Nowadays, the pace of coordinated cyber security crimes has become drastically more rapid, and ne... more Nowadays, the pace of coordinated cyber security crimes has become drastically more rapid, and network attacks have become more advanced and diversified. The explosive growth of network security threats poses serious challenges for building secure Cyber-based Systems (CBS). Existing studies have addressed a breadth of challenges related to detecting network attacks. However, there is still a lack of studies on the detection of sophisticated Multi-stage Attacks (MSAs). The objective of this dissertation is to address the challenges of modeling and detecting sophisticated network attacks, such as multiple interleaved MSAs. We present the interleaving concept and investigate how interleaving multiple MSAs can deceive intrusion detection systems. Using one of the important statistical machine learning (ML) techniques, Hidden Markov Models (HMM), we develop three architectures that take into account the stealth nature of the interleaving attacks, and that can detect and track the progress of these attacks. These architectures deploy a set of HMM templates of known attacks and exhibit varying performance and complexity. For performance evaluation, various metrics are proposed which include (1) attack risk probability, (2) detection error rate, and (3) the number of correctly detected stages. Extensive simulation experiments are conducted to demonstrate the efficacy of the proposed architecture in the presence of multiple multi-stage attack scenarios, and in the presence of false alerts with various rates.
Transactions on Emerging Telecommunications Technologies
Opportunistic networks (OppNets) have attracted widespread attention as wireless technologies hav... more Opportunistic networks (OppNets) have attracted widespread attention as wireless technologies have advanced. OppNets are widely used in delay‐tolerant applications because they route messages using a store‐carry‐forward mechanism. Recently, socially aware routing has been increasingly modeled for message dissemination in OppNets, where the message is routed selectively through cooperative nodes based on user interests; however, routing becomes extremely difficult as node density and data size increase. However, the current method fails to reduce data redundancy, message overhead, delay, and improve performance efficiency. To address the issues, this article proposes social context‐aware microscopic routing (SCAMR) for OppNets. SCAMR uses cluster‐based communication, novel social‐context association mapping, and an improved lost packet retrieval mechanism with minimal messaging overhead. In this work, the experiment was performed by considering three scenarios: varying node size, var...
Nowadays, the pace of coordinated cyber security crimes has become drastically more rapid, and ne... more Nowadays, the pace of coordinated cyber security crimes has become drastically more rapid, and network attacks have become more advanced and diversified. The explosive growth of network security threats poses serious challenges for building secure Cyber-based Systems (CBS). Existing studies have addressed a breadth of challenges related to detecting network attacks. However, there is still a lack of studies on the detection of sophisticated Multi-stage Attacks (MSAs). The objective of this dissertation is to address the challenges of modeling and detecting sophisticated network attacks, such as multiple interleaved MSAs. We present the interleaving concept and investigate how interleaving multiple MSAs can deceive intrusion detection systems. Using one of the important statistical machine learning (ML) techniques, Hidden Markov Models (HMM), we develop three architectures that take into account the stealth nature of the interleaving attacks, and that can detect and track the progress of these attacks. These architectures deploy a set of HMM templates of known attacks and exhibit varying performance and complexity. For performance evaluation, various metrics are proposed which include (1) attack risk probability, (2) detection error rate, and (3) the number of correctly detected stages. Extensive simulation experiments are conducted to demonstrate the efficacy of the proposed architecture in the presence of multiple multi-stage attack scenarios, and in the presence of false alerts with various rates.
Transactions on Emerging Telecommunications Technologies
Opportunistic networks (OppNets) have attracted widespread attention as wireless technologies hav... more Opportunistic networks (OppNets) have attracted widespread attention as wireless technologies have advanced. OppNets are widely used in delay‐tolerant applications because they route messages using a store‐carry‐forward mechanism. Recently, socially aware routing has been increasingly modeled for message dissemination in OppNets, where the message is routed selectively through cooperative nodes based on user interests; however, routing becomes extremely difficult as node density and data size increase. However, the current method fails to reduce data redundancy, message overhead, delay, and improve performance efficiency. To address the issues, this article proposes social context‐aware microscopic routing (SCAMR) for OppNets. SCAMR uses cluster‐based communication, novel social‐context association mapping, and an improved lost packet retrieval mechanism with minimal messaging overhead. In this work, the experiment was performed by considering three scenarios: varying node size, var...
With the growing Cyber threats, the need to develop high assurance Cyber systems is becoming incr... more With the growing Cyber threats, the need to develop high assurance Cyber systems is becoming increasingly important. The objective of this paper is to address the challenges of modeling and detecting sophisticated and diversified network attacks. Using one of the important statistical machine learning (ML) techniques, Hidden Markov Models (HMM), we develop two architectures that can detect and track in real-time the progress of these organized attacks. These architectures are based on developing a database of HMM templates and exhibit varying performance and complexity. For performance evaluation, in the presence of multiple multi-stage attack scenarios, various metrics are proposed which include (1) attack risk probability, (2) detection error rate, and (3) the number of correctly detected stages. Extensive simulation experiments are used based on the DARPA2000 dataset to demonstrate the efficacy of the proposed architectures.
Uploads