Multivariate Statistical Network Monitoring–Sensor: An effective tool for real-time monitoring and anomaly detection in complex networks and systems

Technology evolves quickly. Low-cost and ready-to-connect devices are designed to provide new services and applications. Smart grids or smart health care systems are some examples of these applications. In this totally connected scenario, some security issues arise due to the large number of devices and communications. In this way, new solutions for monitoring and detecting security events are needed to address new challenges brought about by this scenario, among others, the real-time requirement allowing quick security event detection and, consequently, quick response to attacks. In this sense, Intrusion Detection Systems are widely used though their evaluation often relies on the use of predefined network datasets that limit their application in real environments. In this work, a real-time and ready-to-use tool for monitoring and detecting security events is introduced. The Multivariate Statistical Network Monitoring–Sensor is based on the Multivariate Statistical Network Monitoring methodology and provides an alternative way for evaluating Multivariate Statistical Network Monitoring–based Intrusion Detection System solutions. Experimental results based on the detection of well-known attacks in hierarchical network systems prove the suitability of this tool for complex scenarios, such as those found in smart cities or Internet of Things ecosystems.

Download Full-text

A Dynamic Intrusion Detection System Based on Multivariate Hotelling’s T2Statistics Approach for Network Environments

The Scientific World JOURNAL ◽

10.1155/2015/850153 ◽

2015 ◽

Vol 2015 ◽

pp. 1-9 ◽

Cited By ~ 4

Author(s):

Aneetha Avalappampatty Sivasamy ◽

Bose Sundan

Keyword(s):

Statistical Analysis ◽

Intrusion Detection ◽

Multivariate Statistical Analysis ◽

Detection System ◽

Attack Detection ◽

Network Systems ◽

Multivariate Statistical ◽

Detection Rates ◽

Network Intrusion ◽

Network Environments

The ever expanding communication requirements in today’s world demand extensive and efficient network systems with equally efficient and reliable security features integrated for safe, confident, and secured communication and data transfer. Providing effective security protocols for any network environment, therefore, assumes paramount importance. Attempts are made continuously for designing more efficient and dynamic network intrusion detection models. In this work, an approach based on Hotelling’s T2method, a multivariate statistical analysis technique, has been employed for intrusion detection, especially in network environments. Components such as preprocessing, multivariate statistical analysis, and attack detection have been incorporated in developing the multivariate Hotelling’s T2statistical model and necessary profiles have been generated based on the T-square distance metrics. With a threshold range obtained using the central limit theorem, observed traffic profiles have been classified either as normal or attack types. Performance of the model, as evaluated through validation and testing using KDD Cup’99 dataset, has shown very high detection rates for all classes with low false alarm rates. Accuracy of the model presented in this work, in comparison with the existing models, has been found to be much better.

Download Full-text

Toward an Applied Cyber Security Solution in IoT-Based Smart Grids: An Intrusion Detection System Approach

Sensors ◽

10.3390/s19224952 ◽

2019 ◽

Vol 19 (22) ◽

pp. 4952 ◽

Cited By ~ 2

Author(s):

Xiao Chun Yin ◽

Zeng Guang Liu ◽

Lewis Nkenyereye ◽

Bruce Ndibanje

Keyword(s):

Intrusion Detection ◽

Real Time ◽

Intrusion Detection System ◽

Smart Grids ◽

Secure Communication ◽

Detection System ◽

Cyber Attacks ◽

Human Beings ◽

Attack Model ◽

Scada Systems

We present an innovative approach for a Cybersecurity Solution based on the Intrusion Detection System to detect malicious activity targeting the Distributed Network Protocol (DNP3) layers in the Supervisory Control and Data Acquisition (SCADA) systems. As Information and Communication Technology is connected to the grid, it is subjected to both physical and cyber-attacks because of the interaction between industrial control systems and the outside Internet environment using IoT technology. Often, cyber-attacks lead to multiple risks that affect infrastructure and business continuity; furthermore, in some cases, human beings are also affected. Because of the traditional peculiarities of process systems, such as insecure real-time protocols, end-to-end general-purpose ICT security mechanisms are not able to fully secure communication in SCADA systems. In this paper, we present a novel method based on the DNP3 vulnerability assessment and attack model in different layers, with feature selection using Machine Learning from parsed DNP3 protocol with additional data including malware samples. Moreover, we developed a cyber-attack algorithm that included a classification and visualization process. Finally, the results of the experimental implementation show that our proposed Cybersecurity Solution based on IDS was able to detect attacks in real time in an IoT-based Smart Grid communication environment.

