Website Fingerprinting (WF) attacks significantly endanger user privacy in Anonymous Communication Networks, such as Tor, by allowing adversaries to infer the user’s browsing activity. Contemporary research has demonstrated that WF attacks using Deep Learning techniques transcend conventional rule-based defenses. Deep Learning models, in particular, have achieved remarkable accuracy in identifying websites visited through Tor, exhibiting the elevated threat posed by advanced WF attacks. This paper presents a novel WF defense mechanism, ADEFTOR, incorporating incremental distance reduction and universal distortion for individual sites. This approach involves selecting random target traces and progressively decreasing the distance between the modified examples and these targets. It also generates a universal distortion applicable across different user sessions and traffic types, allowing perturbations to blend into real-time network traffic seamlessly. ADEFTOR is evaluated against DL-based attacks using a public Tor traffic dataset. Experimental results demonstrate that ADEFTOR reduces the accuracy of the top-1 attack from 98% to between 29% and 39% and the accuracy of the top-2 to 47%. ADEFTOR reduces the bandwidth overhead of Full-Duplex and Half-Duplex to 45% and 60%, respectively. ADEFTOR presents a promising solution for improving privacy in the Tor networks by addressing WF attacks, effectively degrading the accuracy of sophisticated classifiers.

Internet of Things (IoT) connects billions of devices and tiny sensors enabled with Low-Power and Lossy Networks (LLNs) to provide real time data transfer. These LLNs work as s backbone of complete IoT ecosystem which has limited power, memory and processing capability. The routing protocol for such LLNs enabled devices is standardized by IETF in RFC 6550 which is known has Routing Protocol for Low-Power and Lossy Networks (RPL). Due to the constraints of the RPL protocol, it is vulnerable to various new security attacks which needs effective defense solution. Machine Intelligence (including Machine Learning and Deep Learning) plays a great role to deal with detection of recent attacks based on the pattern and behaviour analysis of device presented in the network. This paper introduces a novel hyperparameter-based approach to detect and classify the RPL-based routing attacks. The proposed approach uses a Hyperband tuner search, that finds the optimal hyperparameter such as learning rate and the number of neurons for deep learning model to improve the detection performance. Experiments have been conducted on the ROUT-4-2023 dataset that contains the attack sample of Flooding, Blackhole, DODAG Version number and Rank attack. The results are evaluated against various performance metrics on dataset balance and imbalance scenario which provide the promising findings for attack classification.

Detecting disruptive events (DEs), such as riots, protests, and natural calamities, from social media is essential for studying geopolitical dynamics. To automate the process, existing methods rely on classical machine learning (ML) models applied to static datasets, which is counterproductive. To detect DEs from dynamic data streams, this article introduces a novelDiEvD-SFframework, which uses continual machine learning (CML) with selective forgetting. Twitter (currently “X”) is used as a real-time and dynamic data source for validation.DiEvD-SFconsiders the temporal nature of DEs and “selectively forgets” outdated DEs through machine unlearning. To the best of our knowledge, this article is the first to apply CML with selective forgetting to discard outdated DEs and to continue learning about the new DEs. Extensive evaluation using a painstakingly collected Twitter dataset shows that the proposed framework continually identifies new DEs with an average incremental accuracy of 78.942% and successfully forgets old DEs with an average forgetting time of 118.498 seconds, which is better than the state-of-the-art. Additionally, computational analysis is performed to establish the effectiveness of theDiEvD-SFframework by applying various candidate selection strategies.

