Question: Lane detection (Part I): A method based on mono-vision analysis.

This paper introduces an innovative technique for calibrating a vision system that involves two or more cameras. The method, which harnesses the fundamental properties of vanishing points, is executed in two stages. Initially, the intrinsic parameters of each camera, including the focal length and the point where the optical axis intersects the image plane, are determined using a single image of a cube. Subsequently, the extrinsic parameters, specifically the rotation matrix and translation vector that describe the rigid transformation between the coordinate systems of the two cameras, are estimated from a stereo pair of images depicting a suitable planar pattern. The first stage involves matching the corresponding vanishing points across the two images to calculate the rotation matrix. The translation vector is then estimated through a straightforward triangulation process. The method's resilience to noise is explored, and conditions for achieving optimal rotation matrix estimation are outlined. Comprehensive experimental results confirm that the accuracy attainable with this method is adequate for executing machine vision tasks that necessitate camera calibration, such as depth estimation from stereo images and motion analysis from image sequences.

This paper presents an e cient shape-based object detection method based on Distance Transforms and describes its use for real-time vision on-board vehicles. The method uses a template hierarchy to capture the variety of object shapes; e cient hierarchies can be generated o ine for given shape distributions using stochastic optimization techniques (i.e. simulated annealing). Online, matching involves a simultaneous coarse-tone approach over the shape hierarchy and over the transformation parameters. Very large speedup factors are typically obtained when comparing this approach with the equivalent brute-force formulation; we have measured gains of several orders of magnitudes. We present experimental results on the real-time detection of tra c signs and pedestrians from a moving vehicle. Because of the highly time sensitive nature of these vision tasks, we also discuss some hardwarespeci c implementations of the proposed method as far as SIMD parallelism is concerned.

Curb detection is an essential component of Autonomous Land Vehicles (ALV), especially important for safe driving in urban environments. In this paper, we propose a fusion-based curb detection method through exploiting 3D-Lidar and camera data. More specifically, we first fuse the sparse 3D-Lidar points and high-resolution camera images together to recover a dense depth image of the captured scene. Based on the recovered dense depth image, we propose a filter-based method to estimate the normal direction within the image. Then, by using the multi-scale normal patterns based on the curb's geometric property, curb point features fitting the patterns are detected in the normal image row by row. After that, we construct a Markov Chain to model the consistency of curb points which utilizes the continuous property of the curb, and thus the optimal curb path which links the curb points together can be efficiently estimated by dynamic programming. Finally, we perform post-processing operations to filter the outliers, parameterize the curbs and give the confidence scores on the detected curbs. Extensive evaluations clearly show that our proposed method can detect curbs with strong robustness at real-time speed for both static and dynamic scenes.

Vehicle License Plate Recognition (VLPR) system is a core module in Intelligent Transportation Systems (ITS). In this paper, a VLPR system is proposed. Considering that license plate localization is the most important and difficult part in VLPR system, we present an effective license plate localization method based on analysis of Maximally Stable Extremal Region (MSER) features. Firstly, MSER detector is utilized to extract candidate character regions. Secondly, the exact locations of license plates are inferred according to the arrangement of characters in standard license plates. The advantage of this license plate localization method is that less assumption of environmental illumination, weather and other conditions is made. After license plate localization, we continue to recognize the license plate characters and color to complete the whole VLPR system. Finally, the proposed VLPR system is tested on our own collected dataset. The experimental results show the availability and effectiveness of our VLPR system in locating and recognizing all the explicit license plates in an image.

In most autonomous driving applications, such as parking and commuting, a vehicle follows a previously taken route, or almost the same route. In this paper, we propose a method to localize a vehicle along a previously driven route using images. The proposed method consists of two stages: offline creation of a database, and online localization. In the offline stage, a database is created from images that are captured when the vehicle drives a route for the first time. The database consists of images, 3D positions of feature points estimated by structure-from-motion, and a topological graph. In the online stage, the method first identifies the database image that is most similar to the current image by topometric localization, which considers topological information on a metric scale. The vehicle poses are then estimated from the 3D-2D correspondences of matching feature points between the current image and the identified database image. In an experiment, we estimated vehicle poses using images captured in an indoor parking lot.

In this paper we describe a trainable object detector and its instantiations for detecting faces and cars at any size, location, and pose. To cope with variation in object orientation, the detector uses multiple classifiers, each spanning a different range of orientation. Each of these classifiers determines whether the object is present at a specified size within a fixed-size image window. To find the object at any location and size, these classifiers scan the image exhaustively. Each classifier is based on the statistics of localized parts. Each part is a transform from a subset of wavelet coefficients to a discrete set of values. Such parts are designed to capture various combinations of locality in space, frequency, and orientation. In building each classifier, we gathered the class-conditional statistics of these part values from representative samples of object and non-object images. We trained each classifier to minimize classification error on the training set by using Adaboost with Confidence-Weighted Predictions (Shapire and Singer, 1999). In detection, each classifier computes the part values within the image window and looks up their associated class-conditional probabilities. The classifier then makes a decision by applying a likelihood ratio test. For efficiency, the classifier evaluates this likelihood ratio in stages. At each stage, the classifier compares the partial likelihood ratio to a threshold and makes a decision about whether to cease evaluation—labeling the input as non-object—or to continue further evaluation. The detector orders these stages of evaluation from a low-resolution to a high-resolution search of the image. Our trainable object detector achieves reliable and efficient detection of human faces and passenger cars with out-of-plane rotation.

At this moment Automous cars are probably the biggest and most talked about technology in the Robotics Reserach Community. In spite of great technolgical advances over past few years a full fledged autonomous car is still far from reality. This article talks about the existing system and discusses the possibility of a Computer Vision enabled driving being superior than the LiDar based system. A detailed overview of privacy violations that might arise from autonomous driving has been discussed in detail both from a technical as well as legal perspective. It has been proved through evidence and arguments that efficient and accurate estimation and efficient solution of the contraint satisfaction problem adressed in the case of autonomous cars are negatively correlated with the preserving the privacy of the user. It is a very difficult trade-off since both are very important aspects and has to be taken into account. The fact that one cannot compromise with the safety issues of the car makes it inevidable to run into serious privacy concerns that might have adverse social and political effects.

A system for real-time traffic sign detection is described in this paper. The system uses restricted Hough transform for circumferences in order to detect circular signs, and for straight lines for triangular ones. Some results obtained from a set of real road images captured under both normal and adverse weather conditions are presented as well in order to illustrate the robustness of the detection system. The average processing time is 30 ms per frame, what makes the system a good approach to work in real time conditions.

To facilitate scene understanding and robot navigation in a modern urban area, we design a multilayer feature graph (MFG) based on two views from an on-board camera. The nodes of an MFG are features such as scale invariant feature transformation (SIFT) feature points, line segments, lines, and planes while edges of the MFG represent different geometric relationships such as adjacency, parallelism, collinearity, and coplanarity. MFG also connects the features in two views and the corresponding 3D coordinate system. Building on SIFT feature points and line segments, MFG is constructed using feature fusion which incrementally, iteratively, and extensively verifies the aforementioned geometric relationships using random sample consensus (RANSAC) framework. Physical experiments show that MFG can be successfully constructed in urban area and the construction method is demonstrated to be very robust in identifying feature correspondence.

Drowsiness detection is vital in preventing traffic accidents. Eye state analysis - detecting whether the eye is open or closed - is critical step for drowsiness detection. In this paper, we propose an easy algorithm for pupil center and iris boundary localization and a new algorithm for eye state analysis, which we incorporate into a four step system for drowsiness detection: face detection, eye detection, eye state analysis, and drowsy decision. This new system requires no training data at any step or special cameras. Our eye detection algorithm uses Eye Map, thus achieving excellent pupil center and iris boundary localization results on the IMM database. Our novel eye state analysis algorithm detects eye state using the saturation (S) channel of the HSV color space. We analyze our eye state analysis algorithm using five video sequences and show superior results compared to the common technique based on distance between eyelids.

In this paper a novel reconstruction method is presented that uses the topological relationship of detected image features to create a highly abstract but semantically rich 3D model of the reconstructed scenes. In the first step, a combined image-based reconstruction of points and lines is performed based on the current state of art structure from motion methods. Subsequently, connected planar threedimensional structures are reconstructed by a novel method that uses the topological relationships between the detected image features. The reconstructed 3D models enable a simple extraction of geometric shapes, such as rectangles, in the scene.


Question: Lane detection (Part I): a mono-vision based technique for identifying lanes.

