Anomaly Detection in Encrypted Internet Traffic Using Hybrid Deep Learning

Bakhshi, Taimur; Ghita, Bogdan

doi:10.1155/2021/5363750

Cited by 18 publications

(13 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The experimental results showed that the proposed HNNIM model achieves the average accuracy of 89.28% on the multiclassification task, which was higher than other classifiers. Similar work was carried out by researchers in [26] by proposing a hybrid DL model to classify and detect enciphered network traffic. The CNN and gated recurrent unit (GRU) were used together for rapid feature extraction and learning.…”

Section: Deep Learning Based Techniquesmentioning

confidence: 80%

Encrypted Malware Detection Methodology without Decryption using Deep Learning based Approaches

Singh

2022

Preprint

View full text Add to dashboard Cite

The proportion of encrypted web traffic is rapidly increasing. The widespread use of encrypted traffic on the Internet provides safe and secure communication between users and servers. However, cybercriminals are also employing encrypted traffic to conceal their malicious activities. Malware detection in encrypted traffic is an arduous task for security professionals due to the complex nature of encrypted traffic on the web. Traditional approaches need to decrypt the content of network traffic, check it for threats, re-encrypt the network traffic content, and send it to the server. This solution compromises the integrity of encryption and the user’s privacy and safety. DL is currently the most effective AI technology that can reduce the manual determination of feature sets to improve classification accuracy. This paper proposes a methodology by using DL algorithms for malware detection in encrypted traffic without decryption. With this architecture, the user’s privacy is maintained, and the efficiency of detecting threats in encrypted traffic is enhanced. Three deep learning techniques, namely, multilayer perceptron (MLP), 1D convolutional neural network (1-D CNN), and long short-term memory (LSTM), are tested on the CTU-13 malware dataset, which comprises flow based features of network traffic. Experimental results show that MLP based approach outperforms 1-D CNN, LSTM, and other existing approaches.

show abstract

Section: Deep Learning Based Techniquesmentioning

confidence: 80%

Encrypted Malware Detection Methodology without Decryption using Deep Learning based Approaches

Singh

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Traditional machine learning techniques including Iterative Dichotomiser 3 (ID3), decision tree (C 5.0), classification and regression tree (CART), and artificial neural network (ANN) have been previously recommended to provide a measure of security for IoBNT biocyber interfaces [25,26]. Deep learning is a sub-field of traditional machine learning, providing increased flexibility and accuracy over classical learning algorithms, and offering the ability to incrementally learn and extrapolate new features from a limited set of training data [34,35]. Moreover, the thin and layered structure of sequential deep neural network models makes them ideal for being deployed over a low-powered and resource-constrained bio-cyber interface, still facilitating real-time anomaly detection.…”

Section: Deep-learning Enabled Traffic Analysismentioning

confidence: 99%

“…Convolutional neural network (CNN) is an extension of the traditional feed-forward neural network. CNN has been proven significantlyly successful in image processing tasks including object identification in robotics, and self-driven cars, and are now gaining traction in cyber security application particularly anomaly detection [32,[34][35][36]. Four main operations of CNN comprise of a convolution layer responsible for feature extraction, a non-linear activation function such as Rectified Linear Unit (ReLu) for fast(er) model learning, a pooling layer for generalization, and a fully connected layer (to be used for classification) [37].…”

Section: Deep-learning Enabled Traffic Analysismentioning

confidence: 99%

Hybrid Deep Learning Techniques for Securing Bioluminescent Interfaces in Internet of Bio Nano Things

