Biblio

Management control and monitoring of production activities in intelligent environments in subway mines must be aligned with the strategies and objectives of each agent. It is required that in operations, the local structure of each service is fault-tolerant and that large amounts of data are transmitted online to executives to make effective and efficient decisions. The paper proposes an architecture that enables strategic text analysis on the Internet of Things devices through task partitioning with multiple agent systems and evaluates the feasibility of the design by building a prototype that improves communication. The results validate the system's design because Raspberry Pi can execute text mining algorithms and agents in about 3 seconds for 197 texts. This work emphasizes multiple agents for text analytics because the algorithms, along with the agents, use about 70% of a Raspberry Pi CPU.

Malwares are the key means leveraged by threat actors in the cyber space for their attacks. There is a large array of commercial solutions in the market and significant scientific research to tackle the challenge of the detection and defense against malwares. At the same time, attackers also advance their capabilities in creating polymorphic and metamorphic malwares to make it increasingly challenging for existing solutions. To tackle this issue, we propose a methodology to perform malware detection and family attribution. The proposed methodology first performs the extraction of opcodes from malwares in each family and constructs their respective opcode graphs. We explore the use of clustering algorithms on the opcode graphs to detect clusters of malwares within the same malware family. Such clusters can be seen as belonging to different sub-family groups. Opcode graph signatures are built from each detected cluster. Hence, for each malware family, a group of signatures is generated to represent the family. These signatures are used to classify an unknown sample as benign or belonging to one the malware families. We evaluate our methodology by performing experiments on a dataset consisting of both benign files and malware samples belonging to a number of different malware families and comparing the results to existing approach.

Nodes in wireless Internet of Things (IoT) sensor networks are heterogeneous in nature. This heterogeneity can come from energy and security resources available at the node level. Besides, these resources are usually limited. Efficient cluster head (CH) selection in rounds is the key to preserving energy resources of sensor nodes. However, energy and security resources are contradictory to one another. Therefore, it is challenging to ensure CH selection with appropriate security resources without decreasing energy efficiency. Coverage and energy optimization subject to a required security level can form a solution to the aforementioned trade-off. This paper proposes a security level aware CH selection algorithm in wireless sensor networks for IoT. The proposed method considers energy and security level updates for nodes and coverage provided by associated CHs. The proposed method performs CH selection in rounds and in a centralized parallel processing way, making it applicable to the IoT scenario. The proposed algorithm is compared to existing traditional and emerging CH selection algorithms that apply security mechanisms in terms of energy and security efficiencies.

Many people are becoming more reliant on internet social media sites like Facebook. Users can utilize these networks to reveal articles to them and engage with your peers. Several of the data transmitted from these connections is intended to be confidential. However, utilizing publicly available data and learning algorithms, it is feasible to forecast concealed informative data. The proposed research work investigates the different ways to initiate deduction attempts on freely released photo sharing data in order to envisage concealed informative data. Next, this research study offers three distinct sanitization procedures that could be used in a range of scenarios. Moreover, the effectualness of all these strategies and endeavor to utilize collective teaching and research to reveal important bits of the data set are analyzed. It shows how, by using the sanitization methods presented here, a user may lower the accuracy by including both global and interpersonal categorization techniques.

Cyberattacks have been the major concern with the growing advancement in technology. Complex security models have been developed to combat these attacks, yet none exhibit a full-proof performance. Recently, several machine learning (ML) methods have gained significant popularity in offering effective and efficient intrusion detection schemes which assist in proactive detection of multiple network intrusions, such as Denial of Service (DoS), Probe, Remote to User (R2L), User to Root attack (U2R). Multiple research works have been surveyed based on adopted ML methods (either signature-based or anomaly detection) and some of the useful observations, performance analysis and comparative study are highlighted in this paper. Among the different ML algorithms in survey, PSO-SVM algorithm has shown maximum accuracy. Using RBF-based classifier and C-means clustering algorithm, a new model i.e., combination of serial and parallel IDS is proposed in this paper. The detection rate to detect known and unknown intrusion is 99.5% and false positive rate is 1.3%. In PIDS (known intrusion classifier), the detection rate for DOS, probe, U2R and R2L is 99.7%, 98.8%, 99.4% and 98.5% and the False positive rate is 0.6%, 0.2%, 3% and 2.8% respectively. In SIDS (unknown intrusion classifier), the rate of intrusion detection is 99.1% and false positive rate is 1.62%. This proposed model has known intrusion detection accuracy similar to PSO - SVM and is better than all other models. Finally the future research directions relevant to this domain and contributions have been discussed.