Download Full-text

A Model-Based Real-Time Intrusion Detection System for Large Scale Heterogeneous Networks

10.21236/ada420824 ◽

2003 ◽

Cited By ~ 1

Author(s):

Richard A. Kemmer ◽

Giovanni Vigna

Keyword(s):

Intrusion Detection ◽

Real Time ◽

Heterogeneous Networks ◽

Intrusion Detection System ◽

Large Scale ◽

Detection System ◽

Model Based

Download Full-text

Real-time Support Vector Machine based Network Intrusion Detection system using Apache Storm

2016 IEEE 7th Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON) ◽

10.1109/iemcon.2016.7746264 ◽

2016 ◽

Cited By ~ 5

Author(s):

Muhammad Asif Manzoor ◽

Yasser Morgan

Keyword(s):

Support Vector Machine ◽

Intrusion Detection ◽

Real Time ◽

Intrusion Detection System ◽

Detection System ◽

Network Intrusion Detection ◽

Support Vector ◽

Network Intrusion ◽

Network Intrusion Detection System ◽

Apache Storm

Download Full-text

LAMP assay coupled with CRISPR/Cas12a system for portable detection of African swine fever virus

10.22541/au.161292271.12539635/v1 ◽

2021 ◽

Author(s):

Bo YANG ◽

zhengwang shi ◽

Yuan Ma ◽

Lijuan Wang ◽

Liyan Cao ◽

...

Keyword(s):

Real Time ◽

Detection System ◽

African Swine Fever Virus ◽

Low Cost ◽

African Swine Fever ◽

Lamp Assay ◽

Cross Reactivity ◽

Clinical Samples ◽

Portable Detection ◽

Real Time Qpcr

African swine fever (ASF) is one of the most severe infectious diseases of pigs. In this study, a LAMP assay coupled with the CRISPR Cas12a system was established in one tube for the detection of the ASFV p72 gene. The single-strand DNA-fluorophore-quencher (ssDNA-FQ) reporters and CRISPR-derived RNA (crRNAs) were screened and selected for the CRISPR detection system. In combination with LAMP amplification assay, the detection limit for the LAMP-CRISPR assay can reach 7 copies/μl of p72 gene per reaction. Furthermore, this method displays no cross-reactivity with other porcine DNA or RNA viruses. The performance of the LAMP-CRISPR assay was compared with real-time qPCR tests for clinical samples, a good consistency between the LAMP-CRISPR assay and real-time qPCR was observed. In the current study, a LAMP coupled with the CRISPR detection method was developed. The method shed a light on the convenient, portable, low cost, highly sensitive and specific detection of ASFV, demonstrating a great application potential for monitoring on-site ASFV in the field.

Download Full-text

Agent-Based Real Time Intrusion Detection System Against Malformed Packet Attacks

Agent Computing and Multi-Agent Systems - Lecture Notes in Computer Science ◽

10.1007/11802372_98 ◽

2006 ◽

pp. 807-812 ◽

Cited By ~ 1

Author(s):

Jun-Cheol Jeon ◽

Eun-Yeung Choi ◽

Kee-Young Yoo

Keyword(s):

Intrusion Detection ◽

Real Time ◽

Intrusion Detection System ◽

Detection System ◽

Agent Based

Download Full-text

Real-Time Automatic Cloud Detection Using a Low-Cost Sky Camera

Remote Sensing ◽

10.3390/rs12091382 ◽

2020 ◽

Vol 12 (9) ◽

pp. 1382 ◽

Cited By ~ 1

Author(s):

Joaquín Alonso-Montesinos

Keyword(s):

