TOWARDS A HOLISTIC EFFICIENT STACKING ENSEMBLE INTRUSION DETECTION SYSTEM USING NEWLY GENERATED HETEROGENEOUS DATASETS

With the exponential growth of network-based applications globally, there has been a transformation in organizations\u27 business models. Furthermore, cost reduction of both computational devices and the internet have led people to become more technology dependent. Consequently, due to inordinate use of computer networks, new risks have emerged. Therefore, the process of improving the speed and accuracy of security mechanisms has become crucial.Although abundant new security tools have been developed, the rapid-growth of malicious activities continues to be a pressing issue, as their ever-evolving attacks continue to create severe threats to network security. Classical security techniquesfor instance, firewallsare used as a first line of defense against security problems but remain unable to detect internal intrusions or adequately provide security countermeasures. Thus, network administrators tend to rely predominantly on Intrusion Detection Systems to detect such network intrusive activities. Machine Learning is one of the practical approaches to intrusion detection that learns from data to differentiate between normal and malicious traffic. Although Machine Learning approaches are used frequently, an in-depth analysis of Machine Learning algorithms in the context of intrusion detection has received less attention in the literature.Moreover, adequate datasets are necessary to train and evaluate anomaly-based network intrusion detection systems. There exist a number of such datasetsas DARPA, KDDCUP, and NSL-KDDthat have been widely adopted by researchers to train and evaluate the performance of their proposed intrusion detection approaches. Based on several studies, many such datasets are outworn and unreliable to use. Furthermore, some of these datasets suffer from a lack of traffic diversity and volumes, do not cover the variety of attacks, have anonymized packet information and payload that cannot reflect the current trends, or lack feature set and metadata.This thesis provides a comprehensive analysis of some of the existing Machine Learning approaches for identifying network intrusions. Specifically, it analyzes the algorithms along various dimensionsnamely, feature selection, sensitivity to the hyper-parameter selection, and class imbalance problemsthat are inherent to intrusion detection. It also produces a new reliable dataset labeled Game Theory and Cyber Security (GTCS) that matches real-world criteria, contains normal and different classes of attacks, and reflects the current network traffic trends. The GTCS dataset is used to evaluate the performance of the different approaches, and a detailed experimental evaluation to summarize the effectiveness of each approach is presented. Finally, the thesis proposes an ensemble classifier model composed of multiple classifiers with different learning paradigms to address the issue of detection accuracy and false alarm rate in intrusion detection systems

The Proceedings of 15th Australian Information Security Management Conference, 5-6 December, 2017, Edith Cowan University, Perth, Australia

Conference Foreword The annual Security Congress, run by the Security Research Institute at Edith Cowan University, includes the Australian Information Security and Management Conference. Now in its fifteenth year, the conference remains popular for its diverse content and mixture of technical research and discussion papers. The area of information security and management continues to be varied, as is reflected by the wide variety of subject matter covered by the papers this year. The papers cover topics from vulnerabilities in “Internet of Things” protocols through to improvements in biometric identification algorithms and surveillance camera weaknesses. The conference has drawn interest and papers from within Australia and internationally. All submitted papers were subject to a double blind peer review process. Twenty two papers were submitted from Australia and overseas, of which eighteen were accepted for final presentation and publication. We wish to thank the reviewers for kindly volunteering their time and expertise in support of this event. We would also like to thank the conference committee who have organised yet another successful congress. Events such as this are impossible without the tireless efforts of such people in reviewing and editing the conference papers, and assisting with the planning, organisation and execution of the conference. To our sponsors, also a vote of thanks for both the financial and moral support provided to the conference. Finally, thank you to the administrative and technical staff, and students of the ECU Security Research Institute for their contributions to the running of the conference

