustering method is then applied to the results with the goal of isolating malicious observations from benign ones using greatest distance between centroids as a heuristic metric of success. The method is then applied to a real-world cybersecurity dataset from an industry partner. i No project of this scale happens in a vacuum. To start with, thank you to Dr. Shirley Mills for taking a chance on me. Your kindness has been invaluable and your expertise irreplaceable. Thank you for supervising me and for introducing me to data mining. Thank you to my committee members, Drs. Dave Campbell and Aaron Smith, for your encouragement, your gentle questions, and your feedback on both the written portion and the defence. It was likely the nicest reviewer feedback anyone in academia could expect to see, and I will cherish that (and likely never publish again so that I can go out on a high note). Thank you to my chair, Dr. Song Cai, for keeping us all on track and overseeing the process. And thank you to our silent Zoom guru Jonathan Lindsay. If things went badly, my wife told me to text her "SOS" and she would unplug the router so that I could claim there were connection issues. I'm glad it all went well so I didn't have to throw you under the bus. Thank you to Hazem Soliman, Geoff Salmon, and Rank Software for approaching us with this project. Thank you for the expert guidance, feedback, and support throughout the early stages, and for the generous use of your data. I hope you got something worthwhile out of this work. Thank you to Shelly Wang for your hard work and support during the first phase of the project as well. I am proud to have a little paper with our names on it and know that you will go on to much bigger things. And thank you to my loving wife Sabrina, without whose coaching, guidance, support, advice and time management I would still have been writing this thesis in 2030. In fact, you're looking over my shoulder right now, complaining about how long this is taking.

show abstract

Unsupervised Protocol-based Intrusion Detection for Real-world Networks

Cited by 11 publications

References 9 publications

SDToW: A Slowloris Detecting Tool for WMNs

SDToW: A Slowloris Detecting Tool for WMNs

Applications of Generative Adversarial Networks in Anomaly Detection: A Systematic Literature Review

Intruder Alert: Dimension Reduction and Density-Based Clustering for a Cybersecurity Application

Contact Info

Product

Resources

About