Detecting Web Attacks Based on Clustering Algorithm and Multi-branch CNN

2021 ◽  
Vol 2 (12) ◽  
pp. 31-37
Author(s):  
Pham Van Huong ◽  
Le Thi Hong Van ◽  
Pham Sy Nguyen
Keyword(s):  
Clustering Algorithm ◽  
Feature Vector ◽  
Attack Detection ◽  
Improvement Rate ◽  
Detection Model ◽  
Web Attacks ◽  
Fully Connected ◽  
Fold Cross Validation ◽  
Component Feature ◽  
Original Feature

Abstract—This paper proposes and develops a web attack detection model that combines a clustering algorithm and a multi-branch convolutional neural network (CNN). The original feature set was clustered into clusters of similar features. Each cluster of similar features was generalized in a convolutional structure of a branch of the CNN. The component feature vectors are assembled into a synthetic feature vector and included in a fully connected layer for classification. Using K-fold cross-validation, the accuracy of the proposed method 98.8%, F1-score is 98.9% and the improvement rate of accuracy is 1.479%.Tóm tắt—Bài báo đề xuất và phát triển mô hình phát hiện tấn công Web dựa trên kết hợp thuật toán phân cụm và mạng nơ-ron tích chập (CNN) đa nhánh. Tập đặc trưng ban đầu được phân cụm thành các nhóm đặc trưng tương ứng. Mỗi nhóm đặc trưng được khái quát hoá trong một nhánh của mạng CNN đa nhánh để tạo thành một vector đặc trưng thành phần. Các vector đặc trưng thành phần được ghép lại thành một vector đặc trưng tổng hợp và đưa vào lớp liên kết đầy đủ để phân lớp. Sử dụng phương pháp kiểm thử chéo trên mô hình đề xuất, độ chính xác đạt 98,8%, F1-score đạt 98,8% và tỉ lệ cải tiến độ chính xác là 1,479%. 

scholarly journals An Improved Anomalous Intrusion Detection Model

2019 ◽  
Vol 4 (2) ◽  
Author(s):  
Bodunde O Akinyemi ◽  
Johnson B Adekunle ◽  
Temitope A Aladesanmi ◽  
Adesola G Aderounmu ◽  
Beman H Kamagate
Keyword(s):  
Intrusion Detection ◽  
Network Traffic ◽  
Clustering Algorithm ◽  
Information Gain ◽  
Attack Detection ◽  
Detection Accuracy ◽  
Cyber Attack ◽  
Network Resources ◽  
Detection Model ◽  
Normal Network

The volume of cyber-attack targeting network resources within the cyberspace is steadily increasing and evolving. Network intrusions compromise the confidentiality, integrity or availability of network resources causing reputational damage and the consequential financial loss. One of the key cyber-defense tools against these attacks is the Intrusion Detection System. Existing anomalous intrusion detection models often misclassified normal network traffics as attacks while minority attacks go undetected due to an extreme imbalance in network traffic data. This leads to a high false positive and low detection rate. This study focused on improving the detection accuracy by addressing the class imbalanced problem which is often associated with network traffic dataset. Live network traffic packets were collected within the test case environment with Wireshark during normal network activities, Syncflood attack, slowhttppost attack and exploitation of known vulnerabilities on a targeted machine. Fifty-two features including forty-two features similar to Knowledge Discovery in Database (KDD ’99) intrusion detection dataset were extracted from the packet meta-data using Spleen tool. The features were normalized with min-max normalization algorithm and Information Gain algorithm was used to select the best discriminatory features from the feature space. An anomalous intrusion detection model was formulated by a cascade of k-means clustering algorithm and random-forest classifier. The proposed model was simulated and its performance was evaluated using detection accuracy, sensitivity, and specificity as metrics. The result of the evaluation showed 10% higher detection accuracy, 29% sensitivity, and 0.2% specificity than the existing model. Keywords— anomalous, cyber-attack, Detection, Intrusion

scholarly journals A Novel Unsupervised Classification Method for Sandy Land Using Fully Polarimetric SAR Data