Computer Criminal Profiling applied to Digital Investigations

This PhD thesis aims to contribute to the Cyber Security body of knowledge and its Computer Forensic field, still in its infancy when comparing with other forensic sciences. With the advancements of computer technology and the proliferation of cyber crime, offenders making use of computers range from state-sponsored cyber squads to organized crime rings; from cyber paedophiles to crypto miners abusing third-party computer resources. Cyber crime is not only impacting the global economy in billions of dollars annually; it is also a life-threatening risk as society is increasingly dependent on critical systems like those in air traffic control, hospitals or connected cars. Achieving cyber attribution is a step towards to identify, deter and prosecute offenders in the cyberspace, a domain among the top priorities for the UK National Security Strategy. However, the rapid evolution of cyber crime may be an unprecedented challenge in the forensic science history. Attempts to keep up with this pace often result in computer forensic practices limited to technical outcomes, like user accounts or IP addresses used by the offenders. Limitations are intensified when the current cyber security skill shortage contrasts with the vastness of digital crime scenes presented by cloud providers and extensive storage capacities or with the wide range of available anonymizing mechanisms. Quite often, offenders are remaining unidentified, unpunished, and unstoppable. As these anonymising mechanisms conceal offenders from a technological perspective, it was considered that they would not offer the same level of concealment from a behavioural standpoint. Therefore, in addition to the analysis of the state-of-theart of cyber crimes and anonymising mechanisms, the literature of traditional crimes and criminal psychology was reviewed, in an attempt to known what traits of human behaviour could be revealed by the evidence at a crime scene and how to recognize them. It was identified that the subdiscipline of criminology called criminal profiling helps providing these answers. Observing its success rate and benefits as a support tool in traditional investigations, it was hypothesized that a similar outcome could be achieved while investigating cyber crimes, providing that a framework could enable digital investigators to apply criminal profiling concepts in digital investigations. 2 Before developing the framework, the scope of this thesis was delimited to a subset of cyber crimes, consisting exclusively of computer intrusions cases. Also, among potential criminal profiling benefits, the reduction of the suspect pool, case linkage and optimization of investigative efforts were included in the scope. A SSH honeypot experiment based on Cowrie was designed and deployed in a public cloud infrastructure. In its first phase, a single honeypot instance was launched, protected by username and password and accepting connection attempts from any Internet address. Users that were able to guess a valid pair of credentials, after a random number of attempts providing strong passwords, were presented to a simple file system, in which all their interactions within the system were recorded and all downloaded attack tools were isolated and securely stored for their posterior analysis. In the second phase of the experiment, the honeypot infrastructure was expanded to a honeynet with 18 (eighteen) nodes, running in a total of 6 (six) geographic regions and making it possible the analysis of additional variables like location of the “victim” system, perceived influence from directory/file structure/contents and resistance levels to password attacks. After a period of approximately 18 (eighteen) months, more than 7 million connection attempts and 12 million authentication attempts were received by the honeynet, where more than 85,000 were able to successfully log into one of the honeynet servers. Offenders were able to interact with the simulated operating systems and their files, while enabling this research to identify behavioural patterns that proved to be useful not only to group offenders, but also to enrich individual offender profiles. Among these behavioural patterns, the choice of which commands and which parameters to run, the basis of the attack on automated versus manual means, the pairs of usernames and passwords that were provided to try to break the honeypot authentication, their response once a command was not successful, their intent on using specific attack tools and the motivation behind it, any level of caution presented and, finally, preferences for naming tools, temporary files or customized ports were some of the most relevant attributes. Based on the collected data set, such attributes successfully make it possible to narrow down the pools of suspects, to link different honeypot breakins to a same offender and to optimize investigative efforts by enabling the researcher to focus the analysis in a reduced area while searching for evidence. 3 In times when cyber security skills shortage is a concerning challenge and where profiling can play a critical role, it is believed that such a structured framework for criminal profiling within cyber investigations can help to make investigation of cyber crimes quicker, cheaper and more effective

Detecting User Behavior in Cyber Threat Intelligence: Development of Honeypsy System.

