With the increasing prevalence of DDoS attacks, various machine learning-based detection models have been employed to mitigate these malicious behaviors. Understanding how machine learning models function can be quite complex, especially for intricate and nonlinear models like deep learning architectures. Recently, various techniques have been advanced to interpret deep learning models and address issues of ambiguity. In this paper, we present a comprehensive analysis of various explanation methods that are applied to Long Short-Term Memory (LSTM) model for detecting Distributed Denial of Service (DDoS) attacks on raw traffic data. While previous studies have focused primarily on improving detection accuracy on feature-based datasets, this paper emphasizes the importance of interpretability in deep learning models on raw-based traffic datasets. By employing explanation techniques such as LIME, SHAP, Anchor, and LORE, we provide insights into the decision-making processes of LSTM models, thereby enhancing trust and understanding in classifying DDoS attacks. The use of raw-based network traffic revealed crucial packet fields that played an important role behind the true and false positive predictions of the LSTM model, as well as identifying common network fields among the DDoS attacks to justify the misclassifications between similar DDoS attacks.

DDoS attacks pose serious threats to the availability and reliability of computer networks. With the increasing complexity of DDoS attacks, the accurate detection and classification of these attacks is essential to ensure the protection of network systems. In this paper, we leverage the power of the LSTM model for DDoS attack classification and its ability to automatically learn complex patterns and select features from raw traffic at the packet level. LSTM models have remarkable performance in network traffic classification, however explaining the internal workings of them remains challenging, which hinders their wider adoption in real-world applications. To address this limitation, we propose the SHAP with Pattern Dependency (SHAPPD) approach to explain the predictions of the LSTM model. The results demonstrate significant performance in classifying the DDoS attacks from raw traffic using the LSTM model. SHAPPD effectively explains the predictions of the LSTM model, highlighting the underlying packet traffic fields that drive the LSTM to make its true and false positive predictions and finding the common fields between the DDoS attacks. The results of the comparison between the SHAPPD and the original SHAP emphasize that the SHAPPD is superior to the original SHAP in providing more elaborative justifications for DDoS attacks classification results. The SHAPPD, by quantifying the contribution of each input feature and considering the interdependencies between the features as well as the continued traffic packets, enables security analysts to gain insights into the decision-making process of the LSTM model and identify critical indicators about the DDoS attacks.

Metaverse is envisioned to be the next-generation human-centric Internet which can offer an immersive experience for users with a broad application in healthcare, education, entertainment, and industries. These applications require the analysis of massive data that contains private and sensitive information. A potential solution to preserving privacy is deploying distributed learning frameworks, including federated learning (FL) and split learning (SL), due to their ability to address privacy leakage and analyze personalised data without sharing raw data. However, it is known that FL and SL are still susceptible to adversarial poisoning attacks. In this paper, we analyse such critical issues for the privacy-preserving mechanism in Metaverse services. We develop a novel poisoning attack based on Bayesian optimisation to emulate the adversarial behaviour against FL (BO-FLPA) and SL (BO-SLPA) which is important for the development of effective defense algorithms in the future. Specifically, we develop a layer optimisation method using the intuition of black-box optimisation with assuming that there is a function between the prediction's uncertainty and layer optimisation parameters. The result of this optimisation provides the optimal weight parameters for the hidden layer, such as the first or the second layer for FL, and the first layer for SL. Numerical results demonstrate that in both FL and SL, the poisoned hidden layers have the ability to increase the susceptibility of the model to adversarial attacks in terms of prediction with low confidence or having a larger deviation of the probability density function of the predictions.