This paper introduces a robust and efficient real-time lane tracking method specifically tailored for curved local roads, a critical element in advanced intelligent transportation systems. To begin, a comprehensive comparative analysis is conducted to identify an effective real-time lane marking classifier. Post-classification, the detected lane markings are aggregated into various lane boundary hypotheses, modeled as constrained cubic spline curves. The paper then details a robust hypothesis generation strategy that combines particle filtering techniques with the RANSAC (Random Sample Consensus) algorithm, enhancing the accuracy and reliability of lane boundary identification. A novel probabilistic approach is proposed for distinguishing between left and right lane boundaries from among the generated hypotheses. This approach can be generalized to broader object tracking scenarios, integrating a likelihood-based recognition mechanism within a Markovian framework. The effectiveness and reliability of the proposed algorithm are validated through real-world experiments conducted on local streets, demonstrating its robust performance in complex, curved road environments.

Steering a car through traffic is a complex task that is difficult to cast into algorithms. Therefore, researchers turn to training artificial neural networks from front-facing camera data stream along with the associated steering angles. Nevertheless, most existing solutions consider only the visual camera frames as input, thus ignoring the temporal relationship between frames. In this work, we propose a Convolutional Long Short-Term Memory Recurrent Neural Network (C-LSTM), that is end-to-end trainable, to learn both visual and dynamic temporal dependencies of driving. Additionally, We introduce posing the steering angle regression problem as classification while imposing a spatial relationship between the output layer neurons. Such method is based on learning a sinusoidal function that encodes steering angles. To train and validate our proposed methods, we used the publicly available Comma.ai dataset. Our solution improved steering root mean square error by 35% over recent methods, and led to a more stable steering by 87%.

This paper presents a stereo vision-based autonomous navigation system using a GPS and a modified version of the VFH algorithm. In order to obtain a high-accuracy disparity map and meet the time constraints of the real time navigation system, this work proposes the use of a semi-global stereo method. By not suffering the same issues of the regularly used local stereo methods, the employed stereo technique enables the generation of a highly dense, efficient, and accurate disparity map. Obstacles are detected using a method that checks for relative slopes and heights differences. Experimental tests using an electric vehicle in an urban environment were performed to validate the proposed approach.

Predicting driver behavior is a key component for Advanced Driver Assistance Systems (ADAS). In this paper, a novel approach based on Support Vector Machine and Bayesian filtering is proposed for online lane change intention prediction. The approach uses the multiclass probabilistic outputs of the Support Vector Machine as an input to the Bayesian filter, and the output of the Bayesian filter is used for the final prediction of lane changes. A lane tracker integrated in a passenger vehicle is used for real-world data collection for the purpose of training and testing. Data from different drivers on different highways were used to evaluate the robustness of the approach. The results demonstrate that the proposed approach is able to predict driver intention to change lanes on average 1.3 seconds in advance, with a maximum prediction horizon of 3.29 seconds.

This paper presents a multi-cue approach to curb recognition in urban traffic. We propose a novel texture-based curb classifier using local receptive field (LRF) features in conjunction with a multi-layer neural network. This classification module operates on both intensity images and on three-dimensional height profile data derived from stereo vision. We integrate the proposed multi-cue curb classifier as an additional measurement module into a state-of-the-art Kaiman filter-based urban lane recognition system. Our experiments involve a challenging real-world dataset captured in urban traffic with manually labeled ground-truth. We quantify the benefit of the proposed multi-cue curb classifier in terms of the improvement in curb localization accuracy of the integrated system. Our results indicate a 25% reduction of the average curb localization error at real-time processing speeds.

Scale drift is a crucial challenge for monocular autonomous driving to emulate the performance of stereo. This paper presents a real-time monocular SFM system that corrects for scale drift using a novel cue combination framework for ground plane estimation, yielding accuracy comparable to stereo over long driving sequences. Our ground plane estimation uses multiple cues like sparse features, dense inter-frame stereo and (when applicable) object detection. A data-driven mechanism is proposed to learn models from training data that relate observation covariances for each cue to error behavior of its underlying variables. During testing, this allows per-frame adaptation of observation covariances based on relative confidences inferred from visual data. Our framework significantly boosts not only the accuracy of monocular self-localization, but also that of applications like object localization that rely on the ground plane. Experiments on the KITTI dataset demonstrate the accuracy of our ground plane estimation, monocular SFM and object localization relative to ground truth, with detailed comparisons to prior art.

Pedestrian detection is a highly debated issue in the scientific community due to its outstanding importance for a large number of applications, especially in the fields of automotive safety, robotics and surveillance. In spite of the widely varying methods developed in recent years, pedestrian detection is still an open challenge whose accuracy and robustness has to be improved. Therefore, in this paper, we focus on improving the classification component in the pedestrian detection task on the Daimler stereo vision data set by adopting two approaches: 1) by combining three image modalities (intensity, depth and flow) to feed a unique convolutional neural network (CNN) and 2) by fusing the results of three independent CNNs.

Both the original version of David Lowe's innuential and classic algorithm for tracking known objects and a reformulation of it implemented by Ishii et al. rely on (diierent) approximated imaging models. Removing their simplifying assumptions yields a fully pro-jective solution with signiicantly improved accuracy and convergence, and arguably better computation{ time properties.

This article proposes a system that fuses radar and monocular vision sensor data in order to detect and classify on-road obstacles, like cars or not cars (other obstacles). The obstacle detection process and classification is divided into three stages, the first consist in reading radar signals and capturing the camera data, the second stage is the data fusion, and the third step is the classify the obstacles, aiming to differentiate the obstacles types identified by the radar and confirmed by the computer vision. In the detection task it is important to locate, measure, and rank the obstacles to be able to take adequate decisions and actions (e.g. Generate alerts, autonomously control the vehicle path), so the correct classification of the obstacle type and position, is very important, also avoiding false positives and/or false negatives in the classification task.

License plate recognition(LPR)system contributed to facilitate the human work and make it easier. It is an image processing technology, which uses number plate to identify the vehicles. This paper aims to investigate in the existing LPR research by categorizing existing methods by analyzing the pros/cons of these features, and comparing them in terms of the algorithms that involve and recognition performance. We focus on the recent studies and their limitations, since each country has a different environment and format of licence plate.

An unmanned aerial vehicle (UAV) has many applications in a variety of fields. Detection and tracking of a specific road in UAV videos play an important role in automatic UAV navigation, traffic monitoring, and ground-vehicle tracking, and also is very helpful for constructing road networks for modeling and simulation. In this paper, an efficient road detection and tracking framework in UAV videos is proposed. In particular, a graph-cut-based detection approach is given to accurately extract a specified road region during the initialization stage and in the middle of tracking process, and a fast homography-based road-tracking scheme is developed to automatically track road areas. The high efficiency of our framework is attributed to two aspects: the road detection is performed only when it is necessary and most work in locating the road is rapidly done via very fast homography-based tracking. Experiments are conducted on UAV videos of real road scenes we captured and downloaded from the Internet. The promising results indicate the effectiveness of our proposed framework, with the precision of 98.4% and processing 34 frames per second for 1046 × 595 videos on average.


Question: Identifying distributed denial of service assaults through machine learning techniques in software-defined network environments.

This paper provides an in-depth review of intrusion detection systems utilizing machine learning techniques, addressing the critical issue of network security. Given the escalating risks associated with network attacks in the era of widespread internet usage, the detection of intrusions has become a focal point of research. Machine learning methods have been widely applied to intrusion detection systems, yet a comprehensive review of the field's current state has been lacking. This chapter critically evaluates 55 studies conducted between 2000 and 2007, focusing on the design of single, hybrid, and ensemble classifiers. The studies are analyzed based on their classifier design, the datasets employed, and other experimental parameters. The review highlights the progress and challenges in developing intrusion detection systems through machine learning, offering insights into the strengths and limitations of various approaches. Additionally, the paper outlines promising avenues for future research, aiming to advance the field of intrusion detection in software-defined networks and beyond. Copyright 2009 Elsevier Ltd. All rights reserved.

**Question**: A comparative study on the effectiveness of different machine learning algorithms for detecting DDoS attacks in software-defined networks

**Documents**: A survey on machine learning techniques for intrusion detection systems
In recent years, machine learning (ML) techniques have been widely used in intrusion detection systems (IDS) to detect various types of network attacks. ML algorithms can learn from data and detect anomalies that may indicate an attack. This survey paper provides an overview of the recent advancements in the use of ML techniques for IDS. We discuss the different ML algorithms that have been used for IDS, including supervised, unsupervised, and semi-supervised learning algorithms. We also review the datasets that have been used in the literature for evaluating the performance of these algorithms. Furthermore, we present a comparative analysis of the performance of different ML algorithms for IDS. Finally, we discuss the challenges and future research directions in the use of ML for IDS. 2021 IEEE.

