Xi Luo

In recent years, with the rapid development of the Internet of Things, large-scale botnet attacks have occurred frequently and have become an important challenge to network security. As artificial intelligence technology continues to evolve, intelligent detection solutions for botnets are constantly emerging. Although graph neural networks are widely used for botnet detection, directly handling large-scale botnet data becomes inefficient and challenging as the number of infected hosts increases and the network scale expands. Especially in the process of node level learning and inference, a large number of nodes and edges need to be processed, leading to a significant increase in computational complexity and posing new challenges to network security. This paper presents a novel approach that can accurately identify diverse intricate botnet architectures in extensive IoT networks based on the aforementioned circumstance. By utilizing GraphSAINT to process large-scale IoT botnet graph data, efficient and unbiased subgraph sampling has been achieved. In addition, a solution with enhanced information representation capability has been developed based on the Graph Isomorphism Network (GIN) for botnet detection. Compared with the five currently popular graph neural network (GNN) models, our approach has been tested on C2, P2P, and Chord datasets, and higher accuracy has been achieved.

Domain Name System (DNS) plays an infrastructure role in providing the directory service for mapping domains to IPs on the Internet. Considering the foundation and openness of DNS, it is not surprising that adversaries register massive domains to enable multiple malicious activities, such as spam, command and control (C&C), malware distribution, click fraud, etc. Therefore, detecting malicious domains is a significant topic in security research. Although a substantial quantity of research has been conducted, previous work has failed to fuse multiple relationship features to uncover the deep underlying relationships between domains, thus largely limiting their level of performance. In this paper, we proposed AGCN-Domain to detect malicious domains by combining various relations. The core concept behind our work is to analyze relations between domains according to their behaviors in multiple perspectives and fuse them intelligently. The AGCN-Domain model utilizes three relationships (client relation, resolution relation, and cname relation) to construct three relationship feature graphs to extract features and intelligently fuse the features extracted from the graphs through an attention mechanism. After the relationship features are extracted from the domain names, they are put into the trained classifier to be processed. Through our experiments, we have demonstrated the performance of our proposed AGCN-Domain model. With 10% initialized labels in the dataset, our AGCN-Domain model achieved an accuracy of 94.27% and the F1 score of 87.93%, significantly outperforming other methods in the comparative experiments.

With the rapid growth of IoT devices, the threat of botnets is becoming increasingly worrying. There are more and more intelligent detection solutions for botnets that have been proposed with the development of artificial intelligence. However, due to the current lack of computing power in IoT devices, these intelligent methods often cannot be well-applied to IoT devices. Based on the above situation, this paper proposes a distributed botnet detection method based on graph partitioning, efficiently detecting botnets using graph convolutional networks. In order to alleviate the wide range of IoT environments and the limited computing power of IoT devices, the algorithm named METIS is used to divide the network traffic structure graph into small graphs. To ensure robust information flow between nodes while preventing gradient explosion, diagonal enhancement is applied to refine the embedding representations at each layer, facilitating accurate botnet attack detection. Through comparative analysis with GATv2, GraphSAGE, and GCN across the C2, P2P, and Chord datasets, our method demonstrates superior performance in both accuracy and F1 score metrics. Moreover, an exploration into the effects of varying cluster numbers and depths revealed that six cluster levels yielded optimal results on the C2 dataset. This research significantly contributes to mitigating the IoT botnet threat, offering a scalable and effective solution for diverse IoT ecosystems.

Sub-hourly load forecasting can provide accurate short-term load forecasts, which is important for ensuring a secure operation and minimizing operating costs. Decomposition algorithms are suitable for extracting sub-series and improving forecasts in the context of short-term load forecasting. However, some existing algorithms like singular spectrum analysis (SSA) struggle to decompose high sampling frequencies and rapidly changing sub-hourly load series due to inherent flaws. Considering this, we propose an empirical mode decomposition-based hybrid model, named EMDHM. The decomposition part of this novel model first detrends the linear and periodic components from the original series. The remaining detrended long-range correlation series is simplified using empirical mode decomposition (EMD), generating intrinsic mode functions (IMFs). Fluctuation analysis is employed to identify high-frequency information, which divide IMFs into two types of long-range series. In the forecasting part, linear and periodic components are predicted by linear and trigonometric functions, while two long-range components are fitted by long short-term memory (LSTM) for prediction. Four forecasting series are ensembled to find the final result of EMDHM. In experiments, the model’s framework we propose is highly suitable for handling sub-hourly load datasets. The MAE, RMSE, MARNE, and R² of EMDHM have improved by 20.1%, 26.8%, 22.1%, and 5.4% compared to single LSTM, respectively. Furthermore, EMDHM can handle both short- and long-sequence, sub-hourly load forecasting tasks. Its R² only decreases by 4.7% when the prediction length varies from 48 to 720, which is significantly lower than other models.

Cyber-attacks have become more frequent, targeted, and complex as the exponential growth in computer networks and the development of Internet of Things (IoT). Network intrusion detection system (NIDS) is an important and essential tool to protect network environments. However, the low performance of a NIDS against small malicious samples has seriously threatened the security of networks, thus directly leading to the loss of personal property and national interests. Given this, we propose an auto encoder-based hybrid detection model, abbreviated as AHDM, for the intrusion detection with small-sample problem. AHDM has a dual classifier framework. It trains first neural network based on the encoding features obtained from the autoencoder feature enhancement algorithm to detect small-sample malicious traffic. It trains second neural network using the original features to detect normal traffic and large-sample malicious traffic. The final detection result of malicious traffic is obtained by combining the detection results of the two neural networks. In experiments, we use three classic datasets (KDD CUP 99, CIC-IDS-2017, and IOT-23) and simulate the malicious traffic detection targeting extremely small-sample malicious traffic. The results show that AHDM has a higher detection rate for small-sample malicious traffic compared to the advanced detection models (DNN and ACID). In the IOT-23 dataset, the AHDM model shows an absolute advantage in detecting DDoS type of malicious traffic, with a detection rate of 0.71, which is much higher than the DNN (0.14) and ACID (0.14) models.

While Internet-of-Things (IoT) significantly facilitates the convenience of people’s daily life, the lack of security practice raises the risk of privacy-sensitive user data leakage. Securing data transmission among IoT devices is therefore a critical capability of IoT environments such as Intelligent Connected Vehicles, Smart Home, Intelligent City and so forth. However, cryptographic communication scheme is challenged by the limited resource of low-cost IoT devices, even negligible extra CPU usage of battery-powered sensors would result in dramatical decrease of the battery life. In this paper, to minimize the resource consumption, we propose a communication protocol involving only the symmetric key-based scheme, which provides ultra-lightweight yet effective encryptions to protect the data transmissions. Symmetric keys generated in this protocol are delegated based on a chaotic system, i.e., Logistic Map, to resist against the key reset and device capture attacks. We semantically model such protocol and analyze the security properties. Moreover, the resource consumption is also evaluated to guarantee runtime efficacy.