8333 research outputs found
Sort by
Ensuring Network Security in Remote Work Environment
No full textThe outbreak of the COVID-19 pandemic has led to the increased use of remote work, and this has greatly improved the uncertainties of cybersecurity hence the need for sophisticated IDS for remote systems. In this work, a comparative study is presented between IDS ML and DL models by using the CICIDS-2017 dataset. The analysis compares clustering algorithms – K-Means, DBSCAN, and DL models – LSTM, Attention LSTM, and Transformer – in threat identification, including zero-day threats. Among the models, the highest precision (95.78%) is seen for the Transformer, as well as a relatively high F1-score with a value of 93.76% This ability of the Transformer model is connected to the model’s ability to work with dependencies between features. LSTM and Attention LSTM models both provided good rates of recall at 98.19% and 98.15% respectively, which is especially good for identifying frequently occurring, known attack types. In this task, supervised methods outperformed unsupervised methods like KMeans and DBSCAN with 15.25% and 0.76% accuracy, respectively, as both algorithms are weak when it comes to a high number of attributes data. This discussion also highlights the use of DL model’s effectiveness in structured IDS application while paving ways to consider the future research with transformer-based algorithms for zero-day attacks
Enhancing IoT Healthcare Security: A Blockchain and AES-Based Framework for Secure Data Transmission and Management
No full textThe increasing trend of Internet of Things (IoT) in healthcare systems has brought up many concerns related to data security and privacy. The existing approaches suffer from efficiency, scalability, and proper protection against unauthorized access. This paper introduces an advanced framework that combines blockchain technology with AES-256 encryption and the MIDC (Monitoring, Integrity, Data Control) framework to address these challenges. The key goals of the framework are to increase data security, integrity, reduce unauthorized access, and automate the access control process using smart contracts. The model is compliant with the regulations of GDPR and HIPAA, thereby meeting the requirements of data privacy standards. The proposed system was compared with the existing encryption techniques and showed superior performance in terms of reducing the encryption time to 3.0 seconds, decryption time to 2.8 seconds, and buffer time to 0.140 MB. These results indicate the efficiency of the model in processing IoT healthcare data, which is better in terms of speed and resource utilization than traditional AES-256 and hybrid encryption models. The smart contracts enable role-based access control, making it easier to manage data-sharing policies and ensuring safe, automated access to data. Despite its promising performance, one challenge remains in the energy optimization of blockchain-based systems with regard to scalability and sustainability. Future work will go towards this challenge in such a way that further optimization of the model will be performed not at the cost of the security. This framework gives rise to a robust solution to securing the IoT healthcare systems with many great benefits in real-world applications, primarily in resource-constrained environments such as healthcare IoT devices
Enhancing Zero-Day Malware Detection in Enterprise Networks Using Behaviour-Based Machine Learning Models
No full textIn the field of cybersecurity and machine learning, zero-day malware poses a significant threat to enterprise networks because of its ability to counter any in-place security and exploit unknown vulnerabilities. This eventually renders the traditional signature-based detection methods very ineffective and so this research study presents a complete framework which can allow the zero-day malware detection enhancement. This enhancement is done by combining behavior-based analysis with advanced machine learning techniques. Utilizing the EMBER dataset, a large-scale collection of labeled Windows Portable Executable (PE) files, both static and behavior-based features were extracted such that internal patterns of the malwares were captured and understood. This study involves a powerful methodology with extensive data preprocessing, feature engineering through dimensionality reduction techniques like Principal Component Analysis (PCA), and the various machine learning models. These machine learning models included Random Forest, Gradient Boosting, XGBoost, and LightGBM classifiers. There was one more attempt of combining these ML models i.e. an autoencoder-based anomaly detection mechanism was used to identify, slight or major, deviations from normal behavior which ended up enhancing the variants’ detection of unseen malware. These ML models were evaluated using a combination of traditional performance metrics, accuracy, precision, recall, F1-score, but also the cybersecurity-specific evaluation measures such as Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). The Random Forest classifier emerged as the best-performing model. The model showed extraordinary results against common malware evasion techniques i.e. code obfuscation and packing. This was primarily because of the addition of the behavior-based features which have been known to be less susceptible to static code changes. The hybrid model used in this study, which combined the anomaly detection with classification, had improved recall but also showed a minor increase in the false positives. This meant that the need for balance in detection sensitivity was important. Furthermore, to cater the practical application of this research, this study’s implementation also included the development of a malware detection API and a simple intrusion detection system (IDS). This study also had some limitations which included the exclusion of dynamic features because of resource constraints and simulated MTTD and MTTR eval metrics, but it also showed that the results had potential for real-world deployment