**Similar Documents**: This comprehensive survey examines the recent trends and advancements in the application of machine learning techniques for intrusion detection systems, particularly in the context of detecting Distributed Denial of Service (DDoS) attacks in software-defined networks. ML algorithms have proven their capability to learn from historical data and identify anomalies indicative of security breaches. The paper explores a range of ML algorithms employed in intrusion detection, encompassing supervised, unsupervised, and semi-supervised learning methods. It also delves into the datasets utilized in the literature to assess the efficacy of these algorithms. A detailed comparative analysis is provided, showcasing

Autonomic communications aim to provide the quality-of-service in networks using self-management mechanisms. It inherits many characteristics from autonomic computing, in particular, when communication systems are running as specialized applications in software-defined networking (SDN) and network function virtualization (NFV)-enabled cloud environments. This paper surveys autonomic computing and communications in the context of software-driven networks, i.e., networks based on SDN/NFV concepts. Autonomic communications create new challenges in terms of security, operations, and business support. We discuss several goals, research challenges, and development issues on self-management mechanisms and architectures in software-driven networks. This paper covers multiple perspectives of autonomic communications in software-driven networks, such as automatic testing, integration, and deployment of network functions. We also focus on self-management and optimization, which make use of machine learning techniques.

The importance of network security has grown tremendously and a collection of devices have been introduced, which can improve the security of a network. Network intrusion detection systems (NIDS) are among the most widely deployed such system; popular NIDS use a collection of signatures of known security threats and viruses, which are used to scan each packet's payload. Today, signatures are often specified as regular expressions; thus the core of the NIDS comprises of a regular expressions parser; such parsers are traditionally implemented as finite automata. Deterministic Finite Automata (DFA) are fast, therefore they are often desirable at high network link rates. DFA for the signatures, which are used in the current security devices, however require prohibitive amounts of memory, which limits their practical use.
 In this paper, we argue that the traditional DFA based NIDS has three main limitations: first they fail to exploit the fact that normal data streams rarely match any virus signature; second, DFAs are extremely inefficient in following multiple partially matching signatures and explodes in size, and third, finite automaton are incapable of efficiently keeping track of counts. We propose mechanisms to solve each of these drawbacks and demonstrate that our solutions can implement a NIDS much more securely and economically, and at the same time substantially improve the packet throughput.

Android is arguably the most widely used mobile operating system in the world. Due to its widespead use and huge user base, it has attracted a lot of attention from the unsavory crowd of malware writers. Traditionally, techniques to counter such malicious software involved manually analyzing code and figuring out whether it was malicious or benign. However, due to the immense pace at which newer malware families are surfacing, such an approach is no longer feasible. Machine learning offers a way to tackle this issue of speed by automating the classification task. While several efforts have been made to use traditional machine learning techniques to Android malware detection, no reasonable effort has been made to utilize the newer, deep learning models in this domain. In this paper, we apply several deep learning models including fully connected, convolutional and recurrent neural networks as well as autoencoders and deep belief networks to detect Android malware from a large scale dataset of more than 55 GBs of Android malware. Further, we apply Bayesian machine learning to this problem domain to see how it fares with the deep learning based models while also providing insights into the dataset. We show that we are able to achieve better results using these models as compared to the state-of-the-art approaches. Our best model gets an F1 score of 0.986 with an AUC of 0.983 as compared to the existing best F1 score of 0.875 and AUC of 0.953.

Buffer overflows have become the most common target for network-based attacks. They are also the primary mechanism used by worms and other forms of automated attacks. Although many techniques have been developed to prevent server compromises due to buffer overflows, these defenses still lead to server crashes. When attacks occur repeatedly, as is common with automated attacks, these protection mechanisms lead to repeated restarts of the victim application, rendering its service unavailable. To overcome this problem, we develop a new approach that can learn the characteristics of a particular attack, and filter out future instances of the same attack or its variants. By doing so, our approach significantly increases the availability of servers subjected to repeated attacks. The approach is fully automatic, does not require source code, and has low runtime overheads. In our experiments, it was effective against most attacks, and did not produce any false positives

Amplification DDoS attacks have gained popularity and become a serious threat to Internet participants. However, little is known about where these attacks originate, and revealing the attack sources is a non-trivial problem due to the spoofed nature of the traffic.
 In this paper, we present novel techniques to uncover the infrastructures behind amplification DDoS attacks. We follow a two-step approach to tackle this challenge: First, we develop a methodology to impose a fingerprint on scanners that perform the reconnaissance for amplification attacks that allows us to link subsequent attacks back to the scanner. Our methodology attributes over 58% of attacks to a scanner with a confidence of over 99.9%. Second, we use Time-to-Live-based trilateration techniques to map scanners to the actual infrastructures launching the attacks. Using this technique, we identify 34 networks as being the source for amplification attacks at 98\% certainty.

In this paper, we present Nyx, the first system to both effectively mitigate modern Distributed Denial of Service (DDoS) attacks regardless of the amount of traffic under adversarial control and function without outside cooperation or an Internet redesign. Nyx approaches the problem of DDoS mitigation as a routing problem rather than a filtering problem. This conceptual shift allows Nyx to avoid many of the common shortcomings of existing academic and commercial DDoS mitigation systems. By leveraging how Autonomous Systems (ASes) handle route advertisement in the existing Border Gateway Protocol (BGP), Nyx allows the deploying AS to achieve isolation of traffic from a critical upstream AS off of attacked links and onto alternative, uncongested, paths. This isolation removes the need for filtering or de-prioritizing attack traffic. Nyx controls outbound paths through normal BGP path selection, while return paths from critical ASes are controlled through the use of specific techniques we developed using existing traffic engineering principles and require no outside coordination. Using our own realistic Internet-scale simulator, we find that in more than 98% of cases our system can successfully route critical traf?c around network segments under transit-link DDoS attacks; a new form of DDoS attack where the attack traf?c never reaches the victim AS, thus invaliding defensive filtering, throttling, or prioritization strategies. More significantly, in over 95% of those cases, the alternate path provides complete congestion relief from transit-link DDoS. Nyx additionally provides complete congestion relief in over 75% of cases when the deployer is being directly attacked.

With the growing realization that current Internet protocols are reaching the limits of their senescence, several on-going research efforts aim to design potential next-generation Internet architectures. Although they vary in maturity and scope, in order to avoid past pitfalls, these efforts seek to treat security and privacy as fundamental requirements. Resilience to Denial-of-Service (DoS) attacks that plague today's Internet is a major issue for any new architecture and deserves full attention. In this paper, we focus on DoS in Named Data Networking (NDN) - a specific candidate for next-generation Internet architecture designs. By naming data instead of its locations, NDN transforms data into a first-class entity and makes itself an attractive and viable approach to meet the needs for many current and emerging applications. It also incorporates some basic security features that mitigate classes of attacks that are commonly seen today. However, NDN's resilience to DoS attacks has not been analyzed to-date. This paper represents a first step towards assessment and possible mitigation of DoS in NDN. After identifying and analyzing several new types of attacks, it investigates their variations, effects and counter-measures. This paper also sheds some light on the debate about relative virtues of self-certifying, as opposed to human-readable, names in the context of content-centric networking.

Intrusion detection is an alternative to the situation of the security violation.Security mechanism of the network is necessary against the threat to the system. There are two types of intruders: external intruders, who are unauthorized users of the machines they attack, and internal intruders, who have permission to access the system with some restrictions. This paper describes a brief overview of various intrusion detection techniques such as fuzzy logic, neural network, pattern recognition methods, genetic algorithms and related techniques is presented. Among the several soft computing paradigms, fuzzy rule-based classifiers, decision trees, support vector machines, linear genetic programming is model fast and efficient intrusion detection systems. KeywordsIntroduction, intrusion detection methods, misuse detection techniques, anomaly detection techniques, genetic algorithms.

