Submit to Algorithms Review for Algorithms Propose a Special Issue

Journal Browser

AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection

Print Special Issue Flyer
Special Issue Editors
Special Issue Information
Keywords
Published Papers

A special issue of Algorithms (ISSN 1999-4893). This special issue belongs to the section "Evolutionary Algorithms and Machine Learning".

Deadline for manuscript submissions: closed (31 March 2023) | Viewed by 31174

Printed Edition Available!
A printed edition of this Special Issue is available here.

Special issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection book cover image

Share This Special Issue

Special Issue Editors

Prof. Dr. Francesco Bergadano

E-Mail Website
Guest Editor

Department of Computer Science, University of Torino, Via Pessinetto 12, 10149 Torino, Italy
Interests: cybersecurity; identity and access management; security analytics
Special Issues, Collections and Topics in MDPI journals

Prof. Dr. Giorgio Giacinto

E-Mail Website
Guest Editor

Department of Electrical and Electronic Engineering, University of Cagliari, Piazza d’Armi, 09123 Cagliari, Italy
Interests: cybersecurity; machine learning; malware analysis; malware detection; adversarial learning; cyber threat intelligence
Special Issues, Collections and Topics in MDPI journals

Special Issue Information

Dear Colleagues,

We are pleased to invite you to submit a paper to the MDPI Algorithms Special Issue “AI for Cybersecurity: Robust Models for Authentication, Threat and Anomaly Detection”.

Cybersecurity models include provisions for legitimate user and agent authentication as well as algorithms for detecting external threats, such as intruders and malicious software. In particular, we focus on a continuum of cybersecurity measures ranging from user identification through to risk-based and multilevel authentication, complex application and network monitoring and anomaly detection. We will refer to this as the “anomaly detection continuum”.

Machine learning and artificial intelligence can provide powerful tools for addressing such issues, but the robustness of the obtained models is often ignored or underestimated. On the one hand, AI-based algorithms can be replicated by malicious opponents, and attacks can be devised so that they will not be detected (elusion attacks). On the other hand, data and system contexts can be modified by attackers in order to influence the countermeasures obtained from machine learning and render them ineffective (active data poisoning).

For this Special Issue, we would like to attract papers that address the robustness and effectiveness of AI-based algorithms that are applied to cybersecurity, with particular reference to the following list of issues in the anomaly detection continuum:

Biometric and behavioral user identification algorithms;
User and agent authentication algorithms;
Two-factor and multilevel authentication;
Risk-aware authentication;
Continuous authentication algorithms;
Network anomaly detection;
Anomaly detection through machine learning;
Malicious software classification and detection;
Misuse detection in social networks;
Threat and security intelligence.

The Special Issue will include research works to be selected from the 2022 Ital-IA workshop on AI and cybersecurity.

Prof. Dr. Francesco Bergadano
Prof. Dr. Giorgio Giacinto
Guest Editors

Manuscript Submission Information

Manuscripts should be submitted online at www.mdpi.com by registering and logging in to this website. Once you are registered, click here to go to the submission form. Manuscripts can be submitted until the deadline. All submissions that pass pre-check are peer-reviewed. Accepted papers will be published continuously in the journal (as soon as accepted) and will be listed together on the special issue website. Research articles, review articles as well as short communications are invited. For planned papers, a title and short abstract (about 100 words) can be sent to the Editorial Office for announcement on this website.

Submitted manuscripts should not have been published previously, nor be under consideration for publication elsewhere (except conference proceedings papers). All manuscripts are thoroughly refereed through a single-blind peer-review process. A guide for authors and other relevant information for submission of manuscripts is available on the Instructions for Authors page. Algorithms is an international peer-reviewed open access monthly journal published by MDPI.

Please visit the Instructions for Authors page before submitting a manuscript. The Article Processing Charge (APC) for publication in this open access journal is 1600 CHF (Swiss Francs). Submitted papers should be well formatted and use good English. Authors may use MDPI's English editing service prior to publication or during author revisions.

