In modern automobiles, a Controller Area Network (CAN) bus facilitates communication among all electronic control units for critical safety functions, including steering, braking, and fuel injection. However, due to the lack of security features, it may be vulnerable to malicious bus traffic-based attacks that cause the automobile to malfunction. Such malicious bus traffic can be the result of either external fabricated messages or direct injection through the on-board diagnostic port, highlighting the need for an effective intrusion detection system to efficiently identify suspicious network flows and potential intrusions. This work introduces Residually Interconnected and Superimposed Kolmogorov-Arnold Networks (RISK-4-Auto), a set of four deep neural network architectures for intrusion detection targeting in-vehicle network traffic classification. RISK-4-Auto models, when applied on three hexadecimally identifiable sequence-based open-source datasets (collected through direct injection in the on-board diagnostic port), outperform six state-of-the-art vehicular network intrusion detection systems (as per their accuracies) by ≈1.0163% for all-class classification and ≈2.5535% on focused (single-class) malicious flow detection. Additionally, RISK-4-Auto enjoys a significantly lower overhead than existing state-of-the-art models, and is suitable for real-time deployment in resource-constrained automotive environments.

In recent years, CAPTCHA has been used as a panacea against HTTP-based Distributed Denial of Service (DDoS) attacks. However, they also cause a lot of inconvenience to legitimate users. In this paper, we present a framework to exploit the synchronized behaviour of bots to exhaust Web server resources. Clustering technique is used to form separate group of attackers and legitimate users. The clusters of attackers are identified by the high workload they generate on the server. They are challenged with CAPTCHAs to mitigate the attack while the legitimate users browse the website without any restriction. The proposed framework was tested using botnets and real web traffic. Results show our frame work has a high detection rate.

Abstract Network‐based attacks such as denial‐of‐service attacks are usually performed by spoofing the source IP address. Packet marking techniques are used to trace such attackers as close as possible to their source. A packet mark consists of some traceback information pertaining to a router being embedded in the IP packet header. In this work, we use the concept of star coloring to assign reusable colors (marks) to routers but at the same time limits false positives and false negatives. The proposed scheme minimizes the bit space required for marking in the IP header. We introduce the concept ofpath identifier, to identify an attack path. Thepath identifiersare used to provide an elegant solution to collect attack packets in the midst of a distributed denial‐of‐service attack and then traceback. Although identifying the attacker is crucial to institute protection measures against future attacks, it cannot mitigate the effects of an ongoing attack. We establish the use ofpath identifiers, to filter packets during an ongoing attack. We present a validation of the proposed techniques in an emulated environment using real attack traffic. Copyright © 2014 John Wiley & Sons, Ltd.