The Low-Power and Lossy Network (LLN) is the most important building block in the Internet of Things (IoT), comprising numerous tiny sensor nodes connected together. The Routing Protocol for Low-Power and Lossy Networks (RPL) is an IPv6-based protocol developed by the Internet Engineering Task Force (IETF) to facilitate routing for LLN devices. The Destination Advertisement Objects (DAOs) are transmitted from RPL nodes in the network toward the root node to construct downward routes. The malicious node exploits the DAO transmission mechanism to replay the DAO with a fixed time interval in the network in order to launch the DAO Insider attack. The DAO Insider attack causes a large number of DAO, which contributes to network congestion; as a result, data packets are delayed, and network performance is degraded. This paper proposes a defense solution that monitors DAO timestamps between child and parent nodes, flagging suspicious nodes that exceed a threshold within a time interval, blacklisting, and discarding DAOs from identified malicious nodes. Moreover, it limits the number of DAO transmitted by a child node within a specified time interval to mitigate the impact of an attack. The experiments show that the DAO insider attack has a negative impact on network performance (packet delivery ratio, average end-to-end delay, and throughput) at various DAO replay intervals. The proposed defense solution restores optimal network performance with a high detection rate.

Cloud security is of paramount importance in the new era of computing. Advanced malware can hide their behavior on detection of the presence of a security tool at a tenant virtual machine (TVM). Hence, TVM-layer security solutions are not reliable. In this paper, we propose a Virtual Machine Introspection (VMI) based security architecture design for fine granular monitoring of the virtual machines to detect known attacks and their variants. We have developed techniques for monitoring the TVMs at the process level and system call level to detect attacks such as those based on malicious hidden processes, attacks that disable security tools in the virtual machines and attacks that alter the behavior of legitimate applications to access sensitive data. Our architecture, VMGuard, utilizes the introspection feature at the VMM-layer to analyze system call traces of programs running on TVM. VMGuard applies the software breakpoint injection technique which is OS agnostic and can be used to trap the execution of programs. Motivated by text mining approaches, VMGuard provides `Bag of n-grams (BonG)' approach integrated with Term Frequency-Inverse Document Frequency (TF-IDF) method, to extract and select features of normal and attack traces. It then applies the Random Forest classifier to produce a generic behavior for different categories of intrusions of the monitored TVM. We have implemented a prototype and conducted a detailed analysis using University of New Mexico (UNM) datasets and a Windows malware dataset obtained from the University of California. The results obtained are promising and demonstrate the applicability of the VMGuard. We compare VMGuard with existing techniques and discuss its advantages.

During the last decade, there has been profound progress in the field of visual saliency. However, there still exist various major challenges that hinder the detection performance for scenes with complex composition, presence of additive noise, objects of diverse scale and rotations etc. Generally, images with additive noise have low spatial resolution and blurred edges, which affects the learning capability of the network and causes inaccurate detection. In order to address these issues, in this study, the authors propose a fully convolutional neural network which jointly denoise the input maps by learning edges and contrast details, followed by learning of residing salient details via colour spatial maps in an end‐to‐end fashion. Their framework employs convolutional layers that use gradient and contrast details of images to denoise the areas with high edge density. After denoising, the denoised images are subjected to salient object detection (SOD) using convolutional layers. The effectiveness of the proposed network is evaluated on benchmark datasets. The experimental results demonstrate the significant performance improvement of the proposed method over state‐of‐the‐art detection techniques.

Summary Cloud computing provides on demand provisioning of resources mostly offered as Infrastructure as a Service. The flexibility in services has opened doors for attackers. Research has been performed to detect various malware in the last few years. However, modern malware are advanced enough to detect the presence of virtualization environment, security analyzer, or even the hypervisor by observing the virtualization‐specific information such as virtual processor features, timing features, etc. The malware exhibit evasive nature and can fool existing security solutions by performing modern antidetection tactics. In this paper, we propose an approach named as VMI‐assisted evasion detection (VAED), deployed at virtual machine monitor, to detect the evasion‐based malware attacks. The VAED is based on learning the program semantic of evasive malware. It uses system call dependency graph approach generated using Markov Chain principle and keeps track of system call ordering with transition probability distribution between each pair system calls. It uses software break point injection technique to extract the system call traces of evasive malware samples, which is free from any modification in hardware‐specific values. Hence, it is secure from evasion attempts. The VAED is validated over evasive samples collected from the University of California on request, and results seem to be promising.