Keywords

anomaly detection
threat intelligence
malware detection
continuous user authentication
biometric and behavioral identification
adversarial learning
natural language processing for cybersecurity
RPA for security management
adaptive incident detection and response
adaptive endpoint protection

Published Papers (11 papers)

Download All Papers

Editorial

Jump to: Research

3 pages, 164 KiB

Open AccessEditorial

Special Issue “AI for Cybersecurity: Robust Models for Authentication, Threat and Anomaly Detection”

by Francesco Bergadano and Giorgio Giacinto

Algorithms 2023, 16(7), 327; https://doi.org/10.3390/a16070327 - 07 Jul 2023

Viewed by 1369

Abstract

Cybersecurity models include provisions for legitimate user and agent authentication, as well as algorithms for detecting external threats, such as intruders and malicious software [...] Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

Research

Jump to: Editorial

18 pages, 651 KiB

Open AccessArticle

An Adaptive Deep Learning Neural Network Model to Enhance Machine-Learning-Based Classifiers for Intrusion Detection in Smart Grids

by Xue Jun Li, Maode Ma and Yihan Sun

Algorithms 2023, 16(6), 288; https://doi.org/10.3390/a16060288 - 02 Jun 2023

Cited by 2 | Viewed by 1759

Abstract

Modern smart grids are built based on top of advanced computing and networking technologies, where condition monitoring relies on secure cyberphysical connectivity. Over the network infrastructure, transported data containing confidential information, must be protected as smart grids are vulnerable and subject to various cyberattacks. Various machine learning based classifiers were proposed for intrusion detection in smart grids. However, each of them has respective advantage and disadvantages. Aiming to improve the performance of existing machine learning based classifiers, this paper proposes an adaptive deep learning algorithm with a data pre-processing module, a neural network pre-training module and a classifier module, which work together classify intrusion data types using their high-dimensional data features. The proposed Adaptive Deep Learning (ADL) algorithm obtains the number of layers and the number of neurons per layer by determining the characteristic dimension of the network traffic. With transfer learning, the proposed ADL algorithm can extract the original data dimensions and obtain new abstract features. By combining deep learning models with traditional machine learning-based classification models, the performance of classification of network traffic data is significantly improved. By using the Network Security Laboratory-Knowledge Discovery in Databases (NSL-KDD) dataset, experimental results show that the proposed ADL algorithm improves the effectiveness of existing intrusion detection methods and reduces the training time, indicating a promising candidate to enhance network security in smart grids. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

25 pages, 842 KiB

Open AccessArticle

From Iris Image to Embedded Code: System of Methods

by Ivan Matveev and Ilia Safonov

Algorithms 2023, 16(2), 87; https://doi.org/10.3390/a16020087 - 06 Feb 2023

Cited by 1 | Viewed by 1252

Abstract

Passwords are ubiquitous in today’s world, as are forgetting and stealing them. Biometric signs are harder to steal and impossible to forget. This paper presents a complete system of methods that takes a secret key and the iris image of the owner as input and generates a public key, suitable for storing insecurely. It is impossible to obtain source data (i.e., secret key or biometric traits) from the public key without the iris image of the owner, the irises of other persons will not help. At the same time, when the iris image of the same person is presented the secret key is restored. The system has been tested on several iris image databases from public sources. It allows storing 65 bits of the secret key, with zero possibility to unlock it with the impostor’s iris and

10.4 %

probability to reject the owner in one attempt. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

18 pages, 837 KiB

Open AccessArticle

Detection of Cyberattacks and Anomalies in Cyber-Physical Systems: Approaches, Data Sources, Evaluation

by Olga Tushkanova, Diana Levshun, Alexander Branitskiy, Elena Fedorchenko, Evgenia Novikova and Igor Kotenko