Behavior of Machine Learning Algorithms in Adversarial Environments

Data and network system security is the most important roles. An organization should find the methods to protect their data and network system to reduce the risk from attacks. Snort Intrusion Detection System (Snort-IDS) is a security tool of network security. It has been widely used for protecting the network of the organizations. The Snort-IDS utilize the rules to matching data packets traffic. If some packet matches the rules, Snort-IDS will generate the alert messages. However, Snort-IDS contain many rules and it also generates a lot of false alerts. In this paper, we present the procedure to improve the Snort-IDS rules for the network probe attack detection. In order to test the performance evaluation, we utilized the data set from the MIT-DAPRA 1999, which includes the normal and abnormal traffics. Firstly, we analyzed and explored the existing the Snort-IDS rules to improve the proposed Snort-IDS rules. Secondly, we applied the WireShark software to analyze data packets form of attack in data set. Finally, the Snort-IDS was improved, and it can detect the network probe attack. This paper, we had classified the attacks into several groups based on the nature of network probe attack. In addition, we also compared the efficacy of detection attacks between Snort-IDS rules to be updated with the Detection Scoring Truth. As the experimental results, the proposed Snort-IDS efficiently detected the network probe attacks compared to the Detection Scoring Truth. It can achieve higher accuracy. However, there were some detecting alert that occur over the attack in Detection Scoring Truth, because some attack occur in several time but the Detection Scoring Truth indentify as one time.


Question: Identifying distributed denial of service assaults through the application of machine learning techniques in software-defined network environments.

This paper explores the integration of OpenFlow and sFlow to create a robust and scalable anomaly detection and response system within Software Defined Network (SDN) environments. SDNs, utilizing the OpenFlow protocol, offer programmable control over network switches, enabling sophisticated traffic management, load balancing, routing, and firewall configurations tailored to specific flows. The research extends this capability by proposing an efficient mechanism for detecting and mitigating anomalies, particularly large-scale malicious activities like Distributed Denial of Service (DDoS) attacks, in SDN frameworks. Initially, the study highlights the scalability challenges posed by the collection and processing of OpenFlow statistics on the centralized control plane. To address this, a modular architecture is introduced, which separates the data collection process from the SDN control plane by leveraging sFlow monitoring data. Comparative performance evaluations between the sFlow-based approach and native OpenFlow methods, which rely on standard flow table statistics, are presented using an entropy-based detection method. The analysis is conducted on high-volume real-world network traffic data from a university campus network, with the data fed into both hardware and software OpenFlow devices to assess flow-based data gathering and anomaly detection capabilities. The findings illustrate the superior efficiency of the sFlow-based mechanism in terms of system resource utilization compared to the native OpenFlow approach. The paper concludes by demonstrating the effectiveness of the OpenFlow protocol in mitigating detected network anomalies through flow table modifications, reinforcing the system's capability to handle and respond to security threats in real-time. 2013 Elsevier B.V. All rights reserved.

We present a scalable system for high-throughput real-time analysis of heterogeneous data streams. Our architecture enables incremental development of models for predictive analytics and anomaly detection as data arrives into the system. In contrast with batch data-processing systems, such as Hadoop, that can have high latency, our architecture allows for ingest and analysis of data on the fly, thereby detecting and responding to anomalous behavior in near real time. This timeliness is important for applications such as insider threat, financial fraud, and network intrusions. We demonstrate an application of this system to the problem of detecting insider threats, namely, the misuse of an organization's resources by users of the system and present results of our experiments on a publicly available insider threat dataset.

The development of Unmanned Aerial Vehicles (UAV) and wireless sensor network (WSN) applications depends on the availability of resources in UAVs and sensor nodes. In traditional applications, UAVs obtain the required data from specific sensors. However, this tightly coupled architecture restricts the usage of the infrastructure for specific applications. This paper proposes a softwarization architecture for UAVs and WSNs. In addition, the higher layers are proposed to be part of the cloud to benefit from the various cloud opportunities. The proposed architecture is based on the network softwarization concept and the Software Defined Networks (SDN) concept along with the Network Functional Virtualization (NFV) technologies. These concepts are associated with decoupling the hardware infrastructure from the control layer that virtualizes the infrastructure resources for the higher layers. The architecture is illustrated with an agricultural example for a cooperative system of a WSN and UAVs. We implement a prototype system that consists of a sensing node, UAV, WSN controller, UAV controller, and orchestration layer to provide a proof of concept for the proposed architecture.

Culprits’ identification by the means of suspicious pattern detection techniques from mobile device data is one of the most important aims of the mobile forensic data analysis. When criminal activities are related to entirely automated procedures such as malware propagation, predicting the corresponding behavior is a rather achievable task. However, when human behavior is involved, such as in cases of traditional crimes, prediction and detection become more compelling. This paper introduces a combined criminal profiling and suspicious pattern detection methodology for two criminal activities with moderate to the heavy involvement of mobile devices, cyberbullying and low-level drug dealing. Neural and Neurofuzzy techniques are applied on a hybrid original and simulated dataset. The respective performance results are measured and presented, the optimal technique is selected, and the scenarios are re-run on an actual dataset for additional testing and verification.

In the Internet age, cyber-attacks occur frequently with complex types. Traffic generated by access activities can record website status and user request information, which brings a great opportunity for network attack detection. Among diverse network protocols, Hypertext Transfer Protocol (HTTP) is widely used in government, organizations and enterprises. In this work, we propose DeepHTTP, a semantics structure integration model utilizing Bidirectional Long Short-TermMemory (Bi-LSTM) with attention mechanism to model HTTP traffic as a natural language sequence. In addition to extracting traffic content information, we integrate structural information to enhance the generalization capabilities of the model. Moreover, the application of attention mechanism can assist in discovering critical parts of anomalous traffic and furthermining attack patterns. Additionally, we demonstrate how to incrementally update the data set and retrain model so that it can be adapted to new anomalous traffic. Extensive experimental evaluations over large traffic data have illustrated that DeepHTTP has outstanding performance in traffic detection and pattern discovery.

Software-defined networking (SDN) has generated tremendous interest from both academia and industry. SDN aims at simplifying network management while enabling researchers to experiment with network protocols on deployed networks. This article is a distillation of the state of the art of SDN in the context of wireless networks. We present an overview of the major design trends and highlight key differences between them.

Malware is coined as an instance of malicious code that has the potential to harm a computer or network. Recent years have encountered massive growth in malwares as existing signature based malware detection approaches are becoming ineffective and intractable. Cyber criminals and malware developers have adapted code obfuscation techniques which undermines the effectiveness of malware defense mechanism. Hence we propounded a system which focuses on static analysis in addition with automated behavior analysis in emulated environment generating behavior reports to investigate malwares. The proposed method uses programs as opcode density histograms and reduces the explosion of features. We employed eigen vector subspace analysis to filter and diminish the misclassification and interference of features. Our system uses a hybrid approach for discovering malware based on support vector machine classifier so that potential of malware detection system can be leveraged to combat with diverse forms of malwares while attaining high accuracy and low false alarms. Keywords—Behavior Analysis, Static Analysis, Opcode Extraction, Malware Detection, Support Vector Machine.

With the development of incipient technologies, user devices becoming more exposed and ill-used by foes. In upcoming decades, traditional security measures will not be sufficient enough to handle this huge threat towards distributed hardware and software. Lack of standard network attack taxonomy has become an indispensable dispute on developing a clear understanding about the attacks in order to have an operative protection mechanism. Present attack categorization techniques protect a specific group of threat which has either messed the entire taxonomy structure or ambiguous when one network attacks get blended with few others attacks. Hence, this raises concerns about developing a common and general purpose taxonomy. In this study, a sequential question-answer based model of categorization is proposed. In this article, an intrusion detection framework and threat grouping schema are proposed on the basis of four sequential questions (“Who”, “Where”, “How” and “What”). We have used our method for classifying traditional network attacks in order to identify initiator, source, attack style and seriousness of an attack. Another focus of the paper is to provide a preventive list of actions for network administrator as a guideline to reduce overall attack consequence. Recommended taxonomy is designed to detect common attacks rather than any particular type of attack which can have a practical effect in real life attack classification. From the analysis of the classifications obtained from few infamous attacks, it is obvious that the proposed system holds certain benefits related to the prevailing taxonomies. Future research directions have also been well acknowledged.

With the growth of networked computers and associated applications, intrusion detection has become essential to keeping networks secure. A number of intrusion detection methods have been developed for protecting computers and networks using conventional statistical methods as well as data mining methods. Data mining methods for misuse and anomaly-based intrusion detection, usually encompass supervised, unsupervised and outlier methods. It is necessary that the capabilities of intrusion detection methods be updated with the creation of new attacks. This paper proposes a multi-level hybrid intrusion detection method that uses a combination of supervised, unsupervised and outlierbased methods for improving the efficiency of detection of new and old attacks. The method is evaluated with a captured real-time flow and packet dataset called the Tezpur University intrusion detection system (TUIDS) dataset, a distributed denial of service dataset, and the benchmark intrusion dataset called the knowledge discovery and data mining Cup 1999 dataset and the new version of KDD (NSL-KDD) dataset. Experimental results are compared with existing multi-level intrusion detection methods and other classifiers. The performance of our method is very good.

