The purpose of this research is to create a simulated environment for teaching algorithms,big data processing,and machine learning.The environment is similar to Google Maps,with the capacity of finding the fastest pat...The purpose of this research is to create a simulated environment for teaching algorithms,big data processing,and machine learning.The environment is similar to Google Maps,with the capacity of finding the fastest path between two points in dynamic traffic situations.However,the system is significantly simplified for educational purposes.Students can choose different traffic patterns and program a car to navigate through the traffic dynamically based on the changing traffic.The environments used in the project are Visual IoT/Robotics Programming Language Environment(VIPLE)and a traffic simulator developed in the Unity game engine.This paper focuses on creating realistic traffic data for the traffic simulator and implementing dynamic routing algorithms in VIPLE.The traffic data are generated from the recorded real traffic data published on the Arizona Maricopa County website.Based on the generated traffic data,VIPLE programs are developed to implement the traffic simulation with support for dynamic changing data.展开更多
Distributed Denial of Service (DDoS) attacks are performed from multiple agents towards a single victim. Essentially, all attacking agents generate multiple packets towards the victim to overwhelm it with requests, th...Distributed Denial of Service (DDoS) attacks are performed from multiple agents towards a single victim. Essentially, all attacking agents generate multiple packets towards the victim to overwhelm it with requests, thereby overloading the resources of the victim. Since it is very complex and expensive to conduct a real DDoS attack, most organizations and researchers result in using simulations to mimic an actual attack. The researchers come up with diverse algorithms and mechanisms for attack detection and prevention. Further, simulation is good practice for determining the efficacy of an intrusive detective measure against DDoS attacks. However, some mechanisms are ineffective and thus not applied in real life attacks. Nowadays, DDoS attack has become more complex and modern for most IDS to detect. Adjustable and configurable traffic generator is becoming more and more important. This paper first details the available datasets that scholars use for DDoS attack detection. The paper further depicts the a few tools that exist freely and commercially for use in the simulation programs of DDoS attacks. In addition, a traffic generator for normal and different types of DDoS attack has been developed. The aim of the paper is to simulate a cloud environment by OMNET++ simulation tool, with different DDoS attack types. Generation normal and attack traffic can be useful to evaluate developing IDS for DDoS attacks detection. Moreover, the result traffic can be useful to test an effective algorithm, techniques and procedures of DDoS attacks.展开更多
网络流量数据的高维复杂特性,使得生成对抗网络生成的网络流量数据质量较差。为了解决该问题,提出一种基于双生成器的条件映射生成对抗网络(a cGAN with projection discriminator based on double generators,PD-DcGAN)并将其应用于少...网络流量数据的高维复杂特性,使得生成对抗网络生成的网络流量数据质量较差。为了解决该问题,提出一种基于双生成器的条件映射生成对抗网络(a cGAN with projection discriminator based on double generators,PD-DcGAN)并将其应用于少数类流量增强。提出基于Gumbel-sigmoid分布的离散生成器,获得近似于离散数据的光滑可导分布生成离散特征,并将其与连续数据生成器并联运行,二者结果串联组合,获得数据整体分布情况;以内积形式融合条件信息和特征信息,克服传统方法出现假设空间增大的问题,缓解模型训练过程中的不稳定现象;在损失函数中引入梯度惩罚因子,将判别器梯度限定在一定范围内,有效缓解梯度爆炸。利用UNSW-NB15数据集,从生成样本质量和模型有效性两个角度检验模型性能。实验结果证明,与其他数据增强方法相比,PD-DcGAN在准确率、精确率、召回率和F1得分上分别平均提高2.72%、1.72%、1.87%和1.16%;与原始数据集相比,对难以检测的Analysis、Backdoors、Exploits、Shellcode和Worms等少数类流量检测性能提升明显,分别从不足1%分别提升至7.93%、6.53%、15.72%、14.02%和10.91%。展开更多
Detecting the anomalous entity in real-time network traffic is a popular area of research in recent times.Very few researches have focused on creating malware that fools the intrusion detection system and this paper f...Detecting the anomalous entity in real-time network traffic is a popular area of research in recent times.Very few researches have focused on creating malware that fools the intrusion detection system and this paper focuses on this topic.We are using Deep Convolutional Generative Adversarial Networks(DCGAN)to trick the malware classifier to believe it is a normal entity.In this work,a new dataset is created to fool the Artificial Intelligence(AI)based malware detectors,and it consists of different types of attacks such as Denial of Service(DoS),scan 11,scan 44,botnet,spam,User Datagram Portal(UDP)scan,and ssh scan.The discriminator used in the DCGAN discriminates two different attack classes(anomaly and synthetic)and one normal class.The model collapse,instability,and vanishing gradient issues associated with the DCGAN are overcome using the proposed hybrid Aquila optimizer-based Mine blast harmony search algorithm(AO-MBHS).This algorithm helps the generator to create realistic malware samples to be undetected by the discriminator.The performance of the proposed methodology is evaluated using different performance metrics such as training time,detection rate,F-Score,loss function,Accuracy,False alarm rate,etc.The superiority of the hybrid AO-MBHS based DCGAN model is noticed when the detection rate is changed to 0 after the retraining method to make the defensive technique hard to be noticed by the malware detection system.The support vector machines(SVM)is used as the malicious traffic detection application and its True positive rate(TPR)goes from 80%to 0%after retraining the proposed model which shows the efficiency of the proposed model in hiding the samples.展开更多
文摘The purpose of this research is to create a simulated environment for teaching algorithms,big data processing,and machine learning.The environment is similar to Google Maps,with the capacity of finding the fastest path between two points in dynamic traffic situations.However,the system is significantly simplified for educational purposes.Students can choose different traffic patterns and program a car to navigate through the traffic dynamically based on the changing traffic.The environments used in the project are Visual IoT/Robotics Programming Language Environment(VIPLE)and a traffic simulator developed in the Unity game engine.This paper focuses on creating realistic traffic data for the traffic simulator and implementing dynamic routing algorithms in VIPLE.The traffic data are generated from the recorded real traffic data published on the Arizona Maricopa County website.Based on the generated traffic data,VIPLE programs are developed to implement the traffic simulation with support for dynamic changing data.