Algorithms 2023, 16(2), 85; https://doi.org/10.3390/a16020085 - 03 Feb 2023

Cited by 12 | Viewed by 3058

Abstract

Cyberattacks on cyber-physical systems (CPS) can lead to severe consequences, and therefore it is extremely important to detect them at early stages. However, there are several challenges to be solved in this area; they include an ability of the security system to detect previously unknown attacks. This problem could be solved with the system behaviour analysis methods and unsupervised or semi-supervised machine learning techniques. The efficiency of the attack detection system strongly depends on the datasets used to train the machine learning models. As real-world data from CPS systems are mostly not available due to the security requirements of cyber-physical objects, there are several attempts to create such datasets; however, their completeness and validity are questionable. This paper reviews existing approaches to attack and anomaly detection in CPS, with a particular focus on datasets and evaluation metrics used to assess the efficiency of the proposed solutions. The analysis revealed that only two of the three selected datasets are suitable for solving intrusion detection tasks as soon as they are generated using real test beds; in addition, only one of the selected datasets contains both network and sensor data, making it preferable for intrusion detection. Moreover, there are different approaches to evaluate the efficiency of the machine learning techniques, that require more analysis and research. Thus, in future research, the authors aim to develop an approach to anomaly detection for CPS using the selected datasets and to conduct experiments to select the performance metrics. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

17 pages, 4585 KiB

Open AccessArticle

A Momentum-Based Local Face Adversarial Example Generation Algorithm

by Dapeng Lang, Deyun Chen, Jinjie Huang and Sizhao Li

Algorithms 2022, 15(12), 465; https://doi.org/10.3390/a15120465 - 08 Dec 2022

Cited by 2 | Viewed by 1211

Abstract

Small perturbations can make deep models fail. Since deep models are widely used in face recognition systems (FRS) such as surveillance and access control, adversarial examples may introduce more subtle threats to face recognition systems. In this paper, we propose a practical white-box adversarial attack method. The method can automatically form a local area with key semantics on the face. The shape of the local area generated by the algorithm varies according to the environment and light of the character. Since these regions contain major facial features, we generated patch-like adversarial examples based on this region, which can effectively deceive FRS. The algorithm introduced the momentum parameter to stabilize the optimization directions. We accelerated the generation process by increasing the learning rate in segments. Compared with the traditional adversarial algorithm, our algorithms are very inconspicuous, which is very suitable for application in real scenes. The attack was verified on the CASIA WebFace and LFW datasets which were also proved to have good transferability. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

15 pages, 999 KiB

Open AccessArticle

Tree-Based Classifier Ensembles for PE Malware Analysis: A Performance Revisit

by Maya Hilda Lestari Louk and Bayu Adhi Tama

Algorithms 2022, 15(9), 332; https://doi.org/10.3390/a15090332 - 17 Sep 2022

Cited by 10 | Viewed by 2839

Abstract

Given their escalating number and variety, combating malware is becoming increasingly strenuous. Machine learning techniques are often used in the literature to automatically discover the models and patterns behind such challenges and create solutions that can maintain the rapid pace at which malware evolves. This article compares various tree-based ensemble learning methods that have been proposed in the analysis of PE malware. A tree-based ensemble is an unconventional learning paradigm that constructs and combines a collection of base learners (e.g., decision trees), as opposed to the conventional learning paradigm, which aims to construct individual learners from training data. Several tree-based ensemble techniques, such as random forest, XGBoost, CatBoost, GBM, and LightGBM, are taken into consideration and are appraised using different performance measures, such as accuracy, MCC, precision, recall, AUC, and F1. In addition, the experiment includes many public datasets, such as BODMAS, Kaggle, and CIC-MalMem-2022, to demonstrate the generalizability of the classifiers in a variety of contexts. Based on the test findings, all tree-based ensembles performed well, and performance differences between algorithms are not statistically significant, particularly when their respective hyperparameters are appropriately configured. The proposed tree-based ensemble techniques also outperformed other, similar PE malware detectors that have been published in recent years. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