Enhancing Peer-to-Peer Security with a Two-Stage Blockchain Model: Mitigating Sybil and 51% Attacks
No full textThe Blockchain technology is decentralized in nature which ensures data integrity and transparency but significantly fails in security challenges especially in peer-to-peer (P2P) networks, more prone to attacks like Sybil and 51% attacks. Therefore, applications like finance, secure communication and file sharing requires high security and trust to overcome these vulnerabilities. The current thesis work ensures to address these issues by implementing Two-Stage Secure P2P Model using Blockchain. It leverages the decentralized peer authentication method and ensure secure transaction validation mechanisms. Two-Stage Secure P2P includes, Blockchain centric cryptographic techniques to authenticate each person’s identity by limiting the number of nodes one can control. This limitation minimizes the domination of single user on the network reducing the Sybil and 51% attacks (Unchaining Blockchain Security Part 3: Exploring the Threats Associated with Private Blockchain Adoption | Trend Micro (US), 2024). In the later stage, Blockchain consensus mechanisms like Proof of Stake (PoS) which prioritizes the data integrity without affecting global consensus. Using NS-3 network simulator, model is being evaluated on the key performance metrics such as Scalability, latency, and resilience. Simulation results demonstrate that the proposed model effectively prevents common P2P attacks while maintaining high scalability and low transaction latency. By restricting node control per user, the model enhances trust and integrity within the network. This Two-Stage Secure P2P Model addresses critical security and privacy concerns in decentralized networks, offering a scalable and robust solution suitable for sensitive applications. Future work will explore optimizing scalability under high transaction volumes and refining node control mechanisms to further strengthen security
Evaluating the Effectiveness of OpenAI a Dedicated Penetration Testing Chatbot in a Comparative Analysis of AI-Assisted and Manual Workflows
No full textPenetration testing, a fundamental cybersecurity practice, traditionally involves manual methods that require skilled professionals to identify and exploit system weaknesses. While effective, these manual approaches can be time-consuming. Recent advancements in Large Language Models, such as the OpenAI GPT series, offer a promising hybrid solution that combines automation efficiency with human precision. This study explores the integration of LLM-powered chatbots into penetration testing workflows, focusing on their effectiveness, efficiency, and usability. Through a comparative analysis of manual and chatbot-assisted workflows on retired Hack The Box (HTB) virtual machines, this research measures detection accuracy, false positive rates, task completion time, and exploitation success rates. Chatbot-assisted workflows exhibited higher detection accuracy (93% vs. 85%), lower false positive rates (9% vs. 14%), and significantly faster task completion times (28% reduction). Qualitative feedback highlighted the chatbot’s adaptability and iterative guidance, although limitations in handling novel vulnerabilities and domain-specific questions were observed. The findings suggest that LLM-based tools can significantly enhance penetration testing, especially for routine and structured tasks. However, human expertise remains essential for complex, non-standard scenarios. This research underscores the transformative potential of LLMs in advancing cybersecurity practices
Zero-Day Exploit Identification in Web Application Using Machine Learning
No full textZero day threats are a significant risk to web applications since they are new and exotic targets that they cannot be covered by most present day anti-hacking measures. This research aims at detecting Zero-day threats through combining machine learning algorithms with AWS CloudWatch logs improving a real time anomaly detection in cloud environment. The research employs a novel end to end machine learning workflow which helps in examining network traffic data for signs of drifts indicative of potential future zero-day attacks. Other types of models like Random Forest, Isolation Forest, Gradient Boost, Support Vector Classifier (SVC) and Deep Neural Network were tested for their performance efficiency where Deep Neural Network outperformed the other models with good the detection accuracy and five times fewer false positives. The factor of real-time alerting included effective mechanisms that have made it easier to alert user and respond quickly to any threat. Through AWS’s logging and high computational capabilities organizations can enhance their protection against advanced attacks with improved overall performance of cloud-based systems
Securing Postfix Mail servers from BruteForce attacks using containerization and Fail2ban
No full textThe growing frequency and severity of cyber-attacks need comprehensive security measures for email servers. Postfix, a widely used mail transfer agent, is frequently the subject of brute force attacks. Such incidents might result in illegal access, revealing sensitive information and interrupting communication services. Traditional security solutions, while useful to some level, sometimes fall short of providing total coverage. Furthermore, coordinating authentication across numerous email-related services may be complicated and error-prone.