A wide range of malicious activities rely on the domain name service (DNS) to manage their large, distributed networks of infected machines. As a consequence, the monitoring and analysis of DNS queries has recently been proposed as one of the most promising techniques to detect and blacklist domains involved in malicious activities (e.g., phishing, spam, botnets command-and-control, etc.). EXPOSURE is a system we designed to detect such domains in real time, by applying 15 unique features grouped in four categories.
 We conducted a controlled experiment with a large, real-world dataset consisting of billions of DNS requests. The extremely positive results obtained in the tests convinced us to implement our techniques and deploy it as a free, online service. In this article, we present the Exposure system and describe the results and lessons learned from 17 months of its operation. Over this amount of time, the service detected over 100K malicious domains. The statistics about the time of usage, number of queries, and target IP addresses of each domain are also published on a daily basis on the service Web page.

Android is arguably the most widely used mobile operating system in the world. Due to its widespead use and huge user base, it has attracted a lot of attention from the unsavory crowd of malware writers. Traditionally, techniques to counter such malicious software involved manually analyzing code and figuring out whether it was malicious or benign. However, due to the immense pace at which newer malware families are surfacing, such an approach is no longer feasible. Machine learning offers a way to tackle this issue of speed by automating the classification task. While several efforts have been made to use traditional machine learning techniques to Android malware detection, no reasonable effort has been made to utilize the newer, deep learning models in this domain. In this paper, we apply several deep learning models including fully connected, convolutional and recurrent neural networks as well as autoencoders and deep belief networks to detect Android malware from a large scale dataset of more than 55 GBs of Android malware. Further, we apply Bayesian machine learning to this problem domain to see how it fares with the deep learning based models while also providing insights into the dataset. We show that we are able to achieve better results using these models as compared to the state-of-the-art approaches. Our best model gets an F1 score of 0.986 with an AUC of 0.983 as compared to the existing best F1 score of 0.875 and AUC of 0.953.


Question: Identifying distributed denial of service assaults through machine learning techniques in software-defined networks.

An In-depth Examination of Software-Defined Networking: A Paradigm Shift for a Connected World
In the digital age, the Internet has woven a global tapestry of interconnected devices, enabling universal access and unprecedented connectivity. Yet, traditional IP networks, despite their ubiquity, are plagued by complexity and inefficiency, posing significant challenges in management and adaptability. Configuring networks to adhere to predefined policies and dynamically reconfiguring them in response to faults, traffic load, or system changes are tasks fraught with difficulty. Compounding these issues, current networks are vertically integrated, with the control and data planes inextricably intertwined. This rigidity hinders the evolution of networking paradigms. Software-Defined Networking (SDN) emerges as a transformative concept designed to rectify these shortcomings. By decoupling the network's control logic from the underlying hardware, promoting logical centralization, and enabling programmability, SDN heralds a new era of network flexibility. The separation of concerns between network policy definition, hardware implementation, and traffic forwarding is pivotal to SDN's promise of simplifying network management and accelerating network innovation. This paper offers an exhaustive exploration of SDN, delving into its motivations, core principles, and how it diverges from conventional networking paradigms. We trace its origins, survey standardization efforts, and dissect the SDN infrastructure layer by layer. We scrutinize the hardware ecosystem, southbound and northbound APIs, network virtualization, SDN controllers, programming languages, and applications, alongside cross-layer issues like debugging and troubleshooting. We also forecast the future trajectory of SDN research, emphasizing switch design, control platforms, and the pursuit of resiliency, scalability, performance, security, and dependability. We explore the potential of SDN in carrier transport networks and cloud services, underscoring its role as a pivotal enabler for software-defined infrastructures.

Ensuring the security of computers is a non-trivial task, with many techniques used by malicious users to compromise these systems. In recent years a new threat has emerged in the form of networks of hijacked zombie machines used to perform complex distributed attacks such as denial of service and to obtain sensitive data such as password information. These zombie machines are said to be infected with a dasiahotpsila - a malicious piece of software which is installed on a host machine and is controlled by a remote attacker, termed the dasiabotmaster of a botnetpsila. In this work, we use the biologically inspired dendritic cell algorithm (DCA) to detect the existence of a single hot on a compromised host machine. The DCA is an immune-inspired algorithm based on an abstract model of the behaviour of the dendritic cells of the human body. The basis of anomaly detection performed by the DCA is facilitated using the correlation of behavioural attributes such as keylogging and packet flooding behaviour. The results of the application of the DCA to the detection of a single hot show that the algorithm is a successful technique for the detection of such malicious software without responding to normally running programs.

Managing resources in dynamic vehicular environments is a tough task, which is becoming more challenging with the increased number of access technologies today available in connected cars (e.g., IEEE 802.11, LTE), in the variety of applications provided on the road (e.g., safety, traffic efficiency, and infotainment), in the amount of driving awareness/coordination required (e.g., local, context, and cooperative awareness), and in the level of automation toward zero-accident driving (e.g., platooning and autonomous driving). The open programmability and logically centralized control features of the software–defined networking (SDN) paradigm offer an attractive means to manage communication and networking resources in the vehicular environment and promise improved performance. In this paper, we enumerate the potentials of software-defined vehicular networks, analyze the need to rethink the traditional SDN approach from theoretical and practical standpoints when applied in this application context, and present an emulation approach based on the proposed node car architecture in Mininet-WiFi to showcase the applicability and some expected benefits of SDN in a selected use case scenario.

Network intrusion detection systems are faced with the challenge of identifying diverse attacks, in extremely high speed networks. For this reason, they must operate at multi-Gigabit speeds, while performing highly-complex per-packet and per-flow data processing. In this paper, we present a multi-parallel intrusion detection architecture tailored for high speed networks. To cope with the increased processing throughput requirements, our system parallelizes network traffic processing and analysis at three levels, using multi-queue NICs, multiple CPUs, and multiple GPUs. The proposed design avoids locking, optimizes data transfers between the different processing units, and speeds up data processing by mapping different operations to the processing units where they are best suited. Our experimental evaluation shows that our prototype implementation based on commodity off-the-shelf equipment can reach processing speeds of up to 5.2 Gbit/s with zero packet loss when analyzing traffic in a real network, whereas the pattern matching engine alone reaches speeds of up to 70 Gbit/s, which is an almost four times improvement over prior solutions that use specialized hardware.

Traffic classification using machine learning continues to be an active research area. The majority of work in this area uses off-the-shelf machine learning tools and treats them as black-box classifiers. This approach turns all the modelling complexity into a feature selection problem. In this paper, we build a problem-specific solution to the traffic classification problem by designing a custom probabilistic graphical model. Graphical models are a modular framework to design classifiers which incorporate domain-specific knowledge. More specifically, our solution introduces semi-supervised learning which means we learn from both labelled and unlabelled traffic flows. We show that our solution performs competitively compared to previous approaches while using less data and simpler features.

Cryptovirological augmentations present an immediate, incomparable threat. Over the last decade, the substantial proliferation of crypto-ransomware has had widespread consequences for consumers and organisations alike. Established preventive measures perform well, however, the problem has not ceased. Reverse engineering potentially malicious software is a cumbersome task due to platform eccentricities and obfuscated transmutation mechanisms, hence requiring smarter, more efficient detection strategies. The following manuscript presents a novel approach for the classification of cryptographic primitives in compiled binary executables using deep learning. The model blueprint, a Dynamic Convolutional Neural Network (DCNN), is fittingly configured to learn from variable-length control flow diagnostics output from a dynamic trace. To rival the size and variability of equivalent datasets, and to adequately train our model without risking adverse exposure, a methodology for the procedural generation of synthetic cryptographic binaries is defined, using core primitives from OpenSSL with multivariate obfuscation, to draw a vastly scalable distribution. The library, CryptoKnight, rendered an algorithmic pool of AES, RC4, Blowfish, MD5 and RSA to synthesise combinable variants which automatically fed into its core model. Converging at 96% accuracy, CryptoKnight was successfully able to classify the sample pool with minimal loss and correctly identified the algorithm in a real-world crypto-ransomware application.