Domain Name System (DNS) is the Internet's system for converting alphabetic names into numeric IP addresses. It is one of the early and vulnerable network protocols, which has several security loopholes that have been exploited repeatedly over the years. The clustering task for the automatic recognition of these attacks uses machine learning approaches based on semi-supervised learning. A family of bio-inspired algorithms, well known as Swarm Intelligence (SI) methods, have recently emerged to meet the requirements for the clustering task and have been successfully applied to various real-world clustering problems. In this paper, Particle Swarm Optimization (PSO), Artificial Bee Colony (ABC), and Kmeans, which is one of the most popular cluster algorithms, have been applied. Furthermore, hybrid algorithms consisting of Kmeans and PSO, and Kmeans and ABC have been proposed for the clustering process. The Canadian Institute for Cybersecurity (CIC) data set has been used for this investigation. In addition, different measures of clustering performance have been used to compare the different algorithms.

Aiming at the problems of low accuracy and poor effect caused by the lack of data labels in most real network traffic, an optimized density peak clustering based on the improved salp swarm algorithm is proposed for traffic anomaly detection. Through the optimization of cosine decline and chaos strategy, the salp swarm algorithm not only accelerates the convergence speed, but also enhances the search ability. Moreover, we use the improved salp swarm algorithm to adaptively search the best truncation distance of density peak clustering, which avoids the subjectivity and uncertainty of manually selecting the parameters. The experimental results based on NSL-KDD dataset show that the improved salp swarm algorithm achieves faster convergence speed and higher precision, increases the average anomaly detection accuracy of 4.74% and detection rate of 6.14%, and reduces the average false positive rate of 7.38%.

Underwater wireless sensor network(UWSN) is an emerging technology for exploring and research inside the ocean. Since it is somehow similar to the normal wireless network, which uses radio signals for communication purposes, while UWSN uses acoustic for communication between nodes inside the ocean and sink nodes. Due to unattended areas and the vulnerability of acoustic medium, UWNS are more prone to various malicious attacks like Sybil attack, Black-hole attack, Wormhole attack, etc. This paper analyzes blackhole attacks in UWSN and proposes an algorithm to mitigate blackhole attacks by forming clusters of nodes and selecting coordinator nodes from each cluster to identify the presence of blackholes in its cluster. We used public-key cryptography and the challenge-response method to authenticate and verify nodes.

The network security problem brought by the cloud computing has become an important issue to be dealt with in information construction. Since anomaly detection and attack detection in cloud environment need to find the vulnerability through the reverse analysis of data flow, it is of great significance to carry out the reverse analysis of unknown network protocol in the security application of cloud environment. To solve this problem, an improved mining method on bitstream protocol association rules with unknown type and format is proposed. The method combines the location information of the protocol framework to make the frequent extraction process more concise and accurate. In addition, for the frame separation problem of unknown protocol, we design a hierarchical clustering algorithm based on Jaccard distance and a frame field delimitation method based on the proximity of information entropy between bytes. The experimental results show that this technology can correctly resolve the protocol format and realize the purpose of anomaly detection in cloud computing, and ensure the security of cloud services.

This paper proposes a novel network intrusion detection algorithm based on the combination of Subspace Clustering (SSC) and BP neural network. Firstly, we perform a subspace clustering algorithm on the network data set to obtain different subspaces. Secondly, BP neural network intrusion detection is carried out on the data in different subspaces, and calculate the prediction error value. By comparing with the pre-set accuracy, the threshold is constantly updated to improve the ability to identify network attacks. By comparing with K-means, DBSCAN, SSC-EA and k-KNN intrusion detection model, the SSC-BP neural network model can detect the most attacked networks with the lowest false detection rate.

