TempoCode-IoT: temporal codebook-based encoding of flow features for intrusion detection in Internet of Things

Siddiqui, Abdul Jabbar; Boukerche, Azzedine

doi:10.1007/s10586-020-03153-8

Cited by 27 publications

(8 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In RACC (Mahdavi et al, 2020) (Real-time Alert Correlation based on Codebooks) codebooks correspond to attack scenarios that are mapped to incoming real-time alerts using matrix operations. TempoCode-IoT (Siddiqui and Boukerche, 2021) uses a flow function representation based on unsupervised learning of a temporal codebook that captures key patterns in data across different time windows. Cluster centers from each time window data are stored as codewords.…”

Section: Rule-based Modelsmentioning

confidence: 99%

“…• Rule-based correlation models -similarity rules (SimR) (Kotenko et al, 2020), causal rules (CauR) (Mahdavi et al, 2020;Siddiqui and Boukerche, 2021), composite rules (ComR) (Tao et al, 2021) and rule mining models (RM) (Xie et al, 2018;Bénard et al, 2021). • Semantic correlation models -signature language-based (SigL) (Almseidin et al, 2019;Tidjon et al, 2020), event embedding (EE) (Lee et al, 2021;Seyyar et al, 2022), and ontology learning (OL) (Zheng et al, 2018;Deng and Hooi, 2021) models.…”

Section: Summary Of Ai-based Security Event Correlation Modelsmentioning

confidence: 99%

See 1 more Smart Citation

A survey on artificial intelligence techniques for security event correlation: models, challenges, and opportunities

Gaifulina

Kotenko

2023

Artif Intell Rev

View full text Add to dashboard Cite

Information systems need to process a large amount of event monitoring data. The process of finding the relationships between events is called correlation, which creates a context between independent events and previously collected information in real time and normalizes it for subsequent processing. In cybersecurity, events can determine the steps of attackers and can be analyzed as part of a specific attack strategy. In this survey, we present the systematization of security event correlation models in terms of their representation in AI-based monitoring systems as: rule-based, semantic, graphical and machine learning based-models. We define the main directions of current research in the field of AI-based security event correlation and the methods used for the correlation of both single events and their sequences in attack scenarios. We also describe the prospects for the development of hybrid correlation models. In conclusion, we identify the existing problems in the field and possible ways to overcome them.

show abstract

Section: Rule-based Modelsmentioning

confidence: 99%

Section: Summary Of Ai-based Security Event Correlation Modelsmentioning

confidence: 99%

A survey on artificial intelligence techniques for security event correlation: models, challenges, and opportunities

Gaifulina

Kotenko

2023

Artif Intell Rev

View full text Add to dashboard Cite

show abstract

“…Siddiqui and Boukerche [62] have proposed a networkbased intrusion detection method which learns patterns of normal flows in a temporal codebook. Based on the temporally learnt codebook, they proposed a feature representation method to transform the flow-based statistical features into more discriminative representations, called TempoCode-IoT.…”

Section: Ids Solutions For Iotmentioning

confidence: 99%

A flow-based intrusion detection framework for internet of things networks

2021

View full text Add to dashboard Cite

The application of the Internet of Things concept in domains such as industrial control, building automation, human health, and environmental monitoring, introduces new privacy and security challenges. Consequently, traditional implementation of monitoring and security mechanisms cannot always be presently feasible and adequate due to the number of IoT devices, their heterogeneity and the typical limitations of their technical specifications. In this paper, we propose an IP flow-based Intrusion Detection System (IDS) framework to monitor and protect IoT networks from external and internal threats in real-time. The proposed framework collects IP flows from an IoT network and analyses them in order to monitor and detect attacks, intrusions, and other types of anomalies at different IoT architecture layers based on some flow features instead of using packet headers fields and their payload. The proposed framework was designed to consider both the IoT network architecture and other IoT contextual characteristics such as scalability, heterogeneity, interoperability, and the minimization of the use of IoT networks resources. The proposed IDS framework is network-based and relies on a hybrid architecture, as it involves both centralized analysis and distributed data collection components. In terms of detection method, the framework uses a specification-based approach drawn on normal traffic specifications. The experimental results show that this framework can achieve & 100% success and 0% of false positives in detection of intrusions and anomalies. In terms of performance and scalability in the operation of the IDS components, we study and compare it with three different conventional IDS (Snort, Suricata, and Zeek) and the results demonstrate that the proposed solution can consume fewer computational resources (CPU, RAM, and persistent memory) when compared to those conventional IDS.

show abstract

“…They demonstrated that RNNs are helpful to generate new, unseen mutants of attacks as well as synthetic signatures from the most advanced malware to improve the intrusion detection rate. The authors in [20] proposed a feature representation method to transform the raw flow-based statistical features into more discriminative representations and developed an ensemble of machine learning-based classifiers optimized to discriminate the malicious flows from the benign ones.…”

Section: Wireless Communications and Mobile Computingmentioning

confidence: 99%

LCHI: Low‐Order Correlation and High‐Order Interaction Integrated Model Oriented to Network Intrusion Detection

Lei

Xia

Wang

2021

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

Network intrusion poses a severe threat to the Internet of Things (IoT). Thus, it is essential to study information security protection technology in IoT. Learning sophisticated feature interactions is critical in improving detection accuracy for network intrusion. Despite significant progress, existing methods seem to have a strong bias towards single low- or high-order feature interaction. Moreover, they always extract all possible low-order interactions indiscriminately, introducing too much noise. To address the above problems, we propose a low-order correlation and high-order interaction (LCHI) integrated feature extraction model. First, we selectively extract the beneficial low-order correlation between the same-type features by the multivariate correlation analysis (MCA) model and attention mechanism. Second, we extract the complicated high-order feature interaction by the deep neural network (DNN) model. Finally, we emphasize both the low- and high-order feature interactions and incorporate them. Our LCHI model seamlessly combines the linearity of MCA in modeling lower-order feature correlation and the nonlinearity of DNN in modeling higher-order feature interaction. Conceptually, our LCHI is more expressive than the previous models. We carry on a series of experiments on the public wireless and wired network intrusion detection datasets. The experimental results show that LCHI improves 1.06%, 2.46%, 3.74%, 0.25%, 1.17%, and 0.64% on the AWID, NSL-KDD, UNSW-NB15, CICIDS 2017, CICIDS 2018, and DAPT 2020 datasets, respectively.

show abstract

TempoCode-IoT: temporal codebook-based encoding of flow features for intrusion detection in Internet of Things

Cited by 27 publications

References 32 publications

A survey on artificial intelligence techniques for security event correlation: models, challenges, and opportunities

A survey on artificial intelligence techniques for security event correlation: models, challenges, and opportunities

A flow-based intrusion detection framework for internet of things networks

LCHI: Low‐Order Correlation and High‐Order Interaction Integrated Model Oriented to Network Intrusion Detection

Contact Info

Product

Resources

About