Software-Defined Networking (SDN) is transforming the networking ecosystem. SDN allows network operators to easily and quickly introduce new services and flexibly adapt to their requirements, while simplifying the network management to reduce the cost of operation, maintenance and deployment. On the other hand, mobility is a key aspect for the future mobile networks. In this context, Distributed Mobility Management (DMM) has been recently introduced as a new trend to overcome the limitations of the today's mobility management protocols which are highly centralized and hierarchical. Driven from the fact that DMM and SDN share the same principle in which the data and control plane are decoupled, we propose a DMM solution based on SDN architecture called S-DMM. This solution offers a lot of advantages including no need to deploy any mobility-related component at the access router, independence of the underlying technologies, and per-flow mobility support. On one hand, the numerical results prove that S-DMM is more scalable than the legacy DMM. On the other hand, the experiment results from a real implementation show that S-DMM comes at no performance penalty (in terms of handover latency and end-to-end delay) compared to legacy DMM, yet at a slightly better management cost, which makes S-DMM a promising candidate for a mobility management solution in the context of 5G networks.

In these days an increasing number of public and commercial services are used through the Internet, so that security of information becomes more important issue in the society information Intrusion Detection System (IDS) used against attacks for protected to the Computer networks. On another way, some data mining techniques also contribute to intrusion detection. Some data mining techniques used for intrusion detection can be classified into two classes: misuse intrusion detection and anomaly intrusion detection. Misuse always refers to known attacks and harmful activities that exploit the known sensitivity of the system. Anomaly generally means a generally activity that is able to indicate an intrusion. In this paper, comparison made between 23 related papers of using data mining techniques for intrusion detection. Our work provide an overview on data mining and soft computing techniques such as Artificial Neural Network (ANN), Support Vector Machine (SVM) and Multivariate Adaptive Regression Spline (MARS), etc. In this paper comparison shown between IDS data mining techniques and tuples used for intrusion detection. In those 23 related papers, 7 research papers use ANN and 4 ones use SVM, because of ANN and SVM are more reliable than other models and structures. In addition, 8 researches use the DARPA1998 tuples and 13 researches use the KDDCup1999, because the standard tuples are much more credible than others. There is no best intrusion detection model in present time. However, future research directions for intrusion detection should be explored in this paper. Keywords— intrusion detection, data mining, ANN

In recent years, there are more and more abnormal activities in the network, which greatly threaten network security. Hence, it is of great importance to collect the data which indicate the running statement of the network, and distinguish the anomaly phenomena of the network in time. In this paper, we propose a novel anomaly network traffic detection algorithm under the cloud computing environment. Firstly, the framework of the anomaly network traffic detection system is illustrated, and six type of network traffic features are consider in this work, that is, (1) number of source IP address, (2) number of source port number, (3) number of destination IP address, (4) number of destination port number, (5) Number of packet type, and (6) number of network packets. Secondly, we propose a novel hybrid information entropy and SVM model to tackle the proposed problem by normalizing values of network features and exploiting SVM detect anomaly network behaviors. Finally, experimental results demonstrate that the proposed algorithm can detect anomaly network traffic with high accuracy and it can also be used in the large scale dataset.

Two of the major challenges in designing anomaly intrusion detection are to maximize detection accuracy and to minimize false alarm rate. In addressing this issue, this paper proposes an ensemble of one-class classifiers where each adopts different learning paradigms. The techniques deployed in this ensemble model are; Linear Genetic Programming (LGP), Adaptive Neural Fuzzy Inference System (ANFIS) and Random Forest (RF). The strengths from the individual models were evaluated and ensemble rule was formulated. Prior to classification, a 2-tier feature selection process was performed to expedite the detection process. Empirical results show an improvement in detection accuracy for all classes of network traffic; Normal, Probe, DoS, U2R and R2L. Random Forest, which is an ensemble learning technique that generates many classification trees and aggregates the individual result was also able to address imbalance dataset problem that many of machine learning techniques fail to sufficiently address it.

The tasks of IDS is to detect activities in the form of intrusion by unauthorized parties which attempt to gain access to information unlawfully in a network environment. Changes in intrusion strategies affect the behavior of networks where the representation of network traffic data changes over time. The nature of the network data has high volume and dimension and contains redundancy. This study proposes the use of ChiMIC as a method to reduce redundancy features and select the relevant features to be used in detecting anomalies on the network, where KGS is used as an anomaly detection engine. Both approach are used to build NAIDS that has capabilities to detect the emergence of new attacks over time.


Question: Identifying distributed denial of service assaults through machine learning techniques in software-defined network environments.

This paper explores the potential of Software Defined Networking (SDN) for enhancing security in home and small office/home office (SOHO) networks, which are often neglected in terms of security management. With SDN, network security issues can be more effectively detected and contained. We demonstrate how four leading traffic anomaly detection algorithms can be adapted to the SDN paradigm, using OpenFlow-compatible switches and the NOX controller. Our experimental results highlight that these algorithms significantly outperform traditional methods in identifying malicious activities in home networks, compared to the ISP level. Moreover, the efficiency of our SDN-based anomaly detection systems on a programmable home network router reveals that they can operate at line rates without imposing any performance overhead on the network traffic, thereby showcasing the benefits of SDN in improving security in underserved network environments.

The constant increase of attacks against networks and their resources (as recently shown by the CodeRed worm) causes a necessity to protect these valuable assets. Firewalls are now a common installation to repel intrusion attempts in the first place. Intrusion detection systems (IDS), which try to detect malicious activities instead of preventing them, offer additional protection when the first defense perimeter has been penetrated. ID systems attempt to pin down attacks by comparing collected data to predefined signatures known to be malicious (signature based) or to a model of legal behavior (anomaly based).Anomaly based systems have the advantage of being able to detect previously unknown attacks but they suffer from the difficulty to build a solid model of acceptable behavior and the high number of alarms caused by unusual but authorized activities. We present an approach that utilizes application specific knowledge of the network services that should be protected. This information helps to extend current, simple network traffic models to form an application model that allows to detect malicious content hidden in single network packets. We describe the features of our proposed model and present experimental data that underlines the efficiency of our systems.

This chapter examines the state of modern intrusion detection, with a particular emphasis on the emerging approach of data mining. The discussion paralleIs two important aspects of intrusion detection: general detection strategy (misuse detection versus anomaly detection) and data source (individual hosts versus network trafik). Misuse detection attempts to match known patterns of intrusion , while anomaly detection searches for deviations from normal behavior . Between the two approaches, only anomaly detection has the ability to detect unknown attacks. A particularly promising approach to anomaly detection combines association mining with other forms of machine learning such as classification. Moreover, the data source that an intrusion detection system employs significantly impacts the types of attacks it can detect. There is a tradeoff in the level of detailed information available verD. Barbará et al. (ed .), Applications of Data Mining in Computer Security © Kluwer Academic Publishers 2002 s

The dependency of our society on networked computers has become frightening: In the economy, all-digital networks have turned from facilitators to drivers; as cyber-physical systems are coming of age, computer networks are now becoming the central nervous systems of our physical world—even of highly critical infrastructures such as the power grid. At the same time, the 24/7 availability and correct functioning of networked computers has become much more threatened: The number of sophisticated and highly tailored attacks on IT systems has significantly increased. Intrusion Detection Systems (IDSs) are a key component of the corresponding defense measures; they have been extensively studied and utilized in the past. Since conventional IDSs are not scalable to big company networks and beyond, nor to massively parallel attacks, Collaborative IDSs (CIDSs) have emerged. They consist of several monitoring components that collect and exchange data. Depending on the specific CIDS architecture, central or distributed analysis components mine the gathered data to identify attacks. Resulting alerts are correlated among multiple monitors in order to create a holistic view of the network monitored. This article first determines relevant requirements for CIDSs; it then differentiates distinct building blocks as a basis for introducing a CIDS design space and for discussing it with respect to requirements. Based on this design space, attacks that evade CIDSs and attacks on the availability of the CIDSs themselves are discussed. The entire framework of requirements, building blocks, and attacks as introduced is then used for a comprehensive analysis of the state of the art in collaborative intrusion detection, including a detailed survey and comparison of specific CIDS approaches.