Aiming at the problem of low detection accuracy in traditional power system network intrusion detection methods, in order to improve the performance of power system network intrusion detection, a power system network intrusion detection method based on random forest algorithm is proposed. Firstly, the power system network intrusion sub sample is selected to construct the random forest decision tree. The random forest model is optimized by using the edge function. The accuracy of the vector is judged by the minimum state vector of the power system network, and the measurement residual of the power system network attack is calculated. Finally, the power system network intrusion data set is clustered by Gaussian mixture clustering Through the design of power system network intrusion detection process, the power system network intrusion detection is realized. The experimental results show that the power system network intrusion detection method based on random forest algorithm has high network intrusion detection performance.

k-anonymity is a well-known definition of privacy, which guarantees that any person in the released dataset cannot be distinguished from at least k-1 other individuals. In the protection model, the records are anonymized through generalization or suppression with a fixed value of k. Accordingly, each record has the same level of anonymity in the published dataset. However, different people or items usually have inconsistent privacy requirements. Some records need extra protection while others require a relatively low level of privacy constraint. In this paper, we propose Multi-Level Privacy Preserving K-Anonymity, an advanced protection model based on k-anonymity, which divides records into different groups and requires each group to satisfy its respective privacy requirement. Moreover, we present a practical algorithm using clustering techniques to ensure the property. The evaluation on a real-world dataset confirms that the proposed method has the advantages of offering more flexibility in setting privacy parameters and providing higher data utility than traditional k-anonymity.

In the recent years, mobile ad hoc wireless networks (MANETs) have experienced a tremendous rise in popularity and usage due to their flexibility and ability to provide connectivity from anywhere at any time. In general, MANETs provide mobile communication to participating nodes in situation where nodes do not need access to an existing network infrastructure. MANETs have a network topology that changes over time due to lack of infrastructure and mobility of nodes. Detection of a malicious node in MANETs is hard to achieve due to the dynamic nature of the relationships between moving node and the nature of the wireless channel. Most traditional Intrusion Detection System (IDS) are designed to operate in a centralized manner; and do not operate properly in MANET because data in MANETs is distributed in different network devices. In this paper, we present an Hierarchical Cooperative Intrusion Detection Method (HCIDM) to secure packets routing in MANETs. HCIDM is a distributed intrusion detection mechanism that uses collaboration between nodes to detect active attacks against the routing table of a mobile ad hoc network. HCIDM reduces the effectiveness of the attack by informing other nodes about the existence of a malicious node to keep the performance of the network within an acceptable level. The novelty of the mechanism lies in the way the responsibility to protect the networks is distributed among nodes, the trust level is computed and the information about the presence of a malicious is communicated to potential victim. HCIDM is coded using the Network Simulator (NS-2) in an ad hoc on demand distance vector enable MANET during a black hole attack. It is found that the HCIDM works efficiently in comparison with an existing Collaborative Clustering Intrusion Detection Mechanism (CCIDM), in terms of delivery ratio, delay and throughput.

Proxy web caching is usually employed to maximize the efficiency and utilization of the network and the origin servers while reducing the request latency. However, and due to the limited cache size, some replacement policy has to be enforced in order to decide on the object(s) to be evicted from the cache once it is full. This paper introduces the use of the K-mean clustering to categorize the objects in the cache into groups of different priorities. This categorization is then used for replacement purposes such that the object(s) of lowest priority are chosen for eviction. The proposed improved the hit rate and the byte hit rate of the cache when compared to conventional and intelligent web proxy caching algorithms.

Testing or defending the security of a large network can be challenging because of the sheer number of potential ingress points that need to be investigated and evaluated for vulnerabilities. In short, manual security testing and analysis do not easily scale to large networks. While it has been shown that clustering can simplify the problem somewhat, the data structures and formats returned by the latest network mapping tools are not conducive to clustering algorithms. In this paper we introduce a hybrid similarity algorithm to compute the distance between two network services and then use those calculations to support a clustering algorithm designed to compress a large network attack surface by orders of magnitude. Doing so allows for new testing strategies that incorporate outlier detection and smart consolidation of test cases to improve accuracy and timeliness of testing. We conclude by presenting two case studies using an organization's network attack surface data to demonstrate the effectiveness of this approach.