文摘Distributed Denial of Service (DDoS) attacks are performed from multiple agents towards a single victim. Essentially, all attacking agents generate multiple packets towards the victim to overwhelm it with requests, thereby overloading the resources of the victim. Since it is very complex and expensive to conduct a real DDoS attack, most organizations and researchers result in using simulations to mimic an actual attack. The researchers come up with diverse algorithms and mechanisms for attack detection and prevention. Further, simulation is good practice for determining the efficacy of an intrusive detective measure against DDoS attacks. However, some mechanisms are ineffective and thus not applied in real life attacks. Nowadays, DDoS attack has become more complex and modern for most IDS to detect. Adjustable and configurable traffic generator is becoming more and more important. This paper first details the available datasets that scholars use for DDoS attack detection. The paper further depicts the a few tools that exist freely and commercially for use in the simulation programs of DDoS attacks. In addition, a traffic generator for normal and different types of DDoS attack has been developed. The aim of the paper is to simulate a cloud environment by OMNET++ simulation tool, with different DDoS attack types. Generation normal and attack traffic can be useful to evaluate developing IDS for DDoS attacks detection. Moreover, the result traffic can be useful to test an effective algorithm, techniques and procedures of DDoS attacks.
文摘网络流量数据的高维复杂特性,使得生成对抗网络生成的网络流量数据质量较差。为了解决该问题,提出一种基于双生成器的条件映射生成对抗网络(a cGAN with projection discriminator based on double generators,PD-DcGAN)并将其应用于少数类流量增强。提出基于Gumbel-sigmoid分布的离散生成器,获得近似于离散数据的光滑可导分布生成离散特征,并将其与连续数据生成器并联运行,二者结果串联组合,获得数据整体分布情况;以内积形式融合条件信息和特征信息,克服传统方法出现假设空间增大的问题,缓解模型训练过程中的不稳定现象;在损失函数中引入梯度惩罚因子,将判别器梯度限定在一定范围内,有效缓解梯度爆炸。利用UNSW-NB15数据集,从生成样本质量和模型有效性两个角度检验模型性能。实验结果证明,与其他数据增强方法相比,PD-DcGAN在准确率、精确率、召回率和F1得分上分别平均提高2.72%、1.72%、1.87%和1.16%;与原始数据集相比,对难以检测的Analysis、Backdoors、Exploits、Shellcode和Worms等少数类流量检测性能提升明显,分别从不足1%分别提升至7.93%、6.53%、15.72%、14.02%和10.91%。
基金This project was funded by the Deanship of Scientific Research(DSR)at King Abdulaziz University,Jeddah,under Grant No.RG-91-611-42.
文摘Detecting the anomalous entity in real-time network traffic is a popular area of research in recent times.Very few researches have focused on creating malware that fools the intrusion detection system and this paper focuses on this topic.We are using Deep Convolutional Generative Adversarial Networks(DCGAN)to trick the malware classifier to believe it is a normal entity.In this work,a new dataset is created to fool the Artificial Intelligence(AI)based malware detectors,and it consists of different types of attacks such as Denial of Service(DoS),scan 11,scan 44,botnet,spam,User Datagram Portal(UDP)scan,and ssh scan.The discriminator used in the DCGAN discriminates two different attack classes(anomaly and synthetic)and one normal class.The model collapse,instability,and vanishing gradient issues associated with the DCGAN are overcome using the proposed hybrid Aquila optimizer-based Mine blast harmony search algorithm(AO-MBHS).This algorithm helps the generator to create realistic malware samples to be undetected by the discriminator.The performance of the proposed methodology is evaluated using different performance metrics such as training time,detection rate,F-Score,loss function,Accuracy,False alarm rate,etc.The superiority of the hybrid AO-MBHS based DCGAN model is noticed when the detection rate is changed to 0 after the retraining method to make the defensive technique hard to be noticed by the malware detection system.The support vector machines(SVM)is used as the malicious traffic detection application and its True positive rate(TPR)goes from 80%to 0%after retraining the proposed model which shows the efficiency of the proposed model in hiding the samples.