17 pages, 1342 KiB

Open AccessArticle

Sustainable Risk Identification Using Formal Ontologies

by Avi Shaked and Oded Margalit

Algorithms 2022, 15(9), 316; https://doi.org/10.3390/a15090316 - 02 Sep 2022

Cited by 4 | Viewed by 1805

Abstract

The cyber threat landscape is highly dynamic, posing a significant risk to the operations of systems and organisations. An organisation should, therefore, continuously monitor for new threats and properly contextualise them to identify and manage the resulting risks. Risk identification is typically performed manually, relying on the integration of information from various systems as well as subject matter expert knowledge. This manual risk identification hinders the systematic consideration of new, emerging threats. This paper describes a novel method to promote automated cyber risk identification: OnToRisk. This artificial intelligence method integrates information from various sources using formal ontology definitions, and then relies on these definitions to robustly frame cybersecurity threats and provide risk-related insights. We describe a successful case study implementation of the method to frame the threat from a newly disclosed vulnerability and identify its induced organisational risk. The case study is representative of common and widespread real-life challenges, and, therefore, showcases the feasibility of using OnToRisk to sustainably identify new risks. Further applications may contribute to establishing OnToRisk as a comprehensive, disciplined mechanism for risk identification. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

22 pages, 1304 KiB

Open AccessArticle

CVE2ATT&CK: BERT-Based Mapping of CVEs to MITRE ATT&CK Techniques

by Octavian Grigorescu, Andreea Nica, Mihai Dascalu and Razvan Rughinis

Algorithms 2022, 15(9), 314; https://doi.org/10.3390/a15090314 - 31 Aug 2022

Cited by 12 | Viewed by 6438

Abstract

Since cyber-attacks are ever-increasing in number, intensity, and variety, a strong need for a global, standardized cyber-security knowledge database has emerged as a means to prevent and fight cybercrime. Attempts already exist in this regard. The Common Vulnerabilities and Exposures (CVE) list documents numerous reported software and hardware vulnerabilities, thus building a community-based dictionary of existing threats. The MITRE ATT&CK Framework describes adversary behavior and offers mitigation strategies for each reported attack pattern. While extremely powerful on their own, the tremendous extra benefit gained when linking these tools cannot be overlooked. This paper introduces a dataset of 1813 CVEs annotated with all corresponding MITRE ATT&CK techniques and proposes models to automatically link a CVE to one or more techniques based on the text description from the CVE metadata. We establish a strong baseline that considers classical machine learning models and state-of-the-art pre-trained BERT-based language models while counteracting the highly imbalanced training set with data augmentation strategies based on the TextAttack framework. We obtain promising results, as the best model achieved an F1-score of 47.84%. In addition, we perform a qualitative analysis that uses Lime explanations to point out limitations and potential inconsistencies in CVE descriptions. Our model plays a critical role in finding kill chain scenarios inside complex infrastructures and enables the prioritization of CVE patching by the threat level. We publicly release our code together with the dataset of annotated CVEs. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

28 pages, 524 KiB

Open AccessArticle

Reducing the False Negative Rate in Deep Learning Based Network Intrusion Detection Systems

by Jovana Mijalkovic and Angelo Spognardi

Algorithms 2022, 15(8), 258; https://doi.org/10.3390/a15080258 - 26 Jul 2022

Cited by 11 | Viewed by 4708

Abstract

Network Intrusion Detection Systems (NIDS) represent a crucial component in the security of a system, and their role is to continuously monitor the network and alert the user of any suspicious activity or event. In recent years, the complexity of networks has been rapidly increasing and network intrusions have become more frequent and less detectable. The increase in complexity pushed researchers to boost NIDS effectiveness by introducing machine learning (ML) and deep learning (DL) techniques. However, even with the addition of ML and DL, some issues still need to be addressed: high false negative rates and low attack predictability for minority classes. Aim of the study was to address these problems that have not been adequately addressed in the literature. Firstly, we have built a deep learning model for network intrusion detection that would be able to perform both binary and multiclass classification of network traffic. The goal of this base model was to achieve at least the same, if not better, performance than the models observed in the state-of-the-art research. Then, we proposed an effective refinement strategy and generated several models for lowering the FNR and increasing the predictability for the minority classes. The obtained results proved that using the proper parameters is possible to achieve a satisfying trade-off between FNR, accuracy, and detection of the minority classes. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

