Subspace Clustering for Interpretable Botnet Traffic Analysis

Araki, Shohei; Takahashi, Kneji; Hu, Bo; Kamiya, Kazunori; Tsuji, Masaki

doi:10.1109/icc.2019.8761218

Cited by 8 publications

(3 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[59], [60], [61], [62], [63], [64], [65], [66], [67], [68], [69], [70], [71], [72], [73], [74], [75], [76], [77], [78], [79], [80], [81], [82], [83], [84], [85], [86], [87], [88], [89], [90], [91], [92], [93], [94], [95], [96], [97], [98], [99] IM 5 3.0 % [100], [101], [102], [103], [104] NOMS 15 9.0 % [105], [106], [107], [108], [109], [110],…”

Section: Publication Venuesunclassified

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Dietz,

Mühlhauser,

Kögel

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Intrusion Detection Systems (IDS) tackle the challenging task of detecting network attacks as fast as possible. As this is getting more complex in modern enterprise networks, Artificial Intelligence (AI) and Machine Learning (ML) have gained substantial popularity in research. However, their adoption into real-world IDS solutions remains poor. Academic research often overlooks the interconnection of users and technical aspects. This leads to less explainable AI/ML models that hinder trust among AI/ML non-experts. Additionally, research often neglects secondary concerns such as usability and privacy. If IDS approaches conflict with current regulations or if administrators cannot deal with attacks more effectively, enterprises will not adopt the IDS in practice. To identify those problems systematically, our literature survey takes a user-centric approach; we examine IDS research from the perspective of stakeholders by applying the concept of personas. Further, we investigate multiple factors limiting the adoption of AI/ML in security and suggest technical, non-technical, and user-related considerations to enhance the adoption in practice. Our key contributions are threefold. (i) We derive personas from realistic enterprise scenarios, (ii) we provide a set of relevant hypotheses in the form of a review template, and (iii), based on our reviews, we derive design guidelines for practical implementations. To the best of our knowledge, this is the first paper that analyzes practical adoption barriers of AI/ML-based intrusion detection solutions concerning appropriateness of data, reproducibility, explainability, practicability, usability, and privacy. Our guidelines may help researchers to holistically evaluate their AI/ML-based IDS approaches to increase practical adoption.

show abstract

Section: Publication Venuesunclassified

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Dietz,

Mühlhauser,

Kögel

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Shohei et al [179] presented a novel two-step clustering approach based on DBSCAN to cluster botnets and classify their categories. Important features were represented and explained by combining subspace clustering and frequent pattern mining from 2 different real-world flow datasets: MAWI [180] and ISP.…”

Section: ) Botnetmentioning

confidence: 99%

Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research

et al. 2022

View full text Add to dashboard Cite

This survey presents a comprehensive review of current literature on Explainable Artificial Intelligence (XAI) methods for cyber security applications. Due to the rapid development of Internetconnected systems and Artificial Intelligence in recent years, Artificial Intelligence including Machine Learning (ML) and Deep Learning (DL) has been widely utilized in the fields of cyber security including intrusion detection, malware detection, and spam filtering. However, although Artificial Intelligence-based approaches for the detection and defense of cyber attacks and threats are more advanced and efficient compared to the conventional signature-based and rule-based cyber security strategies, most ML-based techniques and DL-based techniques are deployed in the ''black-box'' manner, meaning that security experts and customers are unable to explain how such procedures reach particular conclusions. The deficiencies of transparencies and interpretability of existing Artificial Intelligence techniques would decrease human users' confidence in the models utilized for the defense against cyber attacks, especially in current situations where cyber attacks become increasingly diverse and complicated. Therefore, it is essential to apply XAI in the establishment of cyber security models to create more explainable models while maintaining high accuracy and allowing human users to comprehend, trust, and manage the next generation of cyber defense mechanisms. Although there are papers reviewing Artificial Intelligence applications in cyber security areas and the vast literature on applying XAI in many fields including healthcare, financial services, and criminal justice, the surprising fact is that there are currently no survey research articles that concentrate on XAI applications in cyber security. Therefore, the motivation behind the survey is to bridge the research gap by presenting a detailed and up-to-date survey of XAI approaches applicable to issues in the cyber security field. Our work is the first to propose a clear roadmap for navigating the XAI literature in the context of applications in cyber security.

show abstract

“…They analyzed the effectiveness of the proposed framework in terms of energy and processing overheads within an IoT system. Authors in Reference 27 introduced bistep subspace bunching techniques. They initially grouped different botnets and afterward ordered them as per each host.…”

Section: Botnet Background and Literaturementioning

confidence: 99%

Ensemble Adaboost classifier for accurate and fast detection of botnet attacks in connected vehicles

Javed¹,

Jalil

Moqurrab

et al. 2020

Trans Emerging Tel Tech

View full text Add to dashboard Cite

The key characteristic of smart cities (ie, connectivity and intelligence) has enabled connected vehicles to work together to accomplish complex jobs that they are unable to perform individually. Connectivity not only being an inevitable blessing but also poses growing cybersecurity challenges for connected vehicles. The overall risk of connected vehicles is wide as the cybercriminals are nowadays applying versatile approaches (botnets, phishing, zero-days, rootkits, etc) to disrupt their communication. The botnet, capable of launching distributed denial of service attack, is a potential threat for any connected ecosystem due to its excessive capabilities of using maximum compromised devices. Hence, the detection of botnet attacks has become a pinnacle point for cybersecurity analysts. Existing studies lack in detecting botnet at the earliest and accurately. This article presents an approach to detect the botnet attacks at an early stage and accurately utilizing typical network traffic and temporal features. The proposed approach use machine learning algorithms for the detection of botnet attack(s) and present a detailed comparison of the decision tree, probabilistic neural network, sequential minimal optimization, and Adaboost classifiers, as well as comparison of the proposed approach with existing studies in this domain, is also done. Furthermore, it investigates the role of temporal features for botnet detection. The proposed approach accomplishes the promising true positive rate of 99.7%. Results show that our methodology is efficient compared with the existing studies. INTRODUCTIONThe concept of a smart city is primarily composed of information and communication technologies (ICT), to advance the quality of services such as connectivity, energy, transportation, and others. Especially in transportation the continuous vehicle to infrastructure (V2I), vehicle-to-sensors (V2S), vehicle-to-pedestrians, vehicle-to-vehicle (V2V) and the vehicle-to-cloud (V2C) services in smart cities are becoming essential for safety and nonsafety applications. Smart cities provide a channel to the driver, vehicle, infrastructure, and cloud to connect. 1,2 Smart cities produce a huge amount of data collected through IoT devices for further analysis that brings security issues with regard to communicating entities. [3][4][5][6][7] IoT devices (ie, smartphones, smartwatches, smart TV) have become a need of our daily lives. People around the globe are connected using personal smart devices and use them to perform many routine tasks daily. [8][9][10] Security in this current era of the connected world is most important as a single cyberattack can result in loss of important Abdul Rehman Javed and Zunera Jalil contributed equally to this study.

show abstract

Subspace Clustering for Interpretable Botnet Traffic Analysis

Cited by 8 publications

References 7 publications

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research

Ensemble Adaboost classifier for accurate and fast detection of botnet attacks in connected vehicles

Contact Info

Product

Resources

About