Naïve Bayes (NB) classification performance degrades if the conditional independence assumption is not satisfied or if the conditional probability estimate is not realistic due to the attributes of correlation and scarce data, respectively. Many works address these two problems, but few works tackle them simultaneously. Existing methods heuristically employ information theory or applied gradient optimization to enhance NB classification performance, however, to the best of our knowledge, the enhanced model generalization capability deteriorated especially on scant data. In this work, we propose a fine-grained boosting of the NB classifier to identify hidden and potential discriminative attribute values that lead the NB model to underfit or overfit on the training data and to enhance their predictive power. We employ the complement harmonic average of the conditional probability terms to measure their distribution divergence and impact on the classification performance for each attribute value. The proposed method is subtle yet significant enough in capturing the attribute values’ inter-correlation (between classes) and intra-correlation (within the class) and elegantly and effectively measuring their impact on the model’s performance. We compare our proposed complement-class harmonized Naïve Bayes classifier (CHNB) with the state-of-the-art Naive Bayes and imbalanced ensemble boosting methods on general and imbalanced machine-learning benchmark datasets, respectively. The empirical results demonstrate that CHNB significantly outperforms the compared methods.

With the rise of DDoS attacks, several machine learning-based attack detection models have been used to mitigate malicious behavioral attacks. Understanding how machine learning models work is not trivial. This is particularly true for complex and nonlinear models, such as deep learning models that have high accuracy. The struggle to explain these models creates a tension between accuracy and explanation. Recently, different methods have been used to explain deep learning models and address ambiguity issues. In this paper, we utilize the LSTM model to classify DDoS attacks. We then investigate the explanation of LSTM using LIME, SHAP, Anchor, and LORE methods. Predictions of 17 DDoS attacks are explained by these methods, where common explanations are obtained for each class. We also use the output of the explanation methods to extract intrinsic features needed to differentiate DDoS attacks. Our results demonstrate 51 intrinsic features to classify attacks. We finally compare the explanation methods and evaluate them using descriptive accuracy (DA) and descriptive sparsity (DS) metrics. The comparison and evaluation show that the explanation methods can explain the classification of DDoS attacks by capturing either the dominant contribution of input features in the prediction of the classifier or a set of features with high relevance.

Due to great success of transformers in many applications, such as natural language processing and computer vision, transformers have been successfully applied in automatic modulation classification. We have shown that transformer-based radio signal classification is vulnerable to imperceptible and carefully crafted attacks called adversarial examples. Therefore, we propose a defense system against adversarial examples in transformer-based modulation classifications. Considering the need for computationally efficient architecture particularly for Internet of Things (IoT)-based applications or operation of devices in an environment where power supply is limited, we propose a compact transformer for modulation classification. The advantages of robust training such as adversarial training in transformers may not be attainable in compact transformers. By demonstrating this, we propose a novel compact transformer that can enhance robustness in the presence of adversarial attacks. The new method is aimed at transferring the adversarial attention map from the robustly trained large transformer to a compact transformer. The proposed method outperforms the state-of-the-art techniques for the considered white-box scenarios, including the fast gradient method and projected gradient descent attacks. We have provided reasoning of the underlying working mechanisms and investigated the transferability of the adversarial examples between different architectures. The proposed method has the potential to protect the transformer from the transferability of adversarial examples.

In this work, we adapt the fine-tuning algorithm of the Naïve Bayesian (FTNB) classifier to make it more suitable for imbalanced datasets. In particular, we boost misclassified instance probability terms by an amount that is disproportional to the harmonic mean of actual and predicted classes. The intuition is that discriminative attributes when the instance is misclassified would have small probability term pair values in both the actual class due to data scarcity and the predicted class due to weak correlation. Conversely, if both values are relatively high, then the attribute has good data coverage (support) and it should not be a cause for misclassification. Since the harmonic average is dominated by the smaller value and we have an imbalanced dataset, we should enact a large update if both or either term probabilities of actual and predicted classes are small. We used several benchmark datasets (60 different balanced and imbalanced datasets) to determine if the poor performance of the NB classifier is due to the scarcity of data and compared the performance of the proposed algorithm with NB, original FTNB, and other relatively new SOTA Ensemble Imbalanced Classifiers. Our empirical results reveal that the new proposed algorithm significantly outperforms all other classifiers.

