In recent years the number of attacks on computer networks has increased exponentially due to the easy availability of sophisticated tools and attack techniques. These attacks are possible due to existing vulnerabilities in networking protocols. Most of the machine learning based intrusion detection systems proposed earlier, to mitigate these attacks, consider training a model for the group of attacks, which doesn’t consider protocol-specific properties into account and is biased toward attacks where most of the data is available. In this paper, we propose protocol aware unsupervised method based on an autoencoder-based learning approach to detect the attack in network flows by training the model using only normal traffic and using reconstruction error as the parameter to classify the attack event. Our proposed method is based on building protocol aware model by combining individual protocol-specific encoders and learning the protocol channel importance using attention mechanism. We perform various experiments on different recent datasets like CICDDoS2019, and CICIDS2018, and experimental results show that the proposed protocol aware model performs better than the non-protocol aware method.

With the advancement of Internet technologies Cyber attacks have become a significant risk to overall security, therefore, intelligent security systems are required to strengthen the network security against these threats. Machine learning has played a pivotal role in the detection and mitigation of these attacks over the years. However, to identify the zero-day attacks and incorporate frequently changing attack scenarios, techniques need to be developed that can work with minimally labeled data. In this paper, we propose Time aware LSTM Autoencoder-based learning approach to detect the attack in network flows by training the model using only normal traffic and using reconstruction error as the parameter to classify the attack event. We perform the experiments on different recent datasets like CICDDoS2019, & CICIDS2018 and experimental results exhibit that the proposed model overall provides better classification metrics.

In recent years, the number of attacks in computer networks are constantly increasing due to the lack of proper authentication of communicating entities in the network. TCP/IP layering architecture is prone to various threats due to the vulnerabilities in each of its layers. This mandates the requirement for a suitable detection system in the network to monitor the possible attacks. ICMP is a mandatory protocol which provides the error reporting, control and network management functionalities to the Internet Protocol (IP). Many of the attacks in the network like MiTM and DoS can be initiated with the exploitation of this essential protocols. In this paper, an active detection mechanism to identify many ICMP Error messages based attacks is proposed. The ICMP messages are verified by sending suitable probe packets to the hosts and validating their responses. The detection scheme is successfully validated in a testbed with various attack scenarios and the results show the effectiveness of the proposed technique in terms of greater accuracy in the detection rates.