DDo S13
DDo S13
ABSTRACT
Cyber-crime is spreading throughout the world, exploiting any type of vulnerability in the cloud
computing platform. Ethical hackers are primarily concerned in identifying flaws and recommending
mitigation measures. In the cyber security world, there is a pressing need for the development of effective
techniques. The majority of IDS techniques used today are incapable of dealing with the dynamic and
complex nature of cyber-attacks on computer networks. Because of the effectiveness of machine learning
in cyber security issues, machine learning for cyber security has recently become a hot topic. In cyber
security, machine learning approaches have been utilised to handle important concerns such as intrusion
detection, malware classification and detection, spam detection, and phishing detection. Although ML
cannot fully automate a cyber-security system, it can identify cyber security threats more efficiently than
other software-oriented approaches, relieving security analysts of their burden. As a result, effective
adaptive methods, such as machine learning techniques, can yield higher detection rates, lower false alarm
rates, and cheaper computing and transmission costs. Our key goal is that the challenge of detecting attacks
is fundamentally different from those of these other applications, making it substantially more difficult for
the intrusion detection community to apply machine learning effectively. In this study, the CPS is
modelled as a network of agents that move in unison with one another, with one agent acting as a leader
and commanding the other agents. The proposed strategy in this study is to employ the structure of deep
neural networks for the detection phase, which should tell the system of the attack's existence in the early
stages of the attack. The use of robust control algorithms in the network to isolate the misbehaving agent
in the leader-follower mechanism has been researched. Following the attack detection phase with a deep
neural network, the control system uses the reputation algorithm to isolate the misbehaving agent in the
presented control method. Experiment results show that deep learning algorithms can detect attacks more
effectively than traditional methods, making cyber security simpler, more proactive, and less expensive
and more expensive.
KEYWORDS: Network Protocols, Wireless Network, Cyber-crime, Machine learning techniques, cyber-
security system, attacks, SQL Injection, Cross-Site Scripting (XSS), Phishing Attacks, and Intrusion
Detection Attack (IDS), etc.
1. INTRODUCTION
The In this modem era of information and communication technologies, physical objects are now
connected with each other through cyber networks are collectively called cyber physical system. The
stateful firewall, also known as attack detection and prevention, identifies and blocks attacks in network
traffic. An exploit can be a data-gathering probe or an attack aimed at compromising, disabling, or harming
a network or network resource. The line between the two exploit aims can be hazy in some circumstances.
For example, a barrage of TCP SYN segments might be an IP address sweep with the intent of triggering
responses from active hosts, or it might be a SYN flood attack with the intent of overwhelming a network
so that it can no longer function properly. Furthermore, because an attacker usually precedes an attack by
performing reconnaissance on the target, we can consider information-gathering efforts as a precursor to
an impending attack—that is, they constitute the first stage of an attack. Thus, the term exploit
encompasses both reconnaissance and attack activities, and the distinction between the two is not always
clear.
The Internet and computer networks have become an important part of our organizations and everyday
life. With the increase in our dependence on computers and communication networks, malicious activities
have become increasingly prevalent. Network attacks are an important problem in today’s communication
environments. The network traffic must be monitored and analysed to detect malicious activities and
attacks to ensure reliable functionality of the networks and security of users’ information.
Recently, machine learning techniques have been applied toward the detection of network attacks.
Machine learning models are able to extract similarities and patterns in the network traffic. Unlike
signature based methods, there is no need for manual analyses to extract attack patterns. Applying machine
learning algorithms can automatically build predictive models for the detection of network attacks.
New threats and difficulties to wireless communication systems have evolved as a result of the
development of fifth-generation networks and artificial intelligence technologies, particularly in cyber
security. We provide a review of attack detection approaches utilising the strength of deep learning
techniques in this system. Specifically, we firstly summarize fundamental problems of network security
and attack detection and introduce several successful related applications using deep learning structure.
We focus on attack detection systems built on several sorts of architectures, such as auto-encoders,
generative adversarial networks, recurrent neural networks, and convolutional neural networks, based on
classification on deep learning methodologies. Following that, we give some benchmark datasets with
descriptions and compare the performance of various representation approaches to demonstrate the current
state of attack detection methods using deep learning structures. Finally, we summarize this work and
discuss some ways to improve the performance of attack detection under thoughts of utilizing deep
learning structures.
