Accurate X-ray screening systems are of paramount importance in the present day. Most existing systems predict only on the basis of a single image, which could lead to false positives and false ...negatives due to limited information present. We implemented several approaches using single, two and multiple X-Ray views to make a reliable and practical model with varying levels of success in threat object detection. These approaches include long-established methods such as Bag of Visual Words (BOVW), 3D Object Recognition, Adaptive Implicit Shape Model and Deep Neural Networks. The approaches took in dual inputs to make more informed predictions. Varying levels of success are obtained in these methods ranging from 73% using BOVW to 87% using Deep CNN. It was observed that, when two views of an object are considered, an improvement of 5% to 15% in performance took place (considering various approaches) compared to a single view.
A plethora of research is available for detecting and mitigating threats that occur across the organization's boundaries. However, Insider Threat Detection has only recently entered the limelight. It ...turns out to be a daunting task, given that insiders can evade firewalls, Intrusion Detection Systems, and other security mechanisms aimed at protecting the information infrastructure from outside attacks. In addition to this, some insiders having administrative rights to access privileged information and perform operations on it might turn rogue. Their malicious actions could go undetected as their digital footprint might get buried in massive dumps of log data. This survey aims to provide a comprehensive explanation of the problem statement at hand, Insider Threat Detection using Deep Learning. It has been initiated by introducing Insider Threat Detection and related terminology. Deep Learning has been chosen as the preferred approach for solving this problem statement as it has been proven to be better than the conventional Machine Learning algorithms while dealing with complex data originating from varied sources. Here, Deep Learning and Log based Anomaly Detection have been explained. Some datasets available specifically for the research domain of Insider Threat Detection have been brought under one roof. Then, by having a closer look at the CERT Insider Threat Dataset, a brief comparative analysis of the existing Deep Learning solutions for Insider Threat Detection based on this dataset is provided. Also, this work overviews the challenges faced and how they open doors for further research. In order to cater to the readers looking for an industry-oriented approach, this survey explains how a Deep Learning model can be integrated with the Elasticsearch-Logstash-Kibana (ELK) Stack.
Evolving computing paradigms are progressively introducing new design, development, and operation models for digital services, which increasingly leverage service-oriented architectures and ...microservices patterns to create data-centric applications. This approach eventually brings more agility in the overall service lifetime management, but also introduces additional security and privacy concerns that cannot be effectively addressed by legacy device- and infrastructure-centric models. The GUARD project developed an extensible platform for building detection and analytics services for advanced assurance and protection of trustworthy and reliable business chains which span multiple administrative domains and heterogeneous infras-tructures. GUARD advocates the implementation of embedded security capabilities in digital services, that can be accessed and orchestrated through API similar to what already happens for management and operation purposes. GUARD features are demonstrated on two challenging use cases, in the Smart Mobility and eHealth domains.
With the population of the world increasing substantially decade after decade, the probability of terrorist attacks on people will increase. Detecting terrorists with dangerous objects is necessary. ...Airport security is very good, but how about other forms of public transportation such as subways and city buses? More threat detection is expected in these areas. Our research work focuses on developing a system made of two main parts to detect and classify dangerous objects placed on the chest of terrorists. The first part is made up of Wi- Fi imaging. Images are created using Wi-Fi signals scanning a person head-to-toe with a 2\mathrm{x}2 antenna array. The second part uses a Region-based Convolutional Neural Network to classify whether the Wi-Fi image contains a dangerous object or something harmless such as a tablet. Our results demonstrate the feasibility of the proposed system. Also, our system only uses one out of many channels used in the Wi-Fi bandwidth, which allows for the remaining channels to be used for users' Internet applications on public transportation.
