Machine Learning (ML) and Deep Learning (DL) have been used for building Intrusion Detection Systems (IDS). The increase in both the number and sheer variety of new cyber-attacks poses a tremendous challenge for IDS solutions that rely on a database of historical attack signatures. Therefore, the industrial pull for robust IDSs that are capable of flagging zero-day attacks is growing. Current outlier-based zero-day detection research suffers from high false-negative rates, thus limiting their practical use and performance. This paper proposes an autoencoder implementation for detecting zero-day attacks. The aim is to build an IDS model with high recall while keeping the miss rate (false-negatives) to an acceptable minimum. Two well-known IDS datasets are used for evaluation—CICIDS2017 and NSL-KDD. In order to demonstrate the efficacy of our model, we compare its results against a One-Class Support Vector Machine (SVM). The manuscript highlights the performance of a One-Class SVM when zero-day attacks are distinctive from normal behaviour. The proposed model benefits greatly from autoencoders encoding-decoding capabilities. The results show that autoencoders are well-suited at detecting complex zero-day attacks. The results demonstrate a zero-day detection accuracy of 89–99% for the NSL-KDD dataset and 75–98% for the CICIDS2017 dataset. Finally, the paper outlines the observed trade-off between recall and fallout.

To proactively defend computer systems against cyber-attacks, a honeypot system—purposely designed to be prone to attacks—is commonly used to detect attacks, discover new vulnerabilities, exploits or malware before they actually do real damage to real systems. Its usefulness lies in being able to operate without being identified as a trap by adversaries; otherwise, its values are significantly reduced. A honeypot is commonly classified by the degree of interactions that they provide to the attacker: low, medium and high-interaction honeypots. However, these systems have some shortcomings of their own. First, the low and medium-interaction honeypots can be easily detected due to their limited and simulated functions of a system. Second, the usage of real systems in high-interaction honeypots has a high risk of security being compromised due to its unlimited functions. To address these problems, we developed Asgard an adaptive self-guarded honeypot, which leverages reinforcement learning to learn and record attacker’s tools and behaviour while protecting itself from being deeply compromised. In this paper, we compare Asgard and its variant Midgard with two conventional SSH honeypots: Cowrie and a real Linux system. The goal of the paper is (1) to demonstrate the effectiveness of the adaptive honeypot that can learn to compromise between collecting attack data and keeping the honeypot safe, and (2) the benefit of coupling of the environment state and the action in reinforcement learning to define the reward function to effectively learn its objectives. The experimental results show that Asgard could collect higher-quality attacker data compared to Cowrie while evading the detection and could also protect the system for as long as it can through blocking or substituting the malicious programs and some other commands, which is the major problem of the high-interaction honeypot.

DNS over HTTPS (DoH) Tunneling is a technique used to encapsulate the information or programs of other protocols into the DNS protocol with the encrypted form for communication. On the strength of DNS as the core component in internet communication, DoH straightens data privacy with less restriction and qualification of tunneling techniques, the attackers take advantage of exploring DoH Tunneling traffic to initial and deploy their activities, such as command and control communication and data exfiltration. Keeping their assets safe is becoming a critical issue for every organization. Based on our knowledge and investigation, currently, there are only flow-level feature analysis solutions that have been made, and they don't have any methods using single packet information to detect the DoH Tunneling traffic. it can't be used passive data analysis methods such as the active detection system's flow-level detection system. Therefore, in this paper, the first packet-level feature analysis solution to detect DoH Tunneling traffic by using only five selected features from the packet and a study of the number of packets inside flow learning for this traffic detection is proposed. As a result, Random Forest can perform well, with a high accuracy of up to 99.93% among other algorithms.

In this article, the researchers introduce a 3-level model for security access control that comes as an extension to ABAC. This extension augments its structural and hierarchical expressiveness allowing to define arbitrarily complex access control rules. The authors apply this model to IoT platforms and show how it fulfils security access control requirements of these platforms. Finally, a reference architecture is introduced for access control applied to connected objects and its implementation details are presented.