2. LITERATURE SURVEY
• Nutjahan, Farhana Nizam, Shudarshon Chaki, Shamim Al Mamun, M. Shamim Kaiser,” Attack
Detection and Prevention in the Cyber Physical System”. [2016] [1] In this paper proposes Cyber
Physical System cyber-attack detection and prevention To detect distributed denial of service and false
data injection attacks, the Chi square detector and Fuzzy logic based attack classifier (FLAC) were
utilised. Activity profiling, average packet rate, change point detection algorithm, cusum algorithm,
unexpired user sessions, injected incomplete information, and reuse of session key are some of the
fuzzy features used to choose the attacks described. An example scenario has been created using
OpNET Simulator. Simulation results depict that the use of Chi-square detector and FLAC are able to
detect the mentioned cyber physical attacks with high accuracy. Compared to existing Fuzzy logic
based attack detector, the proposed model outperforms the traditional distributed denial of service and
false data detector.
• Yong Fang, Cheng Huang, Yijia Xu and Yang Li, “RLXSS: Optimizing XSS Detection Model to
Defend Against Adversarial Attacks Based on Reinforcement Learning”. [2019] [2]. In this research,
we introduce RLXSS, a reinforcement learning-based strategy for optimising the XSS detection model
to defend against adversarial attacks. First, the adversarial samples of the detection model are mined
by the adversarial attack model based on reinforcement learning. Secondly, the detection model and the
adversarial model are alternately trained. After each round, the newly-excavated adversarial samples
are marked as a malicious sample and are used to retrain the detection model. The proposed RLXSS
model successfully mines adversarial samples that avoid black-box and white-box detection while
retaining aggressive features, according to experimental data. Furthermore, by alternating training the
detection model and the confronting assault model, the detection model's escape rate is continuously
reduced, indicating that the model can increase the detection model's ability to defend against attacks.
• Rishikesh Mahajan, Irfan Siddavatam, “Phishing Website Detection using Machine Learning
Algorithms”. [2018] [3] Phishing is the most basic method of obtaining sensitive information from
unsuspecting consumers. The goal of phishers is to obtain sensitive information such as usernames,
passwords, and bank account information. Cyber security professionals are now looking for
dependable and consistent detection solutions for phishing websites. The purpose of this work is to
discuss machine learning technology for detecting phishing URLs by extracting and analysing various
aspects of authentic and phishing URLs. To detect phishing websites, the Decision Tree, Random
Forest, and Support Vector Machine algorithms are used. The goal of this study is to detect phishing
URLs as well as to narrow down the best machine learning method by analysing each algorithm's
accuracy rate, false positive and false negative rate.
• Vishnu. B. A, Ms. Jevitha. K. P., “Prediction of Cross-Site Scripting Attack Using Machine Learning
Algorithms”. [2018] [4] Cross-site scripting (XSS) is one of the most frequently occurring types of
attacks on web applications, hence is of importance in information security. XSS occurs when an
attacker injects malicious code, usually JavaScript, into a web application such that it can be executed
in the user's browser. Detecting malicious scripts is an important aspect of an online application's
defence. This study studies the use of SVM, k-NN, and Random Forests to detect and limit known and
undiscovered assaults on JavaScript code by developing classifiers. It shown that using an interesting
feature set that combines language syntax and behavioural information resulted in classifiers that
provide excellent accuracy and precision on huge real-world data sets without focusing solely on
obfuscation.
• Zohre Nasiri Zarandi, Iman Sharif, “Detection and Identification of Cyber-Attacks in Cyber- Physical
Systems Based on Machine Learning Methods”. [2020] [5] The CPS is modelled in this study as a
network of agents that move in unison with one another, with one agent acting as a leader and the other
agents being ordered by the leader. In this study, the proposed strategy is to employ the structure of
deep neural networks for the detection phase, which should tell the system of the existence of the attack
in the early stages of the attack. In the leader-follower mechanism, the employment of robust control
algorithms in the network to isolate the misbehaving agent has been examined. In the presented control
method, after the attack detection phase with the use of a deep neural network, the control system uses
the reputation algorithm to isolate the misbehave agent. Experiments reveal that deep learning
algorithms outperform traditional approaches in detecting assaults, making cyber security simpler,
more proactive, less expensive, and considerably more successful.
5. PROPOSED SYSTEM
Cybercrime is spreading throughout the world, using any type of weakness in the computing environment.
Ethical hackers are primarily concerned with assessing vulnerabilities and offering mitigation methods.