Deep learning algorithms have been shown to be powerful in many communication network design problems, including that in automatic modulation classification. However, they are vulnerable to carefully crafted attacks called adversarial examples. Hence, the reliance of wireless networks on deep learning algorithms poses a serious threat to the security and operation of wireless networks. In this letter, we propose for the first time a countermeasure against adversarial examples in modulation classification. Our countermeasure is based on a neural rejection technique, augmented by label smoothing and Gaussian noise injection, that allows to detect and reject adversarial examples with high accuracy. Our results demonstrate that the proposed countermeasure can protect deep-learning based modulation classification systems against adversarial examples.

SummaryWith the rapid growth of security threats in computer networks, the need for developing efficient security‐warning systems is substantially increasing. Distributed denial‐of‐service (DDoS) and DoS attacks are still among the most effective and dreadful attacks that require robust detection. In this work, we propose a new method to detect TCP DoS/DDoS attacks. Since analyzing network traffic is a promising approach, our proposed method utilizes network traffic by decomposing the TCP traffic into control and data planes and exploiting the dynamic time warping (DTW) algorithm for aligning these two planes with respect to the minimum Euclidean distance. By demonstrating that the distance between the control and data planes is considerably small for benign traffic, we exploit this characteristic for detecting attacks as outliers. An adaptive thresholding scheme is implemented by adjusting the value of the threshold in accordance with the local statistics of the median absolute deviation (MAD) of the distances between the two planes. We demonstrate the efficacy of the proposed method for detecting DoS/DDoS attacks by analyzing traffic data obtained from publicly available datasets.

We address the problem of spectrum sensing in decentralized cognitive radio networks using a parametric machine learning method. In particular, to mitigate sensing performance degradation due to the mobility of the secondary users (SUs) in the presence of scatterers, we propose and investigate a classifier that uses a pilot based second order Kalman filter tracker for estimating the slowly varying channel gain between the primary user (PU) transmitter and the mobile SUs. Using the energy measurements at SU terminals as feature vectors, the algorithm is initialized by a K-means clustering algorithm with two centroids corresponding to the active and inactive status of PU transmitter. Under mobility, the centroid corresponding to the active PU status is adapted according to the estimates of the channels given by the Kalman filter and an adaptive K-means clustering technique is used to make classification decisions on the PU activity. Furthermore, to address the possibility that the SU receiver might experience location dependent co-channel interference, we have proposed a quadratic polynomial regression algorithm for estimating the noise plus interference power in the presence of mobility which can be used for adapting the centroid corresponding to inactive PU status. Simulation results demonstrate the efficacy of the proposed algorithm.

There are several Internet applications that exhibit periodic behavior. Some of these applications are benign such as E-mail and software updates, while others are used to release malicious activities such as botnet command and control (C&C) traffic. Therefore, the detection of periodic behavior can lead to the detection of malicious activities that threatens the security of computer network. In this paper, we study the detection of periodic behavior of network traffic. We analyze the packet sequences extracted from network traffic. We estimate the power spectral density (PSD) of the packet count sequences using periodograms. We examine a statistical model that uniformly randomizes the value of the period within a certain range. We validate the detection approach using various types of datasets; Generated data, HULK DoS traffic obtained from the Canadian’s CICIDS2017 dataset, and Botnet IRC C&C traffic obtained from King Saud University’s network. Our results demonstrate the detection approach can detect periodic behavior whether the period is regular or irregular within a certain range.

With the rapid growth of information and communication technologies, the number of security threats in computer networks is substantially increasing; thus, the development of more proactive security warning measures is required. In this work, we propose a new anomaly detection method that operates by decomposing TCP traffic into control and data planes, which exhibit similar behaviors in the absence of attacks. The proposed method exploits the statistics of the cross-correlation function of the two planes traffic and the constant false alarm rate (CFAR) scheme for detecting anomalies of the underlying network traffic. Both the fixed and adaptive thresholding schemes are implemented. The adaptive thresholding is setup by adjusting the value of the threshold in accordance with the local statistics of the cross-correlation function of the two planes traffic. We evaluate the performance of the proposed method by analyzing the real traffic captured from a deployed network and traffic obtained from other publicly available datasets; we focus on TCP traffic with three different aggregated count features: packet count, IP address count, and port count sequences. Although both the fixed and adaptive thresholding schemes perform well and detect the presence of a distributed denial-of-service efficiently. The adaptive thresholding scheme is more reliable because it detects anomalies as they start.