12 pages, 437 KiB

Open AccessArticle

Adaptive IDS for Cooperative Intelligent Transportation Systems Using Deep Belief Networks

by Sultan Ahmed Almalki, Ahmed Abdel-Rahim and Frederick T. Sheldon

Algorithms 2022, 15(7), 251; https://doi.org/10.3390/a15070251 - 20 Jul 2022

Cited by 4 | Viewed by 1681

Abstract

The adoption of cooperative intelligent transportation systems (cITSs) improves road safety and traffic efficiency. Vehicles connected to cITS form vehicular ad hoc networks (VANET) to exchange messages. Like other networks and systems, cITSs are targeted by attackers intent on compromising and disrupting system integrity and availability. They can repeatedly spoof false information causing bottlenecks, traffic jams and even road accidents. The existing security infrastructure assumes that the network topology and/or attack behavior is static. However, the cITS is inherently dynamic in nature. Moreover, attackers may have the ability and resources to change their behavior continuously. Assuming a static IDS security model for VANETs is not suitable and can lead to low detection accuracy and high false alarms. Therefore, this paper proposes an adaptive security solution based on deep learning and contextual references that can cope with the dynamic nature of the cITS topologies and increasingly common attack behaviors. In this study, deep belief networks (DBN) modeling was used to train the detection model. Binary cross entropy was used as a loss function to measure the prediction error. Two activation functions were used, Relu and Softmax, for input–output mapping. The Relu was used in the hidden layers, while the Sigmoid was used in the last layer to map the real vector to output between 0 and 1. The adaptation mechanism was incorporated into the detection model using a moving average that monitors predicted values within a time window. In this way, the model can readjust the classification thresholds on-the-fly as appropriate. The proposed model was evaluated using the Next Generation Simulation (NGSIM) dataset, which is commonly used in such related works. The result is improved accuracy, demonstrating that the adaptation mechanism used in this study was effective. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures

Figure 1

25 pages, 3007 KiB

Open AccessArticle

IoT Multi-Vector Cyberattack Detection Based on Machine Learning Algorithms: Traffic Features Analysis, Experiments, and Efficiency

by Sergii Lysenko, Kira Bobrovnikova, Vyacheslav Kharchenko and Oleg Savenko

Algorithms 2022, 15(7), 239; https://doi.org/10.3390/a15070239 - 12 Jul 2022

Cited by 5 | Viewed by 2643

Abstract

Cybersecurity is a common Internet of Things security challenge. The lack of security in IoT devices has led to a great number of devices being compromised, with threats from both inside and outside the IoT infrastructure. Attacks on the IoT infrastructure result in device hacking, data theft, financial loss, instability, or even physical damage to devices. This requires the development of new approaches to ensure high-security levels in IoT infrastructure. To solve this problem, we propose a new approach for IoT cyberattack detection based on machine learning algorithms. The core of the method involves network traffic analyses that IoT devices generate during communication. The proposed approach deals with the set of network traffic features that may indicate the presence of cyberattacks in the IoT infrastructure and compromised IoT devices. Based on the obtained features for each IoT device, the feature vectors are formed. To conclude the possible attack presence, machine learning algorithms were employed. We assessed the complexity and time of machine learning algorithm implementation considering multi-vector cyberattacks on IoT infrastructure. Experiments were conducted to approve the method’s efficiency. The results demonstrated that the network traffic feature-based approach allows the detection of multi-vector cyberattacks with high efficiency. Full article

(This article belongs to the Special Issue AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection)

► Show Figures