The development of effective techniques is a pressing need in the cyber security community. Most
techniques used in today’s IDS are not able to deal with the dynamic and complex nature of cyber-attacks
on computer networks. Machine learning for cyber security has become an issue of great importance
recently due to the effectiveness of machine learning in cyber security issues. ML approaches have been
used to address important difficulties in cyber security, such as intrusion detection, malware classification
and detection, spam detection, and phishing detection. Although machine learning cannot fully automate
a cyber-security system, it can identify cyber security threats more efficiently than other software-oriented
approaches, easing the strain on security analysts. As a result, effective adaptive approaches, such as
machine learning techniques, can result in higher detection rates, lower false alarm rates, and cheaper
computing and transmission costs. Our main goal is to show that the problem of detecting attacks is
fundamentally different from these other applications, making it far more difficult for the intrusion
detection community to properly use machine learning.
Machine Learning algorithms can be used to train and detect if there has been a cyber-attack. As soon as
the attack is detected, an email notification can be sent to the security users. Any classification algorithm
can be used to determine whether or not an assault is a DoS/DDoS attack. Support Vector Machine (SVM),
a supervised learning approach that analyses data and recognises patterns, is one example of a
classification algorithm. Since we cannot predict when, when, or how an attack will occur, and absolute
prevention cannot be guaranteed, our best bet for the time being is early discovery, which will help lessen
the danger of irreparable damage such occurrences can do. Organizations can use existing solutions or
build their own to detect cyber-attacks at a very early stage to minimize the impact. Any system that
requires minimal human intervention would be ideal.
5.1 PREPROCESSING
Data preprocessing is a crucial step in the data mining process that involves manipulating or dropping data
before it is used to ensure or improve performance. In data mining and machine learning initiatives, the
phrase "garbage in, trash out" is especially apt. Data collection methods are frequently uncontrolled,
resulting in out-of-range values (for example, Income: 100), impossible data combinations (for example,
Sex: Male, Pregnant: Yes), and missing values, among other things. Analyzing data that hasn't been
thoroughly checked for such issues can lead to false conclusions. As a result, before doing any analysis,
the representation and quality of data must come first. Data preprocessing is frequently the most crucial
stage of a machine learning project.
For example:
In this project for Detection of Cross Site Scripting( XSS ) attacks, Some characters have values very big
for eg 8221 and some are Chinese letters, so we are removing letters having values greater than 8222 and
for the rest, we will be considering values greater than 128 and less than 8222 and assign those values so
that they can be normalized.
For Intrusion Detection Attack, we will be extracting numerical attributes and will scale them to have zero
mean and unit variance. Further we will turn the result back into dataframe. Then we will extract
categorical attributes from both training and test sets, and encode the categorical attributes, and separate
For SQL Injection, Phishing attack and Cross Site Scripting Attack the output is in the format of 0 and 1,
where 0 is not an attack and 1 will be considered as malicious.
Fig.2: ABC
Fig.4: ABC
Fig.6: ABC
Fig.3: ABC
Fig.5: ABC
Fig.7: ABC
5.5 Math’s
A. SQL Injection:
SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL code for backend
database manipulation to access information that was not intended to be displayed. This information may
include any number of items, including sensitive company data, user lists or private customer details.
Examples of SQL injection:
o Retrieving hidden data, where you can modify an SQL query to return additional results.
o Subverting application logic, where you can change a query to interfere with the application's logic.
o UNION attacks, where you can retrieve data from different database tables.
o Examining the database, where you can extract information about the version and structure of the
database.
Blind SQL injection, where the results of a query you control are not returned in the application's
responses. To resolve this attack we use Logistic Regression model to train in machine learning platform.
C. Phishing Attack:
Phishing attacks are the practice of sending fraudulent communications that appear to come from a
reputable source. It is usually done through email. The goal is to steal sensitive data like credit card and
login information, or to install malware on the victim's machine.
The message is made to look as though it comes from a trusted sender. If it fools the victim, he or she is
coaxed into providing confidential information, often on a scam website. Sometimes malware is also
Fig.9: ABC
Fig.10: ABC
7. LIMITATIONS
1) No any attack detection software present at all.
2) Time consumed in accessing the attacks of the real time.
3) Manual creation of lists for various activities.
4) The general problem throughout this work is the detection of network attacks.
5) The problem definition gets more specific for any attack type and includes an expanded definition of
the attack and its behavior.
8. CONCLUSION
In this study, an attempt was made to use the resilient control consensus method in complex discrete cyber-
physical networks with a number of local attacks off. By applying this control method, it was observed
that even in the presence of cyber-attacks, the system can remain stable and isolate the attacked node and
the performance of the system is not weakened. Using the neural network used in this study, it was
observed that with a deep neural network, with 7 hidden layers, the system shows better performance.
