The Windows Operating System (OS) is the most popular desktop OS in the world, as it has the majority market share of both servers and personal computing necessities. However, as its default signature-based security measures are ineffectual for detecting zero-day and stealth attacks, it needs an intelligent Host-based Intrusion Detection System (HIDS). Unfortunately, a comprehensive data set that reflects the modern Windows OS’s normal and attack surfaces is not publicly available. To fill this gap, in this paper two open data sets generated by the cyber security department of the Australian Defence Force Academy (ADFA) are introduced, namely: Australian Defence Force Academy Windows Data Set (ADFA-WD); and Australian Defence Force Academy Windows Data Set with a Stealth Attacks Addendum (ADFA-WD: SAA). Statistical analysis results based on these data sets show that, due to the low foot prints of modern attacks and high similarity of normal and attacked data, both these data sets are complex, and highly intelligent Host based Anomaly Detection Systems (HADS) design will be required.

It is essential to acquire the location of sensor nodes in the wireless sensor networks (WSNs), since the data collected with nodes would become meaningless without their location. In the existing studies, rangefree localization schemes have been proved suitable to large-scaled WSNs due to the low cost in hardware implementation. However, the defect of those schemes is their poor accuracy in anisotropic networks with coverage holes. To tackle this problem, we propose a range-free localization scheme that combines the advantages of geometric constraint and hop progress-based methods. The geometric information provided by the combination of anchor pairs and unknown nodes is used to design the discrimination conditions, and each node divides the anchor pairs into one of three proposed categories. For different categories of anchor pairs, corresponding methods are proposed to estimate the distancse between sensor nodes. In this way, the tradeoff between distance estimation accuracy and anchor utilization can be achieved. Simulation results indicate that the proposed scheme outperforms other schemes in terms of localization accuracy and proportion of outliers with acceptable computational and time complexity, where the localization accuracy and proportion of outliers in the proposed scheme are improved by up to 47% and 61% compared to DV-maxHop.

Node localization is one of the basic requirements in various Internet of Things applications. Among a wide range of localization schemes, the range-free localization algorithm is promising as a cost-effective technique. However, the localization accuracy of this technique is susceptible to various anisotropy factors, such as the existence of holes, nonuniform node distribution, and dynamic radio propagation pattern. To this end, an accurate range-free localization model using extreme learning machine (ELM) and ring-shaped salp swarm algorithm (SSA) is proposed for anisotropic wireless sensor networks. First, the integer hop count between two adjacent nodes is quantized as a real number according to the Jaccard coefficient of their shared neighbor nodes. Second, exploiting the strong generalization and fast learning speed of ELM, a distance mapping model based on the modified real hop count is developed for solving anisotropic signal attenuation. Third, the coordinate calculation of normal nodes is formulated as a minimum problem by taking into account the weighted squared error of estimated distance, and the bounding box method is utilized to initialize the possible location boundary area of normal nodes. Finally, the SSA based on the ring-shaped topology is designed to compute the coordinates of normal nodes. Extensive simulations on several network topologies are conducted with the effect of multiple anisotropic factors. Experimental results show that the proposed algorithm is superior to other developed ones not only in localization accuracy but also in robustness against network anisotropy.

Internet of Things (IoT) is improving human life in a more convenient and simpler way. One of the most promising IoT applications is healthcare. In this paper, an availability model of a healthcare IoT system is proposed which is composed of two groups of structures described by separate Markov state-space models. The two separate models are analyzed and combined to implement the whole IoT system modeling. The system balance equations are solved under a given scenario and some performance metrics of interest, such as probabilities of full service, degraded service, and the system unavailability, are derived. Detailed numerical evaluation of selected metrics is provided for further understanding and verification of the analytic results. An availability performance improving (API) method is also proposed for increasing the probability of system full service and decreasing the system unavailability. The proposed system modeling and performance improving method can serve as a useful reference for general IoT system design and evaluation.

Smart grids are vulnerable to stealthy false data injection attacks (SFDIAs), as SFDIAs can bypass residual-based bad data detection mechanisms. Methods based on deep learning technology have shown promising accuracy in the detection of SFDIAs. However, most existing methods rely on the temporal structure of a sequence of measurements but do not take account of the spatial structure between buses and transmission lines. To address this issue, we propose a spatiotemporal deep network, PowerFDNet, for the SFDIA detection in AC-model power grids. The PowerFDNet consists of two sub-architectures: spatial architecture (SA) and temporal architecture (TA). The SA is aimed at extracting representations of bus/line measurements and modeling the spatial structure based on their representations. The TA is aimed at modeling the temporal structure of a sequence of measurements. Therefore, the proposed PowerFDNet can effectively model the spatiotemporal structure of measurements. Case studies on the detection of SFDIAs on the benchmark smart grids show that the PowerFDNet achieved significant improvement compared with the state-of-the-art SFDIA detection methods. In addition, an IoT-oriented lightweight prototype of size 52 MB is implemented and tested for mobile devices, which demonstrates the potential applications on mobile devices. The trained model will be available at [Online]. Available: https://github.com/FrankYinXF/PowerFDNet .

Collaborative Anomaly Detection (CAD) is an emerging field of network security in both academia and industry. It has attracted a lot of attention, due to the limitations of traditional fortress-style defense modes. Even though a number of pioneer studies have been conducted in this area, few of them concern about the universality issue. This work focuses on two aspects of it. First, a unified collaborative detection framework is developed based on network virtualization technology. Its purpose is to provide a generic approach that can be applied to designing specific schemes for various application scenarios and objectives. Second, a general behavior perception model is proposed for the unified framework based on hidden Markov random field. Spatial Markovianity is introduced to model the spatial context of distributed network behavior and stochastic interaction among interconnected nodes. Algorithms are derived for parameter estimation, forward prediction, backward smooth, and the normality evaluation of both global network situation and local behavior. Numerical experiments using extensive simulations and several real datasets are presented to validate the proposed solution. Performance-related issues and comparison with related works are discussed.