This research demonstrates a design of an experiment of a hacker infiltrating a server where it is assumed that the communication between the hacker and the target server is established, and the hacker also escalated his rights on the server. Therefore, the honeypot server setup has been designed to reveal the correlation of a hacker’s actions with that of the hacker’s experience, personality, expertise, and psychology. To the best of our knowledge, such a design of experiment has never been tested rigorously on a honeypot implementation except for self-reporting tests applied to hackers in the literature. However, no study evaluates the actual data of these hackers and these tests. This study also provides a honeypot design to understand the personality and expertise of the hacker and displays the correlation of these data with the tests. Our Honeypsy system is composed of a Big-5 personality test, a cyber expertise test, and a capture-the-flag (CTF) event to collect logs with honeypot applied in this sequence. These three steps generate data on the expertise and psychology of known cyber hackers. The logs of the known hacker activities on honeypots are obtained through the CTF event that they have participated in. The design and deployment of a honeypot, as well as the CTF event, were specifically prepared for this research. Our aim is to predict an unknown hacker's expertise and personality by analyzing these data. By examining/analyzing the data of the known hackers, it is now possible to make predictions about the expertise and personality of the unknown hackers. The same logic applies when one tries to predict the next move of the unknown hackers attacking the server. We have aimed to underline the details of the personalities and expertise of hackers and thus help the defense experts of victimized institutions to develop their cyber defense strategies in accordance with the modus operandi of the hackers

Security Technologies and Methods for Advanced Cyber Threat Intelligence, Detection and Mitigation

The rapid growth of the Internet interconnectivity and complexity of communication systems has led us to a significant growth of cyberattacks globally often with severe and disastrous consequences. The swift development of more innovative and effective (cyber)security solutions and approaches are vital which can detect, mitigate and prevent from these serious consequences. Cybersecurity is gaining momentum and is scaling up in very many areas. This book builds on the experience of the Cyber-Trust EU project’s methods, use cases, technology development, testing and validation and extends into a broader science, lead IT industry market and applied research with practical cases. It offers new perspectives on advanced (cyber) security innovation (eco) systems covering key different perspectives. The book provides insights on new security technologies and methods for advanced cyber threat intelligence, detection and mitigation. We cover topics such as cyber-security and AI, cyber-threat intelligence, digital forensics, moving target defense, intrusion detection systems, post-quantum security, privacy and data protection, security visualization, smart contracts security, software security, blockchain, security architectures, system and data integrity, trust management systems, distributed systems security, dynamic risk management, privacy and ethics

Security Technologies and Methods for Advanced Cyber Threat Intelligence, Detection and Mitigation

The rapid growth of the Internet interconnectivity and complexity of communication systems has led us to a significant growth of cyberattacks globally often with severe and disastrous consequences. The swift development of more innovative and effective (cyber)security solutions and approaches are vital which can detect, mitigate and prevent from these serious consequences. Cybersecurity is gaining momentum and is scaling up in very many areas. This book builds on the experience of the Cyber-Trust EU project’s methods, use cases, technology development, testing and validation and extends into a broader science, lead IT industry market and applied research with practical cases. It offers new perspectives on advanced (cyber) security innovation (eco) systems covering key different perspectives. The book provides insights on new security technologies and methods for advanced cyber threat intelligence, detection and mitigation. We cover topics such as cyber-security and AI, cyber-threat intelligence, digital forensics, moving target defense, intrusion detection systems, post-quantum security, privacy and data protection, security visualization, smart contracts security, software security, blockchain, security architectures, system and data integrity, trust management systems, distributed systems security, dynamic risk management, privacy and ethics

Economics of information security - Impact of government enforcement on hackers' behaviors - An event study analysis

Master'sMASTER OF SCIENC

Inner-Eye: Appearance-based Detection of Computer Scams

As more and more inexperienced users gain Internet access, fraudsters are attempting to take advantage of them in new ways. Instead of sophisticated exploitation techniques, simple confidence tricks can be used to create malware that is both very effective and likely to evade detection by traditional security software. Heuristics that detect complex malicious behavior are powerless against some common frauds. This work explores the use of imaging and text-matching techniques to detect typical computer scams such as pharmacy and rogue antivirus frauds. The Inner-Eye system implements the chosen approach in a scalable and efficient manner through the use of virtualization