Also in a recurrent neural network integrated with a deep neural network, a deep layer network with a
linear function performs better. Therefore, it can be said that the system has less complexity. So With deep
learning method, systems can analyse patterns and learn from them to help prevent similar attacks and
respond to changing behaviour. To summarise, ML has the potential to make cyber security simpler, more
proactive, less expensive, and considerably more successful. After observing the state of the system
reported by the neural network, the control system makes decisions based on it and, if there is an attack,
detects it and isolates it, so as not to have a detrimental effect on the behavior of other agents. Most
techniques used in today’s IDS are not able to deal with the dynamic and complex nature of cyber-attacks
on computer networks. As a result, effective adaptive approaches, such as machine learning techniques,
can result in higher detection rates, lower false alarm rates, and cheaper computing and transmission costs.
We reviewed several influential algorithms for attack detection based on various ML techniques. Because
of the characteristics of ML approaches, it is feasible to construct attacks with high detection rates and
low false positive rates, while the system rapidly adapts to changing hostile behaviors. One thing is sure,
any organization failing to adopt these techniques now or in the immediate future risk compromising data
or worse servers.
ACKNOWLEDGEMENTS
We would prefer to give thanks the researchers likewise publishers for creating their resources available.
We are conjointly grateful to guide, reviewer for their valuable suggestions and also thank the college
authorities for providing the required infrastructure and support.
REFERENCES
1. Z. N. Zarandi and I. Sharifi, "Detection and Identification of Cyber-Attacks in Cyber-Physical
Systems Based on Machine Learning Methods," 2020 11th International Conference on Information
and Knowledge Technology (IKT), 2020, pp. 107-112, doi: 10.1109/IKT51791.2020.9345627.
2. Nurjahan, F. Nizam, S. Chaki, S. Al Mamun and M. S. Kaiser, "Attack detection and prevention in
the Cyber Physical System," 2016 International Conference on Computer Communication and
Informatics (ICCCI), 2016, pp. 1-6, doi: 10.1109/ICCCI.2016.7480022.
3. Ding Chen, Qiseng Yan, Chunwang Wu and Jun Zhao, “SQL Injection Attack Detection and
Prevention Techniques Using Deep Learning,” Journal of Physics: Conference Series, Volume 1757,
International Conference on Computer Big Data and Artificial Intelligence (ICCBDAI 2020) 24-25
October 2020, Changsha, China
4. Ercan NurcanYılmaz, SerkanGönen, “Attack detection/prevention system against cyber-attack in
industrial control systems,” Computers & Security Volume 77, August 2018, pp 94-105
5. Arpitha. B, Sharan. R, Brunda. B. M, Indrakumar. D. M, Ramesh. B. E, “Cyber Attack Detection and
notifying system using ML Techniques,” International Journal of Engineering Science and
Computing (IJESC), Volume 11, Issue No.06
6. Yirui Wu, Dabao Wei, and Jun Feng, “Network Attacks Detection Methods Based on Deep Learning
Techniques: A Survey,” Security Threats to Artificial Intelligence-Driven Wireless Communication
Systems, 2020.
7. Rafał Kozik, Michał Choraś, “Machine Learning Techniques for Cyber Attacks Detection,” Image
Processing and Communications Challenges 5, pp 391-398, Springer International Publishing
Switzerland 2014.
8. Nutjahan, Farhana Nizam, Shudarshon Chaki, Shamim Al Mamun, M. Shamim, “Attack Detection
and Prevention in the Cyber Physical System,” 2016 International Conference on Computer
Comrnunication and Informatics (IEEE -2016), Jan. 07 - 09, 2016, Coimbatore, India
9. Yong Fang, Cheng Huang, Yijia Xu and Yang Li, “RLXSS: Optimizing XSS Detection Model to
Defend Against Adversarial Attacks Based on Reinforcement Learning,” Future Internet 2019.
10. Pratik Rajendra Chougule, Aniket Sanjay Kumbhar, Vinayak Vasant Pachange, Karan Dinkar
Phonde, S. P. Phadtare, “Phishing Websites Detection using Python,” Journal of Web Development
and Web Designing, Volume-5, Issue-2 (May-August, 2020)
11. Rishikesh Mahajan, Irfan Siddavatam, “Phishing Website Detection using Machine Learning
Algorithms,” International Journal of Computer Applications (0975 – 8887) Volume 181 – No. 23,
October 2018
12. Vishnu. B. A, Ms. Jevitha. K. P, “Prediction of Cross-Site Scripting Attack Using Machine Learning