Recommender system helps people in decision making by asking their preferences about various items and recommends other items that have not been rated yet and are similar to their taste. A traditional recommendation system aims at generating a set of recommendations based on inter-user similarity that will satisfy the target user. Positive preferences as well as negative preferences of the users are taken into account so as to find strongly related users. Weighted entropy is usedz as a similarity measure to determine the similar taste users. The target user is asked to fill in the ratings so as to identify the closely related users from the knowledge base and top N recommendations are produced accordingly. Results show a considerable amount of improvement in accuracy after using weighted entropy and opposite preferences as a similarity measure.

Due to the extraordinary volume of business information, classy cyber-attacks pointing the networks of all enterprise have become more casual, with intruders trying to pierce vast into and grasp broader from the compromised network machines. The vital security essential is that field experts and the network administrators have a common terminology to share the attempt of intruders to invoke the system and to rapidly assist each other retort to all kind of threats. Given the enormous huge system traffic, traditional Machine Learning (ML) algorithms will provide ineffective predictions of the network anomaly. Thereby, a hybridized multi-model system can improve the accuracy of detecting the intrusion in the networks. In this manner, this article presents a novel approach Clustered Generalization oriented Ensemble Learning Model (CGELM) for predicting the network anomaly. The performance metrics of the anticipated approach are Detection Rate (DR) and False Predictive Rate (FPR) for the two heterogeneous data sets namely NSL-KDD and UGR'16. The proposed method provides 98.93% accuracy for DR and 0.14% of FPR against Decision Stump AdaBoost and Stacking Ensemble methods.

Low accuracy and slow speed of predictions for cyber security situational awareness. This paper proposes a network security situational awareness model based on accelerated accurate k-means radial basis function (RBF) neural network, the model uses the ball k-means clustering algorithm to cluster the input samples, to get the nodes of the hidden layer of the RBF neural network, speeding up the selection of the initial center point of the RBF neural network, and optimize the parameters of the RBF neural network structure. Finally, use the training data set to train the neural network, using the test data set to test the accuracy of this neural network structure, the results show that this method has a greater improvement in training speed and accuracy than other neural networks.

The most common goal of malware analysis is to determine if a given binary is malware or benign. Another objective is similarity analysis of malware binaries to understand how new samples differ from known ones. Similarity analysis helps to analyze the malware with respect to those already analyzed and guides the discovery of novel aspects that should be analyzed more in depth. In this work, we are concerned with similarities and differences detection of malware binaries. Thousands of malware are created every day and machine learning is an indispensable tool for its analysis. Previous work has studied clustering and classification as competing paradigms. However, in this work, a malware similarity analysis technique (AltCC) is proposed that alternates the use of clustering and classification. In addition it assumes the malware are not available all at once but processed in batches. Initially, clustering is applied to the first batch to group similar binaries into novel malware classes. Then, the discovered classes are used to train a classifier. For the following batches, the classifier is used to decide if a new binary classifies to a known class or otherwise unclassified. The unclassified binaries are clustered and the process repeats. Malware clustering (i.e. labeling) may entail further human expert analysis but dramatically reduces the effort. The effectiveness of AltCC is studied using a dataset of 29,661 malware binaries that represent malware received in six consecutive days/batches. When KMeans is used to label the dataset all at once and its labeling is compared to AltCC's, the adjusted-rand-index scores 0.71.

To harness the value of data generated from IoT, there is a crucial requirement of new mechanisms. Machine learning (ML) is among the most suitable paradigms of computation which embeds strong intelligence within IoT devices. Various ML techniques are being widely utilised for improving network security in IoT. These techniques include reinforcement learning, semi-supervised learning, supervised learning, and unsupervised learning. This report aims to critically analyse the role played by supervised and unsupervised ML for the enhancement of IoT security.