Cloud computing provides industry, government, and academic users' convenient and cost-effective access to distributed services and shared data via the Internet. Due to its distribution of diverse ...users and aggregation of immense data, cloud computing has increasingly been the focus of targeted attacks. Meta-analysis of industry studies and retrospective research involving cloud service providers reveal that cloud computing is demonstrably vulnerable to a particular type of targeted attack, Advanced Persistent Threats (APTs). APTs have proven to be difficult to detect and defend against in cloud based infocommunication systems. The prevalent use of polymorphic malware and encrypted covert communication channels make it difficult for existing packet inspecting and signature based security technologies such as; firewalls, intrusion detection sensors, and anti-virus systems to detect APTs. In this paper, we examine the application of an alternative security approach which applies an algorithm derived from flow based monitoring to successfully detect APTs. Results indicate that statistical modeling of APT communications can successfully develop deterministic characteristics for detection is a more effective and efficient way to protect against APTs.
Cyber-attacks toward cyber-physical systems are one of the main concerns of smart grid's operators. However, many of these cyber-attacks, are toward unmanned substations where the cyber-attackers ...needs to be close enough to substation to malfunction protection and control systems in substations, using Electromagnetic signals. Therefore, in this paper, a new threat detection algorithm is proposed to prevent possible cyber-attacks toward unmanned substations. Using surveillance camera's streams and based on You Only Look Once (YOLO) V3, suspicious objects in the image are detected. Then, using Intersection over Union (IOU) and Generalized Intersection Over Union (GIOU), threat distance is estimated. Finally, the estimated threats are categorized into three categories using color codes red, orange and green. The deep network used for detection consists of 106 convolutional layers and three output prediction with different resolutions for different distances. The pre-trained network is transferred from Darknet-53 weights trained on 80 classes.
Broad network bandwidth and deep inspection impose great challenge for the capability of 10Gpbs network security monitoring. Proper scheduling policies can improve system capability without requiring ...additional resources. LAS, a size-based scheduling policy which can achieve optimal mean response time by giving preferential analysis to short flows, is widely used in various aspects of network field. Due to the high variability property of Internet traffic, LAS favors short flows without penalizing large flows very much. Unfortunately, the inspection of large flows can not be guaranteed in those network intrusion detection systems on 10Gbps links, which are usually heavily loaded, or even overloaded. Although tiny in percentage, large flows comprise more than 50% of the total load, and therefore can not be ignored, especially when specified by users as critical. How to avoid starving large flows while still giving higher priority to short flows is a dilemma we have to face in practice. In this paper, we propose a QoS-supported three-level scheduling policy (QTL), which can remedy LAS' defect. The experimental results show that our QTL scheduling policy has approximately the same performance as LAS for short flows, and meanwhile exhibits greatly enhanced processing capability for large flows.
Insider threat is a prominent cyber-security danger faced by organizations and companies. In this research, we study and evaluate an insider threat detection workflow using supervised and ...unsupervised learning algorithms. To this end, we study data exploration and analysis, anomaly detection and malicious behaviour classification on a publicly available data set. We evaluate several supervised and unsupervised learning algorithms - HMM, SOM, and DT - using this workflow.
Cyber security is an important concern in critical infrastructures such as banking and financial organizations, where a number of malicious insiders are involved. These insiders may be existing ...employees / users present within the organization and causing harm by performing any malicious activity and are commonly known as insider threats. Existing insider threat detection (ITD) methods are based on statistical analysis, machine and deep learning approaches. They monitor and detect malicious user activity based on pre-built rules which fails to detect unforeseen threats. Also, some of these methods require explicit feature engineering which results in high false positives. Apart from this, some methods choose relatively insufficient features and are computationally expensive which affects the classifier's accuracy. Hence, in this paper, a user behaviour based ITD method is presented to overcome the above limitations. It is a conceptually simple and flexible approach based on augmented decision making and anomaly detection. It consists of bi-directional long short term memory (bi-LSTM) for efficient feature extraction. For the purpose of classifying users as "normal" or "malicious", a binary class support vector machine (SVM) is used. CMU-CERT v4.2 dataset is used for testing the proposed method. The performance is evaluated using the following parameters: Accuracy, Precision, Recall, F- Score and AUC-ROC. Test results show that the proposed method outperforms the existing methods.
PDF