2021 ◽  
Vol 13 (3) ◽  
pp. 355
Author(s):  
Weixian Tan ◽  
Borong Sun ◽  
Chenyu Xiao ◽  
Pingping Huang ◽  
Wei Xu ◽  
...  
Keyword(s):  
Spectral Clustering ◽  
Large Scale ◽  
Clustering Algorithm ◽  
Feature Vector ◽  
Unsupervised Classification ◽  
Classification Method ◽  
Sandy Land ◽  
Classification Methods ◽  
The Many ◽  
Representative Points

Classification based on polarimetric synthetic aperture radar (PolSAR) images is an emerging technology, and recent years have seen the introduction of various classification methods that have been proven to be effective to identify typical features of many terrain types. Among the many regions of the study, the Hunshandake Sandy Land in Inner Mongolia, China stands out for its vast area of sandy land, variety of ground objects, and intricate structure, with more irregular characteristics than conventional land cover. Accounting for the particular surface features of the Hunshandake Sandy Land, an unsupervised classification method based on new decomposition and large-scale spectral clustering with superpixels (ND-LSC) is proposed in this study. Firstly, the polarization scattering parameters are extracted through a new decomposition, rather than other decomposition approaches, which gives rise to more accurate feature vector estimate. Secondly, a large-scale spectral clustering is applied as appropriate to meet the massive land and complex terrain. More specifically, this involves a beginning sub-step of superpixels generation via the Adaptive Simple Linear Iterative Clustering (ASLIC) algorithm when the feature vector combined with the spatial coordinate information are employed as input, and subsequently a sub-step of representative points selection as well as bipartite graph formation, followed by the spectral clustering algorithm to complete the classification task. Finally, testing and analysis are conducted on the RADARSAT-2 fully PolSAR dataset acquired over the Hunshandake Sandy Land in 2016. Both qualitative and quantitative experiments compared with several classification methods are conducted to show that proposed method can significantly improve performance on classification.

Finite State Machine for the Social Engineering Attack Detection Model: SEADM

2018 ◽  
Vol 109 (2) ◽  
pp. 133-148 ◽  
Author(s):  
Francois Mouton ◽  
Alastair Nottingham ◽  
Louise Leenen ◽  
H.S Venter
Keyword(s):  
Finite State Machine ◽  
Social Engineering ◽  
State Machine ◽  
Attack Detection ◽  
Detection Model ◽  
The Social ◽  
Finite State

scholarly journals Improved Bidirectional CABOSFV Based on Multi-Adjustment Clustering and Simulated Annealing

2016 ◽  
Vol 16 (6) ◽  
pp. 27-42 ◽  
Author(s):  
Minghan Yang ◽  
Xuedong Gao ◽  
Ling Li
Keyword(s):  
Simulated Annealing ◽  
Data Clustering ◽  
Time Complexity ◽  
Clustering Algorithm ◽  
Feature Vector ◽  
Parameter Determination ◽  
Data Sets ◽  
Parameter Vector ◽  
Clustering Validity

Abstract Although Clustering Algorithm Based on Sparse Feature Vector (CABOSFV) and its related algorithms are efficient for high dimensional sparse data clustering, there exist several imperfections. Such imperfections as subjective parameter designation and order sensibility of clustering process would eventually aggravate the time complexity and quality of the algorithm. This paper proposes a parameter adjustment method of Bidirectional CABOSFV for optimization purpose. By optimizing Parameter Vector (PV) and Parameter Selection Vector (PSV) with the objective function of clustering validity, an improved Bidirectional CABOSFV algorithm using simulated annealing is proposed, which circumvents the requirement of initial parameter determination. The experiments on UCI data sets show that the proposed algorithm, which can perform multi-adjustment clustering, has a higher accurateness than single adjustment clustering, along with a decreased time complexity through iterations.

scholarly journals eHMCOKE: an enhanced overlapping clustering algorithm for data analysis