The real-time information of enemy locations is capable to transform the outcome of combat operations. Such information gathered using connected soldiers on the Internet of Battlefield Things (IoBT) is highly beneficial to create situational awareness (SA) and to plan an effective war strategy. This article presents the novel enemy localization method that uses the soldier's own locations and their gunshot direction. The hardware prototype has been developed that uses a triangulation for an enemy localization in two soldiers and a single enemy scenario. 4.24±1.77 m of average localization error and ±4° of gunshot direction error has been observed during this prototype testing. This basic model is further extended using three-stage software simulation for multiple soldiers and multiple enemy scenarios with the necessary assumptions. The effective algorithm has been proposed, which differentiates between the ghost and true predictions by analyzing the groups of subsequent shooting intents (i.e., frames). Four different complex scenarios are tested in the first stage of the simulation, around three to six frames are required for the accurate enemy localization in the relatively simple cases, and nine frames are required for the complex cases. The random error within ±4° in gunshot direction is included in the second stage of the simulation which required almost double the number of frames for similar four cases. As the number of frames increases, the accuracy of the proposed algorithm improves and better ghost point elimination is observed. In the third stage, two conventional clustering algorithms are implemented to validate the presented work. The comparative analysis shows that the proposed algorithm is faster, computationally simple, consistent, and reliable compared with others. Detailed analysis of hardware and software results for various scenarios has been discussed in this article.

With the development of positioning technology and the popularity of mobile devices, location-based services have been widely deployed. To use the services, users must provide the server accurate location information, during which the attacker tends to infer sensitive information from intercepting queries. In this paper, we model the road network as an edge cluster graph with its location semantics considered. Then, we propose the Circle First Structure Optimization (CFSO) algorithm which generates an anonymous set by adding optimal adjacent locations. Furthermore, we introduce controllable randomness and propose the Attack-Resilient (AR) algorithm to enhance the anti-attack ability. Meanwhile, to reduce the system overhead, our algorithms build the anonymous set quickly and take the structure of the anonymous set into account. Finally, we conduct experiments on a real map and the results demonstrate a higher anonymity success rate and a stronger anti-attack capability with less system overhead.

With the improvement of the current Internet software and hardware performance, cloud storage has become one of the most widely used applications. This paper proposes a user privacy protection algorithm suitable for tennis match live broadcast from media cloud platform. Through theoretical and experimental verification, this algorithm can better protect the privacy of users in the live cloud platform. This algorithm is a ciphertext calculation algorithm based on data blocking. Firstly, plaintext data are grouped, then AES ciphertext calculation is performed on each group of plaintext data simultaneously and respectively, and finally ciphertext data after grouping encryption is spliced to obtain final ciphertext data. Experimental results show that the algorithm has the characteristics of large key space, high execution efficiency, ciphertext statistics and good key sensitivity.

Considering the problem of network security under the background of big data, the clustering analysis algorithms can be utilized to improve the correctness of network intrusion detection models for security management. As a kind of iterative clustering analysis algorithm, K-means algorithm is not only simple but also efficient, so it is widely used. However, the traditional K-means algorithm cannot well solve the network security problem when facing big data due to its high complexity and limited processing ability. In this case, this paper proposes to optimize the traditional K-means algorithm based on the Spark platform and deploy the optimized clustering analysis algorithm in the distributed architecture, so as to improve the efficiency of clustering algorithm for network intrusion detection in big data environment. The experimental result shows that, compared with the traditional K-means algorithm, the efficiency of the optimized K-means algorithm using a Spark-based method is significantly improved in the running time.

With a storage space limit on the sensors, WSN has some drawbacks related to bandwidth and computational skills. This limited resources would reduce the amount of data transmitted across the network. For this reason, data aggregation is considered as a new process. Iterative filtration (IF) algorithms, which provide trust assessment to the various sources from which the data aggregation has been performed, are efficient in the present data aggregation algorithms. Trust assessment is done with weights from the simple average method to aggregation, which treats attack susceptibility. Iteration filter algorithms are stronger than the ordinary average, but they do not handle the current advanced attack that takes advantage of false information with many compromise nodes. Iterative filters are strengthened by an initial confidence estimate to track new and complex attacks, improving the solidity and accuracy of the IF algorithm. The new method is mainly concerned with attacks against the clusters and not against the aggregator. In this process, if an aggregator is attacked, the current system fails, and the information is eventually transmitted to the aggregator by the cluster members. This problem can be detected when both cluster members and aggregators are being targeted. It is proposed to choose an aggregator which chooses a new aggregator according to the remaining maximum energy and distance to the base station when an aggregator attack is detected. It also save time and energy compared to the current program against the corrupted aggregator node.