A Hybrid Real-time Zero-day Attack Detection and Analysis System

Abstract

Abstract-A zero-day attack poses a serious threat to the Internet security as it exploits zero-day vulnerabilities in the computer systems. Attackers take advantage of the unknown nature of zero-day exploits and use them in conjunction with highly sophisticated and targeted attacks to achieve stealthiness with respect to standard intrusion detection techniques. Thus, it's difficult to defend against such attacks. Present research exhibits various issues and is not able to provide complete solution for the detection and analysis of zero-day attacks. This paper presents a novel hybrid system that integrates anomaly, behavior and signature based techniques for detecting and analyzing zero-day attacks in real-time. It has layered and modular design which helps to achieve high performance, flexibility and scalability. The system is implemented and evaluated against various standard metrics like True Positive Rate (TPR), False Positive Rate (FPR), FMeasure, Total Accuracy (ACC) and Receiver Operating Characteristic (ROC) curve. The result shows high detection rate with nearly zero false positives. Additionally, the proposed system is compared with Honeynet system.

Comparative Evaluation of AI-Based Techniques for Zero-Day Attacks Detection

“…The authors of Ref. [37] proposed a zero-day polymorphic worm attack framework for detecting polymorphic worms that are zero-day in nature by their behavior, anomaly, and signature-based techniques. Three layers, namely, analysis, detection, and resource, were used in the proposed architecture.…”

A robust intelligent zero-day cyber-attack detection technique

“…In [19], Moustafa et al have proposed an Outlier Dirichlet Mixture (ODM) based detection system for fog. In [20], authors have proposed an architecture to detect zeroday polymorphic worms attack using signature, behavior, and anomaly-based technique. The proposed architecture consists of three layers, namely: detection, analysis and resource layer.…”

A novel approach for phishing emails real time classifica-tion using k-means algorithm

“…The wrapper technique assumed an essential part in highlight determination, which prompts high precision contrasted with other examined static methodologies. Ratinder Kaur and Maninder Singh [10]has proposed novel hybrid framework that coordinates inconsistency for identifying and breaking down zero day attaks.the framework is actualized and assessed against different standard measurements True Positive Rate(TPR),False Positive Date(FPR), F-Measure, Total Accuracy(ACC) and Receiver Operating Characteristic(ROC).the outcome indicates high discovery rate with almost zero false positive.to guard against zero day attacks, the exploration group has proposed different procedures. There are partitioned into Statistical based, Signatured based, behavior based and Hybrid strategies.…”