Distributed denial-of-service attacks are a kind of malicious attempts among many others that make target services unavailable to legitimate users by using a large number of bots, which send many service requests exceeding the processing capacity of the services. Detection of botnet traffic is therefore critical to maintaining the availability and quality of the services. In contrast, identifying the type of botnet attacks helps system administrators quickly determine which part of the computer and network system is under attack. Current works focus on rule-based detection, which sets rules in the network firewall to drop suspicious traffic that matches the rules. With the emergence of machine learning and deep learning (ML/DL), several preliminary works have been developed to learn botnet traffic behavior and perform detection. However, the performance of existing ML/DL models can be further improved and their decision/prediction are not transparent, making it hard for users to interpret and trust the results. In this work, we develop a novel deep learning model for botnet detection and classification combined with its ability of explaining the decision of the model. We first leverage latent representation of traffic features generated using convolutional neural networks to detect whether a traffic record is generated by a bot then determine the type of bots. We adopt an existing explainable framework to interpret the prediction of the developed deep learning model. We perform extensive experiments with real network traffic as well as synthetic traffic generated by IXIA BreakingPoint System. We compare the developed model with existing models on various performance metrics. The experimental results show that the developed model outperforms the existing machine learning models with an improvement of up to $15\%$ for all performance metrics while providing a clear explanation of the model decision.

SMC allows parties to jointly compute a function over their inputs, while keeping every input confidential. It has been extensively applied in tasks with privacy requirements, such as PPDM, to learn task output and at the same time protect input data privacy. However, existing SMC-based solutions are ad-hoc — they are proposed for specific applications, and thus cannot be applied to other applications directly. To address this issue, we propose a privacy model DAG that consists of a set of fundamental secure operators (e.g., +, -, ×, /, and power). Our model is general — its operators, if pipelined together, can implement various functions, even complicated ones like Naïve Bayes classifier. It is also extendable — new secure operators can be defined to expand the functions the model supports. For case study, we have applied our DAG model to two data mining tasks: kernel regression and Naïve Bayes. Experimental results show that DAG generates outputs that are almost the same as those by non-private setting, where multiple parties simply disclose their data. The experimental results also show that our DAG model runs in acceptable time.

Motivated by the fast advancements in artificial intelligence (AI) technologies, recent research has moved towards using machine learning and deep learning to detect and classify security attacks in computer networks. However, most prior works adopt supervised learning methods, and the performance heavily depends on the amount of labeled data used to train the detection models. Network attack detection and classification is not an exception due to the lack of labeled data, especially the attacking traffic, which is much less than the regular (legitimate) traffic. Yet, labeling network traffic is also challenging and requires specific domain expertise. This paper proposes an efficient semi-supervised learning method for the classification of network attacking traffic, known as Self-Training Mixup Decision Tree (STM-DT). STM-DT first trains a decision tree on a small amount of labeled data and then uses the obtained model to predict labels of unlabeled samples. Some noisy labels will be removed by consistency. The predicted samples will then be mixed with labeled samples using mixup to train a new decision tree, which is the final desired classifier. We evaluate STM-DT using four network traffic datasets. Experimental results demonstrate that the proposed STM-DT method achieves higher macro F1 scores over different minority labeled data percentages.

As mobile phone technology evolves quickly, people could use mobile phones to conduct business, watch entertainment shows, order food, and many more. These location-based services (LBS) require users’ mobility data (trajectories) in order to provide many useful services. Latent patterns and behavior that are hidden in trajectory data should be extracted and analyzed to improve location-based services including routing, recommendation, urban planning, traffic control, etc. While LBSs offer relevant information to mobile users based on their locations, revealing such areas can pose user privacy violation problems. An efficient privacy preservation algorithm for trajectory data must have two characteristics: utility and privacy, i.e., the anonymized trajectories must have sufficient utility for the LBSs to carry out their services, and privacy must be intact without any compromise. Literature on this topic shows many methods catering to trajectories based on GPS data. In this paper, we propose a privacy preserving method for trajectory data based on Call Detail Record (CDR) information. This is useful as a vast number of people, particularly in underdeveloped and developing places, either do not have GPS-enabled phones or do not use them. We propose a novel framework called Privacy-Preserving Trajectory Publication Framework for CDR (PPTPF) for moving object trajectories to address these concerns. Salient features of PPTPF include: (a) a novel stay-region based anonymization technique that caters to important locations of a user; (b) it is based on Spark, thus it can process and anonymize a significant volume of trajectory data successfully and efficiently without affecting LBSs operations; (c) it is a component-based architecture where each component can be easily extended and modified by different parties.