One of the major challenges in cybersecurity is the provision of an automated and effective cyber-threats detection technique. In this paper, we present an AI technique for cyber-threats detection, based on artificial neural networks. The proposed technique converts multitude of collected security events to individual event profiles and use a deep learning-based detection method for enhanced cyber-threat detection. For this work, we developed an AI-SIEM system based on a combination of event profiling for data preprocessing and different artificial neural network methods, including FCNN, CNN, and LSTM. The system focuses on discriminating between true positive and false positive alerts, thus helping security analysts to rapidly respond to cyber threats. All experiments in this study are performed by authors using two benchmark datasets (NSLKDD and CICIDS2017) and two datasets collected in the real world. To evaluate the performance comparison with existing methods, we conducted experiments using the five conventional machine-learning methods (SVM, k-NN, RF, NB, and DT). Consequently, the experimental results of this study ensure that our proposed methods are capable of being employed as learning-based models for network intrusion-detection, and show that although it is employed in the real world, the performance outperforms the conventional machine-learning methods.

While blockchain technology provides strong cryptographic protection on the ledger and the system operations, the underlying blockchain networking remains vulnerable due to potential threats such as denial of service (DoS), Eclipse, spoofing, and Sybil attacks. Effectively detecting such malicious events should thus be an essential task for securing blockchain networks and services. Due to its importance, several studies investigated anomaly detection in Bitcoin and blockchain networks, but their analyses mainly focused on the blockchain ledger in the application context (e.g., transactions) and targets specific types of attacks (e.g., double-spending, deanonymization, etc). In this study, we present a security mechanism based on the analysis of blockchain network traffic statistics (rather than ledger data) to detect malicious events, through the functions of data collection and anomaly detection. The data collection engine senses the underlying blockchain traffic and generates multi-dimensional data streams in a periodic, real-time manner. The anomaly detection engine then detects anomalies from the created data instances based on semi-supervised learning, which is capable of detecting previously unseen patterns, and we introduce our profiling-based detection engine implemented on top of AutoEncoder (AE). Our experimental results evaluated with real and simulated traffic data support the effectiveness of our security mechanism and design choices based on the AE structure, with the approximate detection performance to the supervised learning methods only through the profiling of normal instances. The measured time complexity is sufficiently cheap to perform real-time analysis, with less than 1.4 msec for per-instance testing on a single core setting.

Covert communications, or covert channels, are commonly exploited to establish a data exfiltration channel from an insider on a trusted network to a malicious receiver outside the network without using normal communication of the network. It is because the malicious receiver is an unauthorized user of the communication network and so he cannot communicate with any entity in the network. In this study, we construct a new covert wireless unidirectional communication mechanism in an IEEE 802.11 environment. Our covert communication is based on a covert timing channel exploiting the beacon interval of a given commercial-like AP. Because the wireless covert channel we proposed can be implemented only with firmware modification to the WLAN MAC protocol, it is very suitable for application in a real public AP environment. In order to dramatically reduce the chance of covert signals being detected by others, a new and simple covert data encoding scheme, called ping-pong covert timing channel (PPCTC), is proposed, and we show that the covertness of the PPCTC is excellent compared to the previous timing-based covert channels. Although this wireless covert communication is unidirectional communication, since PPCTC has recovery characteristics against consecutive 2-bit errors, stable communication is guaranteed. Furthermore, a covert frame structure is presented for providing the confidentiality and integrity of the information transmitted via our covert channel. To the best of our knowledge, this is the first attempt.

Cyberattacks are often difficult to identify with traditional signature‐based detection, because attackers continually find ways to bypass the detection methods. Therefore, researchers have introduce...