Real Time ◽

Energy Production ◽

Production Management ◽

Detection System ◽

Low Cost ◽

Color Spaces ◽

Cloud Detection ◽

Precise Control ◽

Short Period ◽

Sky Conditions

Characterizing the atmosphere is one of the most complex studies one can undertake due to the non-linearity and phenomenological variability. Clouds are also among the most variable atmospheric constituents, changing their size and shape over a short period of time. There are several sectors in which the study of cloudiness is of vital importance. In the renewable field, the increasing development of solar technology and the emerging trend for constructing and operating solar plants across the earth’s surface requires very precise control systems that provide optimal energy production management. Similarly, airports are hubs where cloud coverage is required to provide high-precision periodic observations that inform airport operators about the state of the atmosphere. This work presents an autonomous cloud detection system, in real time, based on the digital image processing of a low-cost sky camera. An algorithm was developed to identify the clouds in the whole image using the relationships established between the channels of the RGB and Hue, Saturation, Value (HSV) color spaces. The system’s overall success rate is approximately 94% for all types of sky conditions; this is a novel development which makes it possible to identify clouds from a ground perspective without the use of radiometric parameters.

Download Full-text

A coincidence detection system based on real-time software

Geoscientific Instrumentation Methods and Data Systems ◽

10.5194/gi-5-437-2016 ◽

2016 ◽

Vol 5 (2) ◽

pp. 437-449 ◽

Cited By ~ 3

Author(s):

Sindulfo Ayuso ◽

Juan José Blanco ◽

José Medina ◽

Raúl Gómez-Herrero ◽

Oscar García-Población ◽

...

Keyword(s):

Real Time ◽

Detection System ◽

Low Cost ◽

Cosmic Ray ◽

Coincidence Detection ◽

Pulse Delay ◽

Development Platform ◽

Electronic Circuitry ◽

Coincidence System ◽

Cost Development

Abstract. Conventional real-time coincidence systems use electronic circuitry to detect coincident pulses (hardware coincidence). In this work, a new concept of coincidence system based on real-time software (software coincidence) is presented. This system is based on the recurrent supervision of the analogue-to-digital converters status, which is described in detail. A prototype has been designed and built using a low-cost development platform. It has been applied to two different experimental sets for cosmic ray muon detection. Experimental muon measurements recorded simultaneously using conventional hardware coincidence and our software coincidence system have been compared, yielding identical results. These measurements have also been validated using simultaneous neutron monitor observations. This new software coincidence system provides remarkable advantages such as higher simplicity of interconnection and adjusting. Thus, our system replaces, at least, three Nuclear Instrument Modules (NIMs) required by conventional coincidence systems, reducing its cost by a factor of 40 and eliminating pulse delay adjustments.

Download Full-text

Reputation Management Using Honeypots for Intrusion Detection in the Internet of Things

Electronics ◽

10.3390/electronics9030415 ◽

2020 ◽

Vol 9 (3) ◽

pp. 415 ◽

Cited By ~ 3

Author(s):

Zeeshan Ali Khan ◽

Ubaid Abbasi

Keyword(s):

Internet Of Things ◽

Intrusion Detection ◽

Detection System ◽

Mac Protocol ◽

Low Cost ◽

Reputation Management ◽

The Internet ◽

Detection Accuracy ◽

Extra Energy ◽

Networking Protocols

Internet of Things (IoT) networks consist of tiny devices with limited processing resources and restricted energy budget. These devices are connected to the world-wide web (www) using networking protocols. Considering their resource limitations, they are vulnerable to security attacks by numerous entities on the Internet. The classical security solutions cannot be directly implemented on top of these devices for this reason. However, an Intrusion Detection System (IDS) is a classical way to protect these devices by using low-cost solutions. IDS monitors the network by introducing various metrics, and potential intruders are identified, which are quarantined by the firewall. One such metric is reputation management, which monitors the behavior of the IoT networks. However, this technique may still result in detection error that can be optimized by combining this solution with honeypots. Therefore, our aim is to add some honeypots in the network by distributing them homogeneously as well as randomly. These honeypots will team up with possible maliciously behaving nodes and will monitor their behavior. As per the simulation results, this technique reduces the error rate within the existing IDS for the IoT; however, it costs some extra energy. This trade-off between energy consumption and detection accuracy is studied by considering standard routing and MAC protocol for the IoT network.

Download Full-text