Intrusion detection is a surveillance problem of practical import that is well suited to wireless sensor networks. In this paper, we study the application of sensor networks to the intrusion detection problem and the related problems of classifying and tracking targets. Our approach is based on a dense, distributed, wireless network of multi-modal resource-poor sensors combined into loosely coherent sensor arrays that perform in situ detection, estimation, compression, and exfiltration. We ground our study in the context of a security scenario called “A Line in the Sand” and accordingly define the target, system, environment, and fault models. Based on the performance requirements of the scenario and the sensing, communication, energy, and computation ability of the sensor network, we explore the design space of sensors, signal processing algorithms, communications, networking, and middleware services. We introduce the influence field, which can be estimated from a network of binary sensors, as the basis for a novel classifier. A contribution of our work is that we do not assume a reliable network; on the contrary, we quantitatively analyze the effects of network unreliability on application performance. Our work includes multiple experimental deployments of over 90 sensors nodes at MacDill Air Force Base in Tampa, Florida, as well as other field experiments of comparable scale. Based on these experiences, we identify a set of key lessons and articulate a few of the challenges facing extreme scaling to tens or hundreds of thousands of sensor nodes.

A botnet is a network of compromised computers infected with malicious code that can be controlled remotely under a common command and control (C&C) channel. As one the most serious security threats to the Internet, a botnet cannot only be implemented with existing network applications (e.g. IRC, HTTP, or Peer-to-Peer) but also can be constructed by unknown or creative applications, thus making the botnet detection a challenging problem. In this paper, we propose a new online botnet traffic classification system, called BotCop, in which the network traffic are fully classified into different application communities by using payload signatures and a novel decision tree model, and then on each obtained application community, the temporal-frequent characteristic of flows is studied and analyzed to differentiate the malicious communication traffic created by bots from normal traffic generated by human beings. We evaluate our approach with about 30 million flows collected over one day on a large-scale WiFi ISP network and results show that the proposed approach successfully detects an IRC botnet from about 30 million flows with a high detection rate and a low false alarm rate.

Internet traffic identification is an important tool for network management. It allows operators to better predict future traffic matrices and demands, security personnel to detect anomalous behavior, and researchers to develop more realistic traffic models. We present here a traffic classifier that can achieve a high accuracy across a range of application types without any source or destination host-address or port information. We use supervised machine learning based on a Bayesian trained neural network. Though our technique uses training data with categories derived from packet content, training and testing were done using features derived from packet streams consisting of one or more packet headers. By providing classification without access to the contents of packets, our technique offers wider application than methods that require full packet/payloads for classification. This is a powerful advantage, using samples of classified traffic to permit the categorization of traffic based only upon commonly available information

As more software modules and external interfaces are getting added on vehicles, new attacks and vulnerabilities are emerging. Researchers have demonstrated how to compromise in-vehicle Electronic Control Units (ECUs) and control the vehicle maneuver. To counter these vulnerabilities, various types of defense mechanisms have been proposed, but they have not been able to meet the need of strong protection for safety-critical ECUs against in-vehicle network attacks. To mitigate this deficiency, we propose an anomaly-based intrusion detection system (IDS), called Clock-based IDS (CIDS). It measures and then exploits the intervals of periodic in-vehicle messages for fingerprinting ECUs. The thusderived fingerprints are then used for constructing a baseline of ECUs’ clock behaviors with the Recursive Least Squares (RLS) algorithm. Based on this baseline, CIDS uses Cumulative Sum (CUSUM) to detect any abnormal shifts in the identification errors — a clear sign of intrusion. This allows quick identification of in-vehicle network intrusions with a low false-positive rate of 0.055%. Unlike state-of-the-art IDSs, if an attack is detected, CIDS’s fingerprinting of ECUs also facilitates a rootcause analysis; identifying which ECU mounted the attack. Our experiments on a CAN bus prototype and on real vehicles have shown CIDS to be able to detect a wide range of in-vehicle network attacks.

Network virtualization allows for an abstraction between user and physical resources by letting a given physical infrastructure to be shared by multiple service providers. However, network virtualization presents some challenges, such as, efficient resource management, fast provisioning and scalability. By separating a network's control logic from the underlying routers and switches, software defined networking (SDN) promises an unprecedented simplification in network programmability, management and innovation by service providers, and hence, its control model presents itself as a candidate solution to the challenges in network virtualization. In this paper, we use the SDN control plane to efficiently manage resources in virtualized networks by dynamically adjusting the virtual network (VN) to substrate network (SN) mappings based on network status. We extend an SDN controller to monitor the resource utilisation of VNs, as well as the average loading of SN links and switches, and use this information to proactively add or remove flow rules from the switches. Simulations show that, compared with three state-of-art approaches, our proposal improves the VN acceptance ratio by about 40% and reduces VN resource costs by over 10%.

Internet and internet users are increasing day by day. Also due to rapid development of internet technology , security is becoming big issue. Intruders are monitoring comput er network continuously for attacks. A sophisticated firewall with efficient intrusion detection system (IDS) is required to pre vent computer network from attacks. A comprehensive study of litera tures proves that data mining techniques are more powerful techni que to develop IDS as a classifier. Performance of classif ier is a crucial issue in terms of its efficiency, also number of fe ature to be scanned by the IDS should also be optimized. In thi s paper two techniques C5.0 and artificial neural network (ANN) ar e utilized with feature selection. Feature selection techniques will discard some irrelevant features while C5.0 and ANN acts as a classifier to classify the data in either normal type or one of t he five types of attack.KDD99 data set is used to train and test the models ,C5.0 model with numbers of features is producing better r sults with all most 100% accuracy. Performances were also verified in terms of data partition size.

In recent years, there are more and more abnormal activities in the network, which greatly threaten network security. Hence, it is of great importance to collect the data which indicate the running statement of the network, and distinguish the anomaly phenomena of the network in time. In this paper, we propose a novel anomaly network traffic detection algorithm under the cloud computing environment. Firstly, the framework of the anomaly network traffic detection system is illustrated, and six type of network traffic features are consider in this work, that is, (1) number of source IP address, (2) number of source port number, (3) number of destination IP address, (4) number of destination port number, (5) Number of packet type, and (6) number of network packets. Secondly, we propose a novel hybrid information entropy and SVM model to tackle the proposed problem by normalizing values of network features and exploiting SVM detect anomaly network behaviors. Finally, experimental results demonstrate that the proposed algorithm can detect anomaly network traffic with high accuracy and it can also be used in the large scale dataset.


Question: Identifying distributed denial of service assaults through machine learning techniques in software-defined networks.

This paper presents an innovative 4D network architecture, designed to address the inherent fragility and management challenges of contemporary data networks. It posits that the complexity of the control and management planes, specifically the intertwined nature of decision-making logic and distributed-systems issues, is at the core of these problems. To rectify this, the paper advocates for a radical redesign of network functionality, grounded in three foundational principles: network-level objectives, network-wide perspectives, and direct control mechanisms. These principles inform the development of the 4D architecture, characterized by its four distinct planes: decision, dissemination, discovery, and data. The 4D architecture decouples the decision logic of an autonomous system (AS) from the protocols that govern interactions among network elements. AS-level objectives are outlined in the decision plane and enforced through direct configuration of the state that directs packet forwarding in the data plane. Routers and switches in the 4D architecture operate solely on the instructions from the decision plane, facilitating packet forwarding and collecting measurement data to assist in network control. Despite the significant modifications to the control and management planes, the 4D architecture maintains the current format of data packets, simplifying its deployment and fostering innovation in network control and management. The exploration of this extreme design point is intended to galvanize the research and industrial sectors to concentrate on this critical and intellectually demanding field. However, this document does not directly address the detection of distributed denial of service (DDoS) attacks using machine learning algorithms in software-defined networks, but it does discuss the broader topic of network control and management, which is relevant to the context of managing and securing network operations.

This article presents the progressive evolution of NFV from the initial SDN-agnostic initiative to a fully SDN-enabled NFV solution, where SDN is not only used as infrastructure support but also influences how virtual network functions (VNFs) are designed. In the latest approach, when possible, stateless processing in the VNF shifts from the computing element to the networking element. To support these claims, the article presents the implementation of a flow-based network access control solution, with an SDN-enabled VNF built on IEEE 802.1x, which establishes services as sets of flow definitions that are authorized as the result of an end user authentication process. Enforcing the access to the network is done at the network element, while the authentication and authorization state is maintained at the compute element. The application of this proposal allows the performance to be enhanced, while traffic in the control channel is reduced to a minimum. The SDN-enabled NFV approach sets the foundation to increase the areas of application of NFV, in particular in those areas where massive stateless processing of packets is expected.