Inspired by its success in financial sectors, the blockchain technique is emerging as an enabling technology for secure distributed control and management of wireless networks. In order to fully benefit from this distributed ledger technology, its limitations, cost, complexity and empowerment also have to be critically appraised. Depending on the specific context of the problem to be solved, these limitations have been handled to some extent through a clear dichotomy in the blockchain architectures, namely by conceiving both permissioned and permissionless blockchains. Permissionless blockchain requires massive computing power to achieve consensus, while its permissioned counterpart is energy efficient but would require trusted participants. To combine these benefits by gaining trust at a high energy efficiency, a novel mechanism is proposed for automatically learning the trust level of users in a public blockchain network and granting them access to a private blockchain network. In this context, machine learning is a very powerful tool capable of automatically learning the trust level. We have proposed reinforcement learning for bridging the dichotomy of blockchains in terms of striking a trust vs complexity trade-off in an unknown environment. Benefits and limitations of various forms of blockchain techniques are analyzed, followed by their reinforcement-aided evolution. We demonstrate that the proposed reinforcement learning aided blockchain is capable of supporting high-integrity autonomous operation and decision making in wireless networks. The win-win amalgamation of these techniques has been demonstrated for striking a compelling balance between the benefits of permissioned and permissionless blockchain networks through the case-study of the proposed blockchain based unmanned aerial vehicle aided wireless networks.

The detection of anomalies in network traffic is an important task in today's Internet. Among various anomaly detection methods, the techniques based on examination of the long-range dependence (LRD) behavior of network traffic stands out to be powerful. In this paper, we reveal anomalies in aggregated network traffic by examining the LRD behavior based on the cross-correlation function of the bidirectional control and data planes traffic. Specifically, observing that the conventional cross-correlation function has a low measure of dissimilarity between the two planes, which leads to a reduced anomaly detection performance, we propose a modification of the cross-correlation function to mitigate this issue. The performance of the proposed method is analyzed using a relatively recent Internet traffic captured at King Saud University. The results demonstrate that using the modified cross-correlation function has the ability to detect low volume and short duration attacks. It also compensates for some misdetections exhibited by using the autocorrelation structures of the bidirectional traffic of the control, data, and WHOLE (combined control and data) planes traffic.

The UAV is emerging as one of the greatest technology developments for rapid network coverage provisioning at affordable cost. The aim of this paper is to outsource network coverage of a specific area according to a desired quality of service requirement and to enable various entities in the network to have intelligence to make autonomous decisions using blockchain and auction mechanisms. In this regard, by considering a multiple-UAV network where each UAV is associated to its own controlling operator, this paper addresses two major challenges: the selection of the UAV for the desired quality of network coverage and the development of a distributed and autonomous real-time monitoring framework for the enforcement of service level agreement (SLA). For a suitable UAV selection, we employ a reputation-based auction mechanism to model the interaction between the business agent who is interested in outsourcing the network coverage and the UAV operators serving in closeby areas. In addition, theoretical analysis is performed to show that the proposed auction mechanism attains a dominant strategy equilibrium. For the SLA enforcement and trust model, we propose a permissioned blockchain architecture considering Support Vector Machine (SVM) for real-time autonomous and distributed monitoring of UAV service. In particular, smart contract features of the blockchain are invoked for enforcing the SLA terms of payment and penalty, and for quantifying the UAV service reputation. Simulation results confirm the accuracy of theoretical analysis and efficacy of the proposed model.