Bakhshi,

Zafar

2023

Sensors

Self Cite

View full text Add to dashboard Cite

The Internet of bio-nano things (IoBNT) is an emerging paradigm employing nanoscale (~1–100 nm) biological transceivers to collect in vivo signaling information from the human body and communicate it to healthcare providers over the Internet. Bio-nano-things (BNT) offer external actuation of in-body molecular communication (MC) for targeted drug delivery to otherwise inaccessible parts of the human tissue. BNTs are inter-connected using chemical diffusion channels, forming an in vivo bio-nano network, connected to an external ex vivo environment such as the Internet using bio-cyber interfaces. Bio-luminescent bio-cyber interfacing (BBI) has proven to be promising in realizing IoBNT systems due to their non-obtrusive and low-cost implementation. BBI security, however, is a key concern during practical implementation since Internet connectivity exposes the interfaces to external threat vectors, and accurate classification of anomalous BBI traffic patterns is required to offer mitigation. However, parameter complexity and underlying intricate correlations among BBI traffic characteristics limit the use of existing machine-learning (ML) based anomaly detection methods typically requiring hand-crafted feature designing. To this end, the present work investigates the employment of deep learning (DL) algorithms allowing dynamic and scalable feature engineering to discriminate between normal and anomalous BBI traffic. During extensive validation using singular and multi-dimensional models on the generated dataset, our hybrid convolutional and recurrent ensemble (CNN + LSTM) reported an accuracy of approximately ~93.51% over other deep and shallow structures. Furthermore, employing a hybrid DL network allowed automated extraction of normal as well as temporal features in BBI data, eliminating manual selection and crafting of input features for accurate prediction. Finally, we recommend deployment primitives of the extracted optimal classifier in conventional intrusion detection systems as well as evolving non-Von Neumann architectures for real-time anomaly detection.

show abstract

“…Anomaly detection has been widely used in various fields, including cyber security [ 13 , 14 ], communications security [ 15 , 16 , 17 ], IoT [ 18 , 19 , 20 ], video surveillance [ 21 , 22 ], etc. In general, anomaly detection refers to finding special instances that differ from given normal instances.…”

Section: Introductionmentioning

confidence: 99%

“…Under these circumstances, it is more appropriate to view the surface defect detection problem as a semi-supervised anomaly detection problem. Anomaly detection has been widely used in various fields, including cyber security [13,14], communications security [15][16][17], IoT [18][19][20], video surveillance [21,22], etc. In general, anomaly detection refers to finding special instances that differ from given normal instances.…”

Section: Introductionmentioning

confidence: 99%

Dual Attention-Based Industrial Surface Defect Detection with Consistency Loss

Zheng

Chen

et al. 2022

Sensors

View full text Add to dashboard Cite

In industrial production, flaws and defects inevitably appear on surfaces, resulting in unqualified products. Therefore, surface defect detection plays a key role in ensuring industrial product quality and maintaining industrial production lines. However, surface defects on different products have different manifestations, so it is difficult to regard all defective products as being within one category that has common characteristics. Defective products are also often rare in industrial production, making it difficult to collect enough samples. Therefore, it is appropriate to view the surface defect detection problem as a semi-supervised anomaly detection problem. In this paper, we propose an anomaly detection method that is based on dual attention and consistency loss to accomplish the task of surface defect detection. At the reconstruction stage, we employed both channel attention and pixel attention so that the network could learn more robust normal image reconstruction, which could in turn help to separate images of defects from defect-free images. Moreover, we proposed a consistency loss function that could exploit the differences between the multiple modalities of the images to improve the performance of the anomaly detection. Our experimental results showed that the proposed method could achieve a superior performance compared to the existing anomaly detection-based methods using the Magnetic Tile and MVTec AD datasets.

show abstract

Anomaly Detection in Encrypted Internet Traffic Using Hybrid Deep Learning

Cited by 18 publications

References 41 publications

Encrypted Malware Detection Methodology without Decryption using Deep Learning based Approaches

Encrypted Malware Detection Methodology without Decryption using Deep Learning based Approaches

Hybrid Deep Learning Techniques for Securing Bioluminescent Interfaces in Internet of Bio Nano Things

Dual Attention-Based Industrial Surface Defect Detection with Consistency Loss

Contact Info

Product

Resources

About