Anomaly detection systems can accurately identify malicious network traffic, providing network security. With the development of internet technology, network attacks are becoming more and more sourced and complicated, making it difficult for traditional anomaly detection systems to effectively analyze and identify abnormal traffic. At present, deep neural network (DNN) technology achieved great results in terms of anomaly detection, and it can achieve automatic detection. However, there still exists misclassified traffic in the prediction results of deep neural networks, resulting in redundant alarm information. This paper designs a two-level anomaly detection system based on deep neural network and association analysis. We made a comprehensive evaluation of experiments using DNNs and other neural networks based on publicly available datasets. Through the experiments, we chose DNN-4 as an important part of our system, which has high precision and accuracy in identifying malicious traffic. The Apriori algorithm can mine rules between various discretized features and normal labels, which can be used to filter the classified traffic and reduce the false positive rate. Finally, we designed an intrusion detection system based on DNN-4 and association rules. We conducted experiments on the public training set NSL-KDD, which is considered as a modified dataset for the KDDCup 1999. The results show that our detection system has great precision in malicious traffic detection, and it achieves the effect of reducing the number of false alarms.

The industrial control and automation systems have played an increasing important role in critical manufacturing processes. In these kinds of systems, many Internet of Things (IoT) devices continuously collect large number of streaming data for real-time processing. Verifiable data streaming (VDS) addresses such authenticity issue for streaming data, but most VDS schemes are not efficient and lightweight, do not support range querying, and cannot be used in practice. To improve the efficiency and achieve a verifiable range query in data streaming, we here present a new primitive, namely, a chameleon authentication tree with prefixes (PCAT), which is extended from the PBTree and CAT. Our scheme is not only lightweight but also supports dynamic expansion and verifiable range query in data streaming, making it more suitable for resource-constrained devices. We separated the PCAT algorithms into the following phases: initialization, data appending, query, and verification. Our analyses prove that the PCAT satisfies all the security requirements of VDS. Moreover, an efficiency analysis and performance evaluations demonstrate that our scheme not only supports lightweight data streaming authentication but also has high efficiency, which means that the PCAT is easier to apply in the industrial control and automation systems.