Encryption technologies randomize network communication to protect user privacy. However, attackers exploit encrypted traffic to conceal malicious activities. The existing detection methods rely primarily on traffic content or interactive patterns. Nevertheless, static methods can be easily obfuscated by advanced attacks. Since the set of potential attacks is open and infinite, models regularly lose effectiveness against novel attacks. Robust encrypted malicious traffic detection remains a valuable research area. In this paper, we propose BSTS-Net, a robust unsupervised encrypted malicious traffic detection model based entirely on traffic relations. The key motivations are to construct a relation-based traffic contextual representation and to establish dynamic baselines for anomaly detection. To represent local relations within flows, we innovatively introduce the concept of traffic microelements, which capture fine-grained interaction pattern relations. To integrate the global relationships between flows, we construct a traffic microelement space based on the Siamese neural network. Three optimization functions are proposed to optimize the intraservice, interservice and internode relations. For robust detection, we introduce a reputation-enhanced dynamic encrypted traffic detection algorithm that constructs dynamic baselines and continuously detects novel anomalies. We evaluate BSTS-Net through extensive experiments on three datasets and compare it with seven SOTA methods. Our results demonstrate its superiority, with an F1 score of more than 99.63% across all the datasets in multiclassification scenarios. Additionally, we simulate three adversarial scenarios for robustness analysis. Although the baseline methods experience an F1 score degradation of 32.21%, BSTS-Net achieves high performance, with only 1% degradation.

The Domain Name System (DNS) plays a critical role in the Internet, making it a popular target for cyber attackers. Malicious actors use DNS to locate their command and control servers, and spam often contains URLs linked to domains that host malicious servers. Detecting such malicious domain activities is essential. While many prior works have shown promising results in detecting malicious domains, the time and storage required during detection are relatively high.In this paper, we propose a lightweight and effective malicious domain detection system called Quicksolver, ideal for large-scale networks. Our system uses only domain features, eliminating the need for additional costs associated with DNS traffic and registration information. Additionally, we use an improved autoencoder as our classifier, combining it with neural networks to avoid the need for setting and adjusting thresholds manually.We evaluated Quicksolver using malicious data collected from a certain ISP over three months. The results show that Quicksolver has better detection ability and lower detection time compared to other state-of-the-art methods. Furthermore, it can automatically identify unknown malicious domains that are misused in seven types of cyber attacks.

As network technologies have been developing rapidly, web applications have been widely used. Meanwhile, more and more web attacks have appeared. These attacks have caused a lot of losses to individuals or organizations. A large number of web access logs also bring huge challenges to the attack detection. In this paper, we propose a system ELSV(Ensemble Learning classification with Semantic Vectorization) to detect anomaly web access logs. We use the difference of word occurrence between different types of web access logs to refine the formatted log data, strengthening the distinction between them. The Word2Vec method and TextCNN model are applied to extract vectorized features, making feature extraction more automated and intelligent. We use the ensemble learning classification algorithm as the final classifier, improving the overall classification performance. ELSV is tested on the HTTP DATASET CSIC 2010. The final experimental results show that ELSV achieved 98.48% F1-score and 99.74% AUC, proving the efficacy of it.

Summary The increase of security incidents brings a challenge to the cloud computing security. Intrusion detection technologies have been applied to protect information in cloud from being compromised, and complicated learning‐based detection methods have been used to improve the performance of intrusion detection systems. Higher quality and well‐formed samples are crucial to the performance of detection algorithm. Therefore, we mainly study the intrusion detection model based on data optimization processing. In this article, we establish an intrusion detection algorithm based on ensemble support vector machine with bag representation. Specifically, the sample flows are divided into bags, where the sample flows in each bag are related to each other. Each bag contains multiple related data flows that can accurately reflect intrusion behavior, especially persistent intrusion. What's more, ensemble algorithm is applied to detection model, which greatly optimizes the performance of detection algorithm. The experimental results on open access datasets show that the proposed model detects the persistent attack with 90.58% recall.

Hybrid learning approaches prove to be superior to single technologies in the field of intrusion detection. Moreover, the representative feature is a determinant of generating accurate signatures and improving detection performance. In this paper, we propose a hybrid intrusion detection algorithm based on Gaussian Mixture Model (GMM) and k-Nearest Neighbors (k-NN). More specifically, we first implement GMM to characterize the spatial distribution of each category. Then, a novel GMM-based data formation method is performed to extract distance and density features, called GMDD. By sufficiently utilizing the classification information contained in the original data, GMDD constructs concise and high-quality characteristics. Finally, k-NN is trained and tested on newly transformed datasets to build the detection model. The experimental results on KDD'99 and NSL-KDD datasets indicate that the proposed method not only outperforms other recent studies in terms of accuracy, detection rate and false alarm rate, but also provides excellent computational efficiency.

At present, intrusion detection system (IDS) focuses on classifying the network traffic individually and may overlook underlying correlation among adjacent attack behaviors. This paper proposes an attack behaviors prediction model based on bag representation in time series. We aggregate traffic flows into bags, and describe the distribution of data within each bag using Gaussian mixture model (GMM). The change of history data is measured and added into current bag features. The experimental results based on the Kyoto 2006+ dataset show that the approach successfully predicting the number of security incidents.

Summary Cloud servers provide cloud users with storage service and allow cloud users to access their files anytime. To guarantee security of the stored files, auditors need to periodically verify data block correctness. In the existing integrity verification schemes, there are few protocols to support the users' identity anonymity and the data block dynamic operation simultaneously. In this paper, we present an efficient and anonymous identity‐based integrity auditing protocol, which supports data dynamic operation and can be extended to support batch auditing in the multifile or multiuser setting. Our scheme not only resists forgery, replace, and replay attacks but also maintains users' anonymity, which is not discussed in other related techniques. The computation efficiency of auditor is improved a lot. Comparing with Zhang's efficient identity‐based public auditing scheme, our scheme is more suitable for actual application scenario with large‐scale storage system.

Summary Verifying the integrity of outsourced data is an important issue in cloud storage. Recently, many integrity verify protocols have been proposed that can support the public verifiability, data dynamics, and privacy against verifiers but involve a third‐party auditor's participation. In this work, we propose a novel identity‐based storage management and integrity verify protocol for secure outsourcing in multi‐cloud. From theoretical analysis and a lot of simulation experiments, we show our proposed protocol is secure and efficient, without using any trusted organizer. Furthermore, the protocol enjoys many important security attributes including prevention of various attacks, user anonymity, local password verification, and so on. Copyright © 2015 John Wiley & Sons, Ltd.