Machine learning (ML)-based Network Intrusion Detection Systems (NIDSs) can classify each network’s flow behavior as benign or malicious by detecting heterogeneous features, including both categorical and numerical features. However, the present ML-based NIDSs are deemed insufficient in terms of their ability to generalize, particularly in changing network environments such as the Internet of Things (IoT)-based smart home. Although IoT devices add so much to home comforts, they also introduce potential risks and vulnerabilities. Recently, many NIDS studies on other IoT scenarios, such as the Internet of Vehicles (IoV) and smart cities, focus on utilizing the telemetry data of IoT devices for IoT intrusion detection. Because when IoT devices are under attack, their abnormal telemetry data values can reflect the anomaly state of those devices. Those telemetry data-based IoT NIDS methods detect intrusion events from a different view, focusing on the attack impact, from the traditional network traffic-based NIDS, which focuses on analyzing attack behavior. The telemetry data-based NIDS is more suitable for IoT devices without built-in security mechanisms. Considering the smart home IoT scenario, which has a smaller scope and a limited number of IoT devices compared to other IoT scenarios, both NIDS views can work independently. This motivated us to propose a novel ML-based NIDS to combine the network traffic-based and telemetry data-based NIDS together. In this paper, we propose a Transformer-based IoT NIDS method to learn the behaviors and effects of attacks from different types of data that are generated in the heterogeneous IoT environment. The proposed method utilizes a self-attention mechanism to learn contextual embeddings for input network features. Based on the contextual embeddings, our method can solve the feature set challenge, including both continuous and categorical features. Our method is the first to utilize both network traffic data and IoT sensors’ telemetry data at the same time for intrusion detection. Experiments reveal the effectiveness of our method on a realistic network traffic intrusion detection dataset named ToN_IoT, with an accuracy of 97.95% for binary classification and 95.78% for multiple classifications on pure network data. With the extra IoT information, the performance of our method has been improved to 98.39% and 97.06%, respectively. A comparative study with existing works shows that our method can achieve state-of-the-art performance on the ToN_IoT dataset.

Utilizing machine learning (ML)-based approaches for network intrusion detection systems (NIDSs) raises valid concerns due to the inherent susceptibility of current ML models to various threats. Of particular concern are two significant threats associated with ML: adversarial attacks and distribution shifts. Although there has been a growing emphasis on researching the robustness of ML, current studies primarily concentrate on addressing specific challenges individually. These studies tend to target a particular aspect of robustness and propose innovative techniques to enhance that specific aspect. However, as a capability to respond to unexpected situations, the robustness of ML should be comprehensively built and maintained in every stage. In this paper, we aim to link the varying efforts throughout the whole ML workflow to guide the design of ML-based NIDSs with systematic robustness. Toward this goal, we conduct a methodical evaluation of the progress made thus far in enhancing the robustness of the targeted NIDS application task. Specifically, we delve into the robustness aspects of ML-based NIDSs against adversarial attacks and distribution shift scenarios. For each perspective, we organize the literature in robustness-related challenges and technical solutions based on the ML workflow. For instance, we introduce some advanced potential solutions that can improve robustness, such as data augmentation, contrastive learning, and robustness certification. According to our survey, we identify and discuss the ML robustness research gaps and future direction in the field of NIDS. Finally, we highlight that building and patching robustness throughout the life cycle of an ML-based NIDS is critical.

Summary: As a special type of denial of service (DoS) attacks, the TCP‐targeted low‐rate denial of service (LDoS) attacks have the characteristics of low average rate and strong concealment, so it is difficult to identify such attack traffic. As multifractal characteristics exist in network traffic, a new identification approach based on wavelet transform and combined neural network is proposed to classify normal network traffic and LDoS attack traffic. Wavelet energy spectrum coefficients extracted from the sampled traffic are used for multifractal analysis of traffic over different time scale. The combined neural network is designed to classify these multiscale spectrum coefficients that show different multifractal characteristics belonging to normal network traffic and LDoS attack traffic. Test results of test‐bed experiments indicate that the proposed approach can identify LDoS attack traffic accurately.

In frequency domain, the power spectrum of Low-rate denial of service (LDoS) attacks is totally spread into the spectrum of normal traffic. It is a challenging task to detect and filter LDoS attack flows from the normal traffic. Based on the analysis of LDoS attack flows and legitimate TCP traffic in time and frequency domains, the periodicity of the TCP traffic and LDoS attack flows is explored to facilitate the research of network traffic processing. Hence, an approach of LDoS attack flow filtering based on frequency spectrum analysis is proposed. In this approach, the TCP traffic and LDoS attack flows are transformed from the time domain into the frequency domain. Then the round-trip time (RTT) is estimated by using frequency domain search method. Analysis of amplitude spectrum shows that TCP traffic energy is mainly concentrated on the points of n/RTT. Therefore, a comb filter using infinite impulse response (IIR) filter is designed to filter out the LDoS attack flows in frequency domain, while most legitimate TCP traffic energy at the points of n/RTT are pass through. Experimental results show that the maximum pass rate for legitimate TCP traffic reaches 92.55%, while the maximum filtration rate of LDoS attack flows reaches 81.36%. The proposed approach can effectively filter the LDoS attack flows while less impact on the legitimate TCP traffic.

Objective. This study aims to introduce a novel generative pre-trained transformer (GPT)-based foundation model specifically tailored to photoplethysmography (PPG) signals, enabling effective adaptation to various downstream biomedical tasks. Approach. We adapted the standard GPT architecture to handle the continuous characteristics of PPG signals, leveraging extensive pre-training on a large dataset comprising over 200 million 30 s PPG samples, followed by supervised fine-tuning strategies for task-specific optimization. Main results. Our approach achieves performance comparable to or exceeding current state-of-the-art methods on various downstream tasks, notably atrial fibrillation detection, and demonstrates a unique generative capability, such as effective signal denoising, inherently available without additional fine-tuning. Significance. The successful adaptation of GPT to PPG signals underscores the potential of generative transformer frameworks as versatile foundation models in biomedical signal processing, highlighting their dual role in predictive and generative tasks.

A TCP-targeted Low-rate denial of service (LDoS) attack exploits the vulnerabilities of TCP congestion control mechanism. CUBIC is the most widely used TCP congestion control algorithm today. CUBIC TCP increases the resilience against LDoS over traditional TCP. This paper explores high-potency patterns of the LDoS attack against CUBIC TCP under RED queue management scenario, and accordingly develops two attack models referring to maximizing attack potency. Theoretical analyses and extensive experiments are conducted to validate the proper function of the two models and evaluate their performance. Test results show that the two attack models can effectively throttle CUBIC TCP throughput. Under standard-configured network parameters, the number of TCP units damaged by one attack unit are up to about 21 and 26 respectively for our proposed two models, which represents an increase in attack potency of about 20%. And, our proposed models outperform the traditional attack model in terms of attack potency by at least 250%. In addition, with variations in different network parameters, these two models are still efficient and alternatively maximize the attack potency. Finally, an outline for the attack countermeasure is discussed. The present study offers a basis to explore new attack manners which may be exploited by attackers and excites defenders to develop new measurements against such attack.