This paper addresses the essential issue of protecting email servers, notably Postfix, from attacks like this while increasing system management and scalability. The main issue addressed is the vulnerability of email servers to brute force attacks as well as the complexities involved in handling authentication across numerous services.
To solve these issues, this research installed Fail2Ban (as used by Makopa et al., 2023) on the same server having Postfix and other containers configured, to successfully prevent brute force attacks. A custom script in fail2ban was created for preventing the ports. Further, considering multiple postfix servers and to keep system users separate from mailing users, Postfix and Dovecot were combined with MariaDB to provide central authentication, reducing administrative work while increasing security. Furthermore, a huge milestone was made by converting Postfix and its dependent services, such as Dovecot, DKIM, and DMARC, to Podman containers—an invention that had never been described before.
The outcomes of these implementations were impressive. Fail2Ban successfully decreased the number of brute force attacks, hence improving the security of the Postfix server. The interface with MariaDB enabled a centralized administration system, which streamlined the authentication process across several services. The containerization of Postfix and its dependencies using Podman proved greater portability, consistency, and deployment simplicity, marking an iconic moment in this sector.
Theoretically, this study offers to the body of knowledge by illustrating an integrated approach to protecting and maintaining email servers that is consistent with current practices in cybersecurity and systems administration. Practically, the significant benefits are increased security, improved management, and higher deployment flexibility, which make the system more robust and easier to maintain
Leveraging Advanced Machine Learning Ensembles for Enhanced IoT Security: A Comprehensive Study on Intrusion Detection Systems
No full textThe Internet of Things (IoT) for instance, has significantly changed the way devices communicate and how automation is facilitated across large ecosystems efficiently in a connected manner. This has a massively increased the attack surface, making secure policies and tools like Intrusion Detection Systems (IDS) absolutely critical for protecting them. This research focuses on the use of state-of-the-art machine learning algorithms Logistic Regression, Decision Tree and LightGBM, to design an IDS capable for usage in IoT networks. We then demonstrate that using the BoT-IoT dataset as a training and testing data, modelling the semi-supervised SW under ensemble learning principles enhances detection performance compared to individual models. This indicates that current machine learning techniques have the capability to improve IoT security mechanisms mainly through their powerful, complex adaptability features of typical dynamic and smart nature challenges in designing secure environments for IoT
Managing Risks in Enterprise VPNs: A Framework
No full textWith the widespread adoption of Virtual Private Networks during COVID, VPNs proved a valuable target for hackers looking for entry into enterprise networks. Attacks have risen dramatically in recent years, and further investigation into the vulnerabilities exploited seemed warranted. This is done with a view to categorising the attacks and building a model that outlines appropriate steps at remediation and limiting of risk where possible. If codified into a framework, this should provide a path to greater overall security while allowing for remote access to networks
Testing The Efficacy of Windows Defender Endpoint Security Control Using BAS Technology
No full textData breaches have become a widespread and expensive concern for enterprises worldwide in the quickly changing cyber threat landscape of today. This paper examines the substantial impact of misconfigurations, frequently caused by human errors and insufficient security measures, in contributing to catastrophic breaches. Utilising information from recent case studies and industry reports, such as the 2023 Data Breach Investigations Report, the research emphasises how misconfigurations enable unauthorised access and the exploitation of vulnerabilities. The study highlights the importance of ongoing and effective configuration management and continual security validation. It suggests utilising modern Breach and Attack Simulation (BAS) tools to automate and improve the process of testing security control capabilities. Moreover, the incorporation of AttackIQ's Flex platform, which provides complimentary and sophisticated adversary simulation and security control testing, is positioned as a cost-efficient and easily attainable solution for enhancing organisational security. This research places emphasis on the significance of proactive and well-informed security management. It offers practical suggestions for reducing the risks associated with misconfigurations and improving overall cybersecurity resilience. The purpose of the research is to provide guidance to cybersecurity professionals, policymakers, and organisations on how to implement steps to protect sensitive information and establish strong security frameworks to protect critical organizational assets