2024
Authors
Fernandes, P; Ciardhuáin, SO; Antunes, M;
Publication
MATHEMATICS
Abstract
The increasing proliferation of cyber-attacks threatening the security of computer networks has driven the development of more effective methods for identifying malicious network flows. The inclusion of statistical laws, such as Benford's Law, and distance functions, applied to the first digits of network flow metadata, such as IP addresses or packet sizes, facilitates the detection of abnormal patterns in the digits. These techniques also allow for quantifying discrepancies between expected and suspicious flows, significantly enhancing the accuracy and speed of threat detection. This paper introduces a novel method for identifying and analyzing anomalies within computer networks. It integrates Benford's Law into the analysis process and incorporates a range of distance functions, namely the Mean Absolute Deviation (MAD), the Kolmogorov-Smirnov test (KS), and the Kullback-Leibler divergence (KL), which serve as dispersion measures for quantifying the extent of anomalies detected in network flows. Benford's Law is recognized for its effectiveness in identifying anomalous patterns, especially in detecting irregularities in the first digit of the data. In addition, Bayes' Theorem was implemented in conjunction with the distance functions to enhance the detection of malicious traffic flows. Bayes' Theorem provides a probabilistic perspective on whether a traffic flow is malicious or benign. This approach is characterized by its flexibility in incorporating new evidence, allowing the model to adapt to emerging malicious behavior patterns as they arise. Meanwhile, the distance functions offer a quantitative assessment, measuring specific differences between traffic flows, such as frequency, packet size, time between packets, and other relevant metadata. Integrating these techniques has increased the model's sensitivity in detecting malicious flows, reducing the number of false positives and negatives, and enhancing the resolution and effectiveness of traffic analysis. Furthermore, these techniques expedite decisions regarding the nature of traffic flows based on a solid statistical foundation and provide a better understanding of the characteristics that define these flows, contributing to the comprehension of attack vectors and aiding in preventing future intrusions. The effectiveness and applicability of this joint method have been demonstrated through experiments with the CICIDS2017 public dataset, which was explicitly designed to simulate real scenarios and provide valuable information to security professionals when analyzing computer networks. The proposed methodology opens up new perspectives in investigating and detecting anomalies and intrusions in computer networks, which are often attributed to cyber-attacks. This development culminates in creating a promising model that stands out for its effectiveness and speed, accurately identifying possible intrusions with an F1 of nearly 80%, a recall of 99.42%, and an accuracy of 65.84%.
2024
Authors
Freitas, T; Novo, C; Soares, J; Dutra, I; Correia, ME; Shariati, B; Martins, R;
Publication
2024 IEEE 6TH INTERNATIONAL CONFERENCE ON TRUST, PRIVACY AND SECURITY IN INTELLIGENT SYSTEMS, AND APPLICATIONS, TPS-ISA
Abstract
HAL 9000 is an Intrusion Tolerant Systems (ITSs) Risk Manager, which assesses configuration risks against potential intrusions. It utilizes gathered threat knowledge and remains operational, even in the absence of updated information. Based on its advice, the ITSs can dynamically and proactively adapt to recent threats to minimize and mitigate future intrusions from malicious adversaries. Our goal is to reduce the risk linked to the exploitation of recently uncovered vulnerabilities that have not been classified and/or do not have a script to reproduce the exploit, considering the potential that they may have already been exploited as zero-day exploits. Our experiments demonstrate that the proposed solution can effectively learn and replicate National Vulnerability Database's evaluation process with 99% accuracy.
2024
Authors
Pinheira, AG; Casal Guisande, M; Comesaña Campos, A; Dutra, I; Nascimento, C; Cerqueiro Pequeño, J;
Publication
Lecture Notes in Educational Technology
Abstract
Bipolar Disorder (BD) is a chronic and severe psychiatric illness presenting with mood alterations, including manic, hypomanic, and depressive episodes. Due to the high clinical heterogeneity and lack of biological validation, both treatment and diagnosis of BD remain problematic and challenging. In this context, this paper proposes a novel intelligent system applied to the diagnosis of BD. First, each patient’s single nucleotide polymorphism (SNP) data is represented by QR codes, which reduces the high dimensionality of the problem and homogenizes the data representation. For the initial tests of the system, the Wellcome Trust Case Control Consortium (WTCCC) dataset was used. The preliminary results are encouraging, with an AUC value of 0.82 and an accuracy of 82%, correctly classifying all cases and most controls. This approach reduces the dimensionality of large amounts of data and can help improve diagnosis and deliver the right treatment to the patient. Furthermore, the architecture of the system is versatile and could be adapted and used to diagnose other diseases where there is also high dimensionality. © The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd. 2024.
2024
Authors
Almeida, L; Dutra, I; Renna, F;
Publication
CoRR
Abstract
2024
Authors
Nóbrega, D; Ribeiro, P;
Publication
COMPLEX NETWORKS XV, COMPLENET 2024
Abstract
Motifs are overrepresented and statistically significant sub-patterns in a network, whose identification is relevant to uncover its underlying functional units. Recently, its extraction has been performed on higher-order networks, but due to the complexity arising from polyadic interactions, and the similarity with known computationally hard problems, its practical application is limited. Our main contribution is a novel approach for hyper-subgraph census and higher-order motif discovery, allowing for motifs with sizes 3 or 4 to be found efficiently, in real-world scenarios. It is consistently an order of magnitude faster than a baseline state-of-art method, while using less memory and supporting a wider range of base algorithms.
2024
Authors
Eddin, AN; Bono, J; Aparício, DO; Ferreira, H; Pinto Ribeiro, PM; Bizarro, P;
Publication
Trans. Mach. Learn. Res.
Abstract
Continuous-time dynamic graphs (CTDGs) are essential for modeling interconnected, evolving systems. Traditional methods for extracting knowledge from these graphs often depend on feature engineering or deep learning. Feature engineering is limited by the manual and time-intensive nature of crafting features, while deep learning approaches suffer from high inference latency, making them impractical for real-time applications. This paper introduces Deep-Graph-Sprints (DGS), a novel deep learning architecture designed for efficient representation learning on CTDGs with low-latency inference requirements. We benchmark DGS against state-of-the-art (SOTA) feature engineering and graph neural network methods using five diverse datasets. The results indicate that DGS achieves competitive performance while inference speed improves between 4x and 12x compared to other deep learning approaches on our benchmark datasets. Our method effectively bridges the gap between deep representation learning and low-latency application requirements for CTDGs.
The access to the final selection minute is only available to applicants.
Please check the confirmation e-mail of your application to obtain the access code.