2021 ◽  
Vol 10 (4) ◽  
pp. 2212-2222
Author(s):  
Alvincent E. Danganan ◽  
Edjie Malonzo De Los Reyes
Keyword(s):  
Data Analysis ◽  
Clustering Algorithm ◽  
Median Absolute Deviation ◽  
Accuracy Rate ◽  
Absolute Deviation ◽  
Improvement Rate ◽  
Overlapping Clustering ◽  
Overlapping Clusters ◽  
Runtime Performance

Improved multi-cluster overlapping k-means extension (IMCOKE) uses median absolute deviation (MAD) in detecting outliers in datasets makes the algorithm more effective with regards to overlapping clustering. Nevertheless, analysis of the applied MAD positioning was not considered. In this paper, the incorporation of MAD used to detect outliers in the datasets was analyzed to determine the appropriate position in identifying the outlier before applying it in the clustering application. And the assumption of the study was the size of the cluster and cluster that are close to each other can led to a higher runtime performance in terms of overlapping clusters. Therefore, additional parameters such as radius of clusters and distance between clusters are added measurements in the algorithm procedures. Evaluation was done through experimentations using synthetic and real datasets. The performance of the eHMCOKE was evaluated via F1-measure criterion, speed and percentage of improvement. Evaluation results revealed that the eHMCOKE takes less time to discover overlap clusters with an improvement rate of 22% and achieved the best performance of 91.5% accuracy rate via F1-measure in identifying overlapping clusters over the IMCOKE algorithm. These results proved that the eHMCOKE significantly outruns the IMCOKE algorithm on mosts of the test conducted.

scholarly journals Anomaly detection in multi-class time series

2021 ◽  
Vol 2113 (1) ◽  
pp. 012062
Author(s):  
Weihong Wang ◽  
Zhuolin Wu ◽  
Xuan Liu ◽  
Lei Jia ◽  
Xiaoguang Wang
Keyword(s):  
Image Processing ◽  
Time Series ◽  
Anomaly Detection ◽  
Performance Indicators ◽  
Clustering Algorithm ◽  
Limited Resources ◽  
Detection Model ◽  
Class Time ◽  
Operation And Maintenance ◽  
Maintenance Systems

Abstract For modern operation and maintenance systems, they are usually required to monitor multiple types and large quantities of machine’s key performance indicators (KPIs) at the same time with limited resources. In this paper, to tackle these problems, we propose a highly compatible time series anomaly detection model based on K-means clustering algorithm with a new Wavelet Feature Distance (WFD). Our work is inspired by some ideas from image processing and signal processing domain. Our model detects abnormalities in the time series datasets which are first clustered by K-means to boost the accuracy. Our experiments show significant accuracy improvements compared with traditional algorithms, and excellent compatibilities and operating efficiencies compared with algorithms based on deep learning.

Black-box Adversarial Attacks on XSS Attack Detection Model

2021 ◽  
pp. 102554
Author(s):  
Qiuhua Wang ◽  
Hui Yang ◽  
Guohua Wu ◽  
Kim-Kwang Raymond Choo ◽  
Zheng Zhang ◽  
...  
Keyword(s):  
Black Box ◽  
Attack Detection ◽  
Detection Model

Approach to real time attack detection on the base of simulation and graph oriented modeling

2021 ◽  
Vol 7 ◽  
Author(s):  
V.A. Desnitsky ◽  
Keyword(s):  
Real Time ◽  
Software Tool ◽  
Attack Detection ◽  
Suitable Model ◽  
Distinctive Features ◽  
Detection Process ◽  
Detection Model ◽  
Security Incidents

The article presents an approach to detecting attacks in real time based on simulation and graph-oriented mod- eling. The detection process is performed in a mode close to real-time with the ability to promptly detect known types of security incidents. The distinctive features of the approach include the multidimensional nature of attack detection with the ability to select a specific type of simulation and graph-oriented attack detection model with their subsequent combination. In addition, within the practical part of the work, a software tool has been developed to select the most suitable model apparatus for detecting attacks of each type.

Sign in / Sign up

Export Citation Format

Share Document