Symmetry

Research

Jump to: Review

21 pages, 7609 KiB

Open AccessArticle

Real-Time Anomaly Detection of Network Traffic Based on CNN

by Haitao Liu and Haifeng Wang

Symmetry 2023, 15(6), 1205; https://doi.org/10.3390/sym15061205 - 4 Jun 2023

Cited by 4 | Viewed by 3657

Abstract

Network traffic anomaly detection mainly detects and analyzes abnormal traffic by extracting the statistical features of network traffic. It is necessary to fully understand the concept of symmetry in anomaly detection and anomaly mitigation. However, the original information on network traffic is easily [...] Read more.

Network traffic anomaly detection mainly detects and analyzes abnormal traffic by extracting the statistical features of network traffic. It is necessary to fully understand the concept of symmetry in anomaly detection and anomaly mitigation. However, the original information on network traffic is easily lost, and the adjustment of dynamic network configuration becomes gradually complicated. To solve this problem, we designed and realized a new online anomaly detection system based on software defined networks. The system uses the convolutional neural network to directly extract the original features of the network flow for analysis, which can realize online real- time packet extraction and detection. It utilizes SDN to flexibly adapt to changes in the network, allowing for a zero-configuration anomaly detection system. The packet filter of the anomaly detection system is used to automatically implement mitigation strategies to achieve online real-time mitigation of abnormal traffic. The experimental results show that the proposed method is more accurate and can warn the network manager in time that security measures can be taken, which fully demonstrates that the method can effectively detect abnormal traffic problems and improve the security performance of edge clustering networks. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

13 pages, 961 KiB

Open AccessArticle

Local Cluster-Aware Attention for Non-Euclidean Structure Data

by Ming Zhuo, Yunzhuo Liu, Leyuan Liu and Shijie Zhou

Symmetry 2023, 15(4), 837; https://doi.org/10.3390/sym15040837 - 31 Mar 2023

Viewed by 1491

Abstract

Meaningful representation of large-scale non-Euclidean structured data, especially in complex domains like network security and IoT system, is one of the critical problems of contemporary machine learning and deep learning. Many successful cases of graph-based models and algorithms deal with non-Euclidean structured data. [...] Read more.

Meaningful representation of large-scale non-Euclidean structured data, especially in complex domains like network security and IoT system, is one of the critical problems of contemporary machine learning and deep learning. Many successful cases of graph-based models and algorithms deal with non-Euclidean structured data. However, It is often undesirable to derive node representations by walking through the complete topology of a system or network (graph) when it has a very big or complicated structure. An important issue is using neighborhood knowledge to deduce the symmetric network’s topology or graph. The traditional approach to solving the graph representation learning issue is surveyed from machine learning and deep learning perspectives. Second, include local neighborhood data encoded to the attention mechanism to define node solidarity and enhance node capture and interactions. The performance of the proposed model is then assessed for transduction and induction tasks that include downstream node categorization. The attention model taking clustering into account has successfully equaled or reached the state-of-the-art performance of several well-established node classification benchmarks and does not depend on previous knowledge of the complete network structure, according to experiments. Following a summary of the research, we discuss problems and difficulties that must be addressed for developing future graph signal processing algorithms and graph deep learning models, such as graph embeddings’ interpretability and adversarial resilience. At the same time, it has a very positive impact on network security and artificial intelligence security. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

16 pages, 558 KiB

Open AccessArticle

Hybrid Intrusion Detection System Based on Combination of Random Forest and Autoencoder

by Chao Wang, Yunxiao Sun, Wenting Wang, Hongri Liu and Bailing Wang

Symmetry 2023, 15(3), 568; https://doi.org/10.3390/sym15030568 - 21 Feb 2023

Cited by 20 | Viewed by 2616

Abstract

To cope with the rising threats posed by network attacks, machine learning-based intrusion detection systems (IDSs) have been intensively researched. However, there are several issues that need to be addressed. It is difficult to deal with unknown attacks that do not appear in [...] Read more.

To cope with the rising threats posed by network attacks, machine learning-based intrusion detection systems (IDSs) have been intensively researched. However, there are several issues that need to be addressed. It is difficult to deal with unknown attacks that do not appear in the training set, and as a result, poor detection rates are produced for these unknown attacks. Furthermore, IDSs suffer from high false positive rate. As different models learn data characteristics from different perspectives, in this work we propose a hybrid IDS which leverages both random forest (RF) and autoencoder (AE). The hybrid model operates in two steps. In particular, in the first step, we utilize the probability output of the RF classifier to determine whether a sample belongs to attack. The unknown attacks can be identified with the assistance of the probability output. In the second step, an additional AE is coupled to reduce the false positive rate. To simulate an unknown attack in experiments, we explicitly remove some samples belonging to one attack class from the training set. Compared with various baselines, our suggested technique demonstrates a high detection rate. Furthermore, the additional AE detection module decreases the false positive rate. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

18 pages, 3603 KiB

Open AccessArticle

K-CTIAA: Automatic Analysis of Cyber Threat Intelligence Based on a Knowledge Graph

by Zong-Xun Li, Yu-Jun Li, Yi-Wei Liu, Cheng Liu and Nan-Xin Zhou

Symmetry 2023, 15(2), 337; https://doi.org/10.3390/sym15020337 - 25 Jan 2023

Cited by 10 | Viewed by 3464

Abstract

Cyber threat intelligence (CTI) sharing has gradually become an important means of dealing with security threats. Considering the growth of cyber threat intelligence, the quick analysis of threats has become a hot topic at present. Researchers have proposed some machine learning and deep [...] Read more.

