Elastic gradient boosting decision trees under limited labels by sequential epistemic uncertainty quantification: Elastic CatBoost Uncertainty (eCBU)

Intrusion detection systems (IDSs) are essential for protecting computer systems and networks from malicious attacks. However, IDSs face challenges in dealing with dynamic and imbalanced data, as well as limited label availability. In this thesis, we propose a novel elastic gradient boosting decision tree algorithm, namely Elastic CatBoost...

Measuring the quality of publicly available synthetic IDS datasets: A comparative study

Year after year, the amount of network intrusions and costs associated to them rises. Research in this area is, therefore, of high importance and provides valuable insight in how to prevent or counteract intrusions. Machine learning algorithms seem to be a promising answer for automated network intrusion detection, as their results often reach...

Adversarial Traffic Modifications for the Network Intrusion Detection Domain: A Practical Adversarial Network Traffic Crafting Approach

Adversarial attacks pose a risk to machine learning (ML)-based network intrusion detection systems (NIDS). In this manner, it is of great significance to explore to what degree these methods can be viably utilized by potential adversaries. The majority of adversarial techniques are designed for unconstrained domains such as the image recognition...

Real-time Intrusion Detection of Cyber Physical Systems

Intrusion detection problem in Industrial Control Systems(ICS), such as water treat- ment plant and power grid, is an important real-world problem. Real-time anomaly detection have been proposed to minimize the risk of cyber attack. In this study, two different kind of intrusion detection mode-based approach are learned from normal behaviour of...

An Unsupervised Approach for False Alarm Filtering in Rule-based NIDS

To detect malicious activities in a network, intrusion detection systems are used. Even though these solutions are widely deployed for this purpose they have one serious shortcoming which is the huge amount of false alarms that they are generating. Different measures are taken to tackle this problem such as manually changing the settings of the...

Last line of defence: Cyber security of industrial control systems

The world is rapidly embracing networked technology and transitioning into one of hyperconnectivity, a term first coined by social scientists Anabel Quan-Haase and Barry Wellman. Increased connectivity provides benefits such as automation and, remote access and control of networks and equipment, thereby decreasing operational costs. Maritime and...

Streaming Fraud Detection on Session Based Data

Financial fraud is, within the banking world, a major source of expenses. Improving on timely detecting fraud is a constantly ongoing cat and mouse game between the financial institutions and criminal organisations. To be on the edge of fraud detection, new approaches have to constantly be developed. This research will tap into the large amount...

Anomaly Detection Beyond the Research Setting: An exploration of the use of statistics and machine learning to detect cyber attacks

In this work we approach the problem of deploying anomaly detection techniques for detecting cyber attacks in an organisational environment. Anomaly detection has been an active research area for almost three decades with promising results. However, few such systems have been successfully im- plemented in an operational environment for improving...

Event correlation for detecting advanced multi-stage cyber-attacks

Rapidly evolving IT infrastructures bring beneficial effects to society and promote information sharing and use. However, vulnerabilities create opportunities for hostile users to perform malicious activities and IT security has gradually turned into a critical research area for organizations and governments. Processes of decision making in...

Towards a roadmap for development of intelligent data analysis based cyber attack detection systems

Cyber-attacks against companies and governments are seeing an increase in complexity and persistence. These more complex attacks are aimed at penetrating corporate and government networks to obtain classified information. Common intrusion detection methods lack in their ability to detect such complex attacks. A framework is proposed to relate...

Efficient pre-filtering techniques for packet inspection

Network Security is a significant issue nowadays. The information flow is enormous and the attacks have been substantially evolved.Every single packet of the flow must be scanned in deep and checked with all known attack rules (Deep Packet Inspection) to determine whether it is malicious. However, the task of Deep Packet Inspection requires a...