The growing interest in the Internet of Things (IoT) has resulted in a number of wide-area deployments of IoT subnetworks, where multiple heterogeneous wireless communication solutions coexist: from multiple access technologies such as cellular, WiFi, ZigBee, and Bluetooth, to multi-hop ad-hoc and MANET routing protocols, they all must be effectively integrated to create a seamless communication platform. Managing these open, geographically distributed, and heterogeneous networking infrastructures, especially in dynamic environments, is a key technical challenge. In order to take full advantage of the many opportunities they provide, techniques to concurrently provision the different classes of IoT traffic across a common set of sensors and networking resources must be designed. In this paper, we will design a software-defined approach for the IoT environment to dynamically achieve differentiated quality levels to different IoT tasks in very heterogeneous wireless networking scenarios. For this, we extend the Multinetwork INformation Architecture (MINA), a reflective (self-observing and adapting via an embodied Observe-Analyze-Adapt loop) middleware with a layered IoT SDN controller. The developed IoT SDN controller originally i) incorporates and supports commands to differentiate flow scheduling over task-level, multi-hop, and heterogeneous ad-hoc paths and ii) exploits Network Calculus and Genetic Algorithms to optimize the usage of currently available IoT network opportunities. We have applied the extended MINA SDN prototype in the challenging IoT scenario of wide-scale integration of electric vehicles, electric charging sites, smart grid infrastructures, and a wide set of pilot users, as targeted by the Artemis Internet of Energy and Arrowhead projects. Preliminary simulation performance results indicate that our approach and the extended MINA system can support efficient exploitation of the IoT multinetwork capabilities.

Software-defined networking (SDN) has generated tremendous interest from both academia and industry. SDN aims at simplifying network management while enabling researchers to experiment with network protocols on deployed networks. This article is a distillation of the state of the art of SDN in the context of wireless networks. We present an overview of the major design trends and highlight key differences between them.

Managing resources in dynamic vehicular environments is a tough task, which is becoming more challenging with the increased number of access technologies today available in connected cars (e.g., IEEE 802.11, LTE), in the variety of applications provided on the road (e.g., safety, traffic efficiency, and infotainment), in the amount of driving awareness/coordination required (e.g., local, context, and cooperative awareness), and in the level of automation toward zero-accident driving (e.g., platooning and autonomous driving). The open programmability and logically centralized control features of the software–defined networking (SDN) paradigm offer an attractive means to manage communication and networking resources in the vehicular environment and promise improved performance. In this paper, we enumerate the potentials of software-defined vehicular networks, analyze the need to rethink the traditional SDN approach from theoretical and practical standpoints when applied in this application context, and present an emulation approach based on the proposed node car architecture in Mininet-WiFi to showcase the applicability and some expected benefits of SDN in a selected use case scenario.

With the growth of networked computers and associated applications, intrusion detection has become essential to keeping networks secure. A number of intrusion detection methods have been developed for protecting computers and networks using conventional statistical methods as well as data mining methods. Data mining methods for misuse and anomaly-based intrusion detection, usually encompass supervised, unsupervised and outlier methods. It is necessary that the capabilities of intrusion detection methods be updated with the creation of new attacks. This paper proposes a multi-level hybrid intrusion detection method that uses a combination of supervised, unsupervised and outlierbased methods for improving the efficiency of detection of new and old attacks. The method is evaluated with a captured real-time flow and packet dataset called the Tezpur University intrusion detection system (TUIDS) dataset, a distributed denial of service dataset, and the benchmark intrusion dataset called the knowledge discovery and data mining Cup 1999 dataset and the new version of KDD (NSL-KDD) dataset. Experimental results are compared with existing multi-level intrusion detection methods and other classifiers. The performance of our method is very good.

In this paper, a new learning algorithm for adaptive network intrusion detection using naive Bayesian classifier and decision tree is presented, which performs balance detections and keeps false positives at acceptable level for different types of network attacks, and eliminates redundant attributes as well as contradictory examples from training data that make the detection model complex. The proposed algorithm also addresses some difficulties of data mining such as handling continuous attribute, dealing with missing attribute values, and reducing noise in training data. Due to the large volumes of security audit data as well as the complex and dynamic properties of intrusion behaviours, several data miningbased intrusion detection techniques have been applied to network-based traffic data and host-based data in the last decades. However, there remain various issues needed to be examined towards current intrusion detection systems (IDS). We tested the performance of our proposed algorithm with existing learning algorithms by employing on the KDD99 benchmark intrusion detection dataset. The experimental results prove that the proposed algorithm achieved high detection rates (DR) and significant reduce false positives (FP) for different types of network intrusions using limited computational resources.

SDN enables the administrators to configure network resources very quickly and to adjust network-wide traffic flow to meet changing needs dynamically. However, there are some challenges for implementing a full-scale carrier SDN. One of the most important challenges is SDN security, which is beginning to receive attention. With new SDN architecture, some security threats are common to traditional networking, but the profile of these threats (including their likelihood and impact and hence their overall risk level) changes. Moreover, there are some new security challenges such as bypassing predefined mandatory policies by overwriting flow entries and data eavesdropping by inserting fraudulent flow entries. This paper is to design open-flow specific security solutions and propose a comprehensive security architecture to provide security services such as enforcing mandatory network policy correctly and receiving network policy securely for SDN in order to solve these common security issues and new security challenges. It can also help the developers to implement security functions to provide security services when developing the SDN controller.

Wireless sensor networks (WSNs) are becoming increasingly popular with the advent of the Internet of things (IoT). Various real-world applications of WSNs such as in smart grids, smart farming and smart health would require a potential deployment of thousands or maybe hundreds of thousands of sensor nodes/actuators. To ensure proper working order and network efficiency of such a network of sensor nodes, an effective WSN management system has to be integrated. However, the inherent challenges of WSNs such as sensor/actuator heterogeneity, application dependency and resource constraints have led to challenges in implementing effective traditional WSN management. This difficulty in management increases as the WSN becomes larger. Software Defined Networking (SDN) provides a promising solution in flexible management WSNs by allowing the separation of the control logic from the sensor nodes/actuators. The advantage with this SDN-based management in WSNs is that it enables centralized control of the entire WSN making it simpler to deploy network-wide management protocols and applications on demand. This paper highlights some of the recent work on traditional WSN management in brief and reviews SDN-based management techniques for WSNs in greater detail while drawing attention to the advantages that SDN brings to traditional WSN management. This paper also investigates open research challenges in coming up with mechanisms for flexible and easier SDN-based WSN configuration and management.

Mobile security is an important issue on Android platform. Most malware detection methods based on machine learning models heavily rely on expert knowledge for manual feature engineering, which are still difficult to fully describe malwares. In this paper, we present LSTM-based hierarchical denoise network (HDN), a novel static Android malware detection method which uses LSTM to directly learn from the raw opcode sequences extracted from decompiled Android files. However, most opcode sequences are too long for LSTM to train due to the gradient vanishing problem. Hence, HDN uses a hierarchical structure, whose first-level LSTM parallelly computes on opcode subsequences (we called them method blocks) to learn the dense representations; then the secondlevel LSTM can learn and detect malware through method block sequences. Considering that malicious behavior only appears in partial sequence segments, HDN uses method block denoise module (MBDM) for data denoising by adaptive gradient scaling strategy based on loss cache. We evaluate and compare HDN with the latest mainstream researches on three datasets. The results show that HDN outperforms these Android malware detection methods,and it is able to capture longer sequence features and has better detection efficiency thanN-gram-based malware detection which is similar to our method.

As more software modules and external interfaces are getting added on vehicles, new attacks and vulnerabilities are emerging. Researchers have demonstrated how to compromise in-vehicle Electronic Control Units (ECUs) and control the vehicle maneuver. To counter these vulnerabilities, various types of defense mechanisms have been proposed, but they have not been able to meet the need of strong protection for safety-critical ECUs against in-vehicle network attacks. To mitigate this deficiency, we propose an anomaly-based intrusion detection system (IDS), called Clock-based IDS (CIDS). It measures and then exploits the intervals of periodic in-vehicle messages for fingerprinting ECUs. The thusderived fingerprints are then used for constructing a baseline of ECUs’ clock behaviors with the Recursive Least Squares (RLS) algorithm. Based on this baseline, CIDS uses Cumulative Sum (CUSUM) to detect any abnormal shifts in the identification errors — a clear sign of intrusion. This allows quick identification of in-vehicle network intrusions with a low false-positive rate of 0.055%. Unlike state-of-the-art IDSs, if an attack is detected, CIDS’s fingerprinting of ECUs also facilitates a rootcause analysis; identifying which ECU mounted the attack. Our experiments on a CAN bus prototype and on real vehicles have shown CIDS to be able to detect a wide range of in-vehicle network attacks.