Cyber threat intelligence (CTI) sharing has gradually become an important means of dealing with security threats. Considering the growth of cyber threat intelligence, the quick analysis of threats has become a hot topic at present. Researchers have proposed some machine learning and deep learning models to automatically analyze these immense amounts of cyber threat intelligence. However, due to a large amount of network security terminology in CTI, these models based on open-domain corpus perform poorly in the CTI automatic analysis task. To address this problem, we propose an automatic CTI analysis method named K-CTIAA, which can extract threat actions from unstructured CTI by pre-trained models and knowledge graphs. First, the related knowledge in knowledge graphs will be supplemented to the corresponding position in CTI through knowledge query and knowledge insertion, which help the pre-trained model understand the semantics of network security terms and extract threat actions. Second, K-CTIAA reduces the adverse effects of knowledge insertion, usually called the knowledge noise problem, by introducing a visibility matrix and modifying the calculation formula of the self-attention. Third, K-CTIAA maps corresponding countermeasures by using digital artifacts, which can provide some feasible suggestions to prevent attacks. In the test data set, the F1 score of K-CTIAA reaches 0.941. The experimental results show that K-CTIAA can improve the performance of automatic threat intelligence analysis and it has certain significance for dealing with security threats. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

15 pages, 2559 KiB

Open AccessArticle

Mission-Based Cybersecurity Test and Evaluation of Weapon Systems in Association with Risk Management Framework

by Ikjae Kim, Sungjoong Kim, Hansung Kim and Dongkyoo Shin

Symmetry 2022, 14(11), 2361; https://doi.org/10.3390/sym14112361 - 9 Nov 2022

Cited by 5 | Viewed by 2872

Abstract

With the advancement of information technology (IT), the importance of cyber security is increasing because of the expansion of software utilization in the development of weapon systems. Civilian embedded systems and military weapon systems have cybersecurity-related symmetry that can increase vulnerabilities in the [...] Read more.

With the advancement of information technology (IT), the importance of cyber security is increasing because of the expansion of software utilization in the development of weapon systems. Civilian embedded systems and military weapon systems have cybersecurity-related symmetry that can increase vulnerabilities in the process of advanced information technology. Many countries, including the United States, are exploring ways to improve cybersecurity throughout the lifecycle of a weapon system. The South Korean military is applying the U.S. standard risk management framework (RMF) to some weapon systems to improve cybersecurity, but the need for a model that is more suitable for the South Korean military has been emphasized. This paper presents the results of a mission-based cybersecurity test, along with an evaluation model that can be applied to South Korean military weapon systems in parallel with the RMF. This study first examined the related international research trends, and proposed a test and evaluation method that could be utilized with the RMF throughout the entire life cycle of a weapon system. The weapon system was divided into asset, function, operational task, and mission layers based on the mission, and a mutually complementary model was proposed by linking the RMF and cybersecurity test and evaluation according to the domestic situation. In order to verify the proposed cybersecurity test and evaluation model, a simulation was developed and performed targeting the Close Air Support (CAS) mission support system, which is a virtual weapon system. In this simulation, the nodes performances by layer before and after a cyberattack were calculated, and the vulnerabilities and protection measures identified in the cyber security test and evaluation were quantified. This simulation made it possible to evaluate and derive protection measures in consideration of mission performance. It is believed that the proposed model could be used with some modifications, depending on the circumstances of each country developing weapon systems in the future. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

15 pages, 1403 KiB

Open AccessArticle

NetDAO: Toward Trustful and Secure IoT Networks without Central Gateways

by Gang Liu, Chi-Yuan Chen, Jing-Yuan Han, Yi Zhou and Guo-Biao He

Symmetry 2022, 14(9), 1796; https://doi.org/10.3390/sym14091796 - 30 Aug 2022

Cited by 1 | Viewed by 1545

Abstract

The Internet of Things (IoT) suffers from a profound lack of trust between central gateways and sensors, e.g., gateways suspect sensors of flooding malicious packets, and vice versa, sensors suspect gateways of manipulating traffic data. One important reason for the mistrust is the [...] Read more.