Efficient and reliable network operation are the major concerns of computer networks monitoring, an objective that can be achieved by properly analysing the monitored network traffic. But due to the huge size of monitored traffic, this paper suggests a solution by presenting a representative of the monitored traffic. We claim that analysing the representative will generate the same information about the monitored networks, rather than analysing the whole network traffic. The representative is created by decomposing the monitored traffic into two parts, a representative and the rest of the traffic (data traffic), visual plots and cross-correlation will be used to expose the similarity between the representative and the data traffic. Experiments showed that the presented methodology reduces the volume of the analyzed traffic by a percentage of (30-80%), representative and data traffic showed similar behavior in the visual plots and in the cross-correlation calculations.

Caching is a promising solution for the cloud radio access network (Cloud-RAN) to mitigate the traffic load problem in the fronthaul links. Multiuser downlink beamforming plays an important role in efficient utilisation of spectrum and transmission power while satisfying the user's quality of service requirements. When the number of users exceeds the serving capacity of the network, certain users will have to be dropped or rescheduled. This is normally achieved by appropriate admission control mechanisms. Introducing local storage or cache at the remote radio heads where some popular contents are cached, the authors propose beamforming and admission control techniques for cache-enabled Cloud-RAN in the downlink. This minimises the total network cost including power and fronthaul cost while admitting as many users as possible. They formulate this multi-objective optimisation problem as a single objective optimisation problem. The original problem, which is a mixed-integer non-linear programme, is first converted to the mixed-integer second-order cone programming form. The branch and bound algorithm is then used to determine the optimal and suboptimal solutions. A simulation study has been conducted to assess the performance of both methods.

Malware is considered as one of the main actors in cyber attacks. The number of unique malware samples is constantly on the rise; however, the ratio of benign software still greatly outnumbers malware samples. In machine learning, such datasets are known as imbalanced, where the majority class label greatly dominates over others. In this paper, we present a comparative analysis and evaluation of some of the proposed techniques in the literature in order to address the problem of classifying imbalanced multi-class malware datasets. More specifically, we use Convolutional Neural Network (CNN) as a classification algorithm to study the effect of imbalanced datasets on deep learning approaches. These experiments are conducted on three publicly available imbalanced datasets. Our performance analysis demonstrates that methods such as cost sensitive learning, oversampling and cross validation have positive effects on the model classification performance, albeit in varying degrees. Meanwhile others like using pre-trained models require more special parameter settings. However, best practices may change in accordance with the problem domain.

With the rapid development of new technologies and applications of Internet, much attention has been paid to the detection of anomalies in cyberspace traffic. A series of intrusion detection techniques based on machine learning have been developed. Support vector machine (SVM), as an essential approach, has been paid close attention in this filed. Nevertheless, the existing SVM-based techniques with the training features can not efficiently detect short duration intrusions and attacks in the traffic. To tackle this issue, we propose an anomaly-based SVM detection scheme by extracting and optimizing the training features. It trains the SVM with Kullback-Leibler (KL) divergence and cross-correlation calculated by the control and data planes traffic. Following this way, the novel training method can effectively enhance the detection accuracy. And the performance of the presented scheme is validated and evaluated based on a recent realistic Internet traffic dataset. Finally, relevant results indicate that the developed method establishes the relationship between Transmission Control Protocol (TCP) traffic and intrusions. It can efficiently detect short duration intrusions and attacks in the network traffic.

Analyzing network traffic behavior is essential for detecting network anomalies. However, it remains a challenge to effectively analyze this behavior for anomaly diagnosis. One promising approach is to decompose network traffic into control and data planes, and statistically analyze each plane's packet features. Both control and data planes behave similarly during benign traffic. However, any difference in the behavior of these planes may indicate an anomaly. In this work, We show that under normal conditions, the packet count distance between the two planes falls within a range of values. Consecutive outliers to these values may reveal the presence of anomalies. We exploit Dynamic Time Warping (DTW) to get the best alignment of the two planes and measure the Euclidean distance between their corresponding instances. We investigate our approach using recent Internet traffic captured at King Saud University. Results support our argument and show that the distance between the TCP control plane and corresponding data plane falls within a certain range of values during benign applications and exceeds these values during anomalous activities.