The Internet of Things (IoT) suffers from a profound lack of trust between central gateways and sensors, e.g., gateways suspect sensors of flooding malicious packets, and vice versa, sensors suspect gateways of manipulating traffic data. One important reason for the mistrust is the asymmetry of a centralized network organization. A Decentralized Autonomous Organization (DAO) can establish a trustful and symmetric network with the blockchain. However, it is a vacant area for IoT networks to build trust between gateways and sensors within the DAO. In this paper, we firstly propose a trustful and secure IoT Network DAO solution (NetDAO) to mitigate the data manipulation and the malicious flooding packets. In particular, the NetDAO has a security rating algorithm to assign a reputation value for each entity in the network. Based on this, each entity can mitigate the malicious flooding packets using a proof-of-reputation packet-forwarding mechanism. In addition, the NetDAO stores traffic data using the blockchain to mitigate the data manipulation. The experimental results show that the NetDAO effectively mitigates malicious flooding packets and costs 1 s for ∼480 entities to complete the rating algorithm. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

11 pages, 432 KiB

Open AccessArticle

Raft-PLUS: Improving Raft by Multi-Policy Based Leader Election with Unprejudiced Sorting

by Jinjie Xu, Wei Wang, Yu Zeng, Zhiwei Yan and Hongtao Li

Symmetry 2022, 14(6), 1122; https://doi.org/10.3390/sym14061122 - 29 May 2022

Cited by 6 | Viewed by 3294

Abstract

Raft is a fast, scalable, understandable consensus algorithm widely used in distributed systems. The Leader handles client requests and interacts with other servers to reach a consensus, so a stable, reliable, and powerful Leader is crucial for the cluster. We designed a policy-based [...] Read more.

Raft is a fast, scalable, understandable consensus algorithm widely used in distributed systems. The Leader handles client requests and interacts with other servers to reach a consensus, so a stable, reliable, and powerful Leader is crucial for the cluster. We designed a policy-based voting mechanism to make the elected Leader as reliable as possible. In order to improve the asymmetric relationship between the Followers and Leader, we designed a mechanism to trigger a new round of the election actively so that the Leader node can actively transform into a Follower under certain conditions and enhance the symmetry between servers. Our proposed Raft-PLUS algorithm makes the elected Leader as reliable as possible through four election policies and designed three opposition policies to trigger a new round of the election. To verify the effectiveness of the Raft-PLUS algorithm, we configure different election and opposition policies on 12 servers to simulate the election and opposition process of the Leader and explain the process. To demonstrate the advantages of the Raft-PLUS algorithm, we built key-value stores based on Raft and Raft-PLUS, and we tested the performance of Raft-PLUS and the Raft algorithm in normal and abnormal states. Experimental results show that the Raft-PLUS algorithm has similar write throughput to the Raft algorithm under normal conditions. Regarding the quality of the Leader network changes, the average write throughput of the Raft-PLUS algorithm is 40% higher than that of the Raft algorithm. The Leader’s CPU usage fluctuated; the average write throughput of Raft-PLUS was 38% higher than Raft. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

Review

Jump to: Research

33 pages, 4228 KiB

Open AccessReview

Security Concepts in Emerging 6G Communication: Threats, Countermeasures, Authentication Techniques and Research Directions

by Syed Hussain Ali Kazmi, Rosilah Hassan, Faizan Qamar, Kashif Nisar and Ag Asri Ag Ibrahim

Symmetry 2023, 15(6), 1147; https://doi.org/10.3390/sym15061147 - 25 May 2023

Cited by 15 | Viewed by 5375

Abstract

Challenges faced in network security have significantly steered the deployment timeline of Fifth Generation (5G) communication at a global level; therefore, research in Sixth Generation (6G) security analysis is profoundly necessitated. The prerogative of this paper is to present a survey on the [...] Read more.

Challenges faced in network security have significantly steered the deployment timeline of Fifth Generation (5G) communication at a global level; therefore, research in Sixth Generation (6G) security analysis is profoundly necessitated. The prerogative of this paper is to present a survey on the emerging 6G cellular communication paradigm to highlight symmetry with legacy security concepts along with asymmetric innovative aspects such Artificial Intelligence (AI), Quantum Computing, Federated Learning, etc. We present a taxonomy of the threat model in 6G communication in five security legacy concepts, including Confidentiality, Integrity, Availability, Authentication and Access control (CIA³). We also suggest categorization of threat-countering techniques specific to 6G communication into three types: cryptographic methods, entity attributes and Intrusion Detection System (IDS). Thus, with this premise, we distributed the authentication techniques in eight types, including handover authentication, mutual authentication, physical layer authentication, deniable authentication, token-based authentication, certificate-based authentication, key agreement-based authentication and multi-factor authentication. We specifically suggested a series of future research directions at the conclusive edge of this survey. Full article

(This article belongs to the Special Issue The Study of Network Security and Symmetry)

► Show Figures

Figure 1

Journal Menu

Journal Browser

The Study of Network Security and Symmetry

Share This Special Issue

Special Issue Editors

Special Issue Information

Keywords

Published Papers (8 papers)

Research

Review

Further Information

Guidelines

MDPI Initiatives

Follow MDPI