A Cognitive Approach to Intrusion Detection

Cyber-attackers unit investment automation technology to launch strikes, whereas many organisations unit still victimisation manual efforts to mixture internal security findings and contextualising them with external threat data. Victimisation these ancient ways that, it'll take weeks or months to sight intrusions, throughout that amount attackers can exploit vulnerabilities to compromise systems and extract info. To wear down these challenges, progressive organisations unit exploring the employment of AI (AI) in their regular cyber risk management operations. The speed of processes and conjointly the amount of data to be used in defensive the cyberspace can't be handled by humans whereas not sizeable automation. However, it's hard to develop code with customarily mounted algorithms (hard-wired logic on deciding level) for effectively defensive against the dynamically evolving attacks in networks. this instance is also handled by applying methods of computing that supply...

IOP Conference Series: Materials Science and Engineering, 2020

Predicting or estimating the occurrence of a cyberattack has been a challenge for various sectors including defense one. In this paper we propose a new method for making a prediction or an estimation of the occurrence of cyberattacks in terms of the attack type or category and when the attack(s) would be possible to occur. Our method based on Cognitive Artificial Intelligence (CAI) approach called as Knowledge Growing System (KGS). For this purpose, we did a simulation using random numbers which were generated based on the real data from UNSW-NB15. From the simulation results, we can conclude that CAI is able to deliver a prediction or an estimation of the occurrence of future possible cyberattacks.

Data & Knowledge Engineering, 2013

Every organization uses computer networks (consisting of networks of networks) for resource sharing (i.e. printer, files, etc.) and communication. Computer networks today are increasingly complex, and managing such networks requires specialized expertise. Monitoring systems help network administrators in monitoring and protecting their network by not allowing users to run illegal application or changing the configuration of network nodes. In this paper we have developed an agent based system for activity monitoring on networks (ABSAMN) and proposed Categorization of Malicious Behaviors using Cognitive Agents (CMBCA). This uses ontology to predict unknown illegal applications based on known illegal application behaviors. CMBCA is an intelligent multi agent system used to detect known and unknown malicious activities carried out users over the network. We have compared An Agent Based System for Activity Monitoring on Network (ABSAMN) and Categorization of Malicious Behaviors using Cognitive Agents (CMBCA) concurrently at the university campus having seven labs equipped with 20 to 300 PCs in various labs. Both systems were tested on the same configuration; results indicate that CMBCA outperforms ABSAMN in every aspect.

Information Technology …, 1998

This paper focuses on intrusion detection and countermeasures with respect to widely-used operating systems and networks. The design and architecture of an intrusion detection system built from distributed agents is proposed to implement an intelligent system on which data mining can be performed to provide global, temporal views of an entire networked system.

ISJEM, 2024

The rise of cyber threats has underscored the need for advanced tools that can predict, detect, and respond to security incidents with minimal human intervention. Artificial Intelligence (AI) is now at the forefront of such tools, transforming intrusion detection and threat intelligence systems with its ability to analyze vast amounts of data, learn from patterns, and adapt to emerging threats. This article explores how AI is reshaping intrusion detection systems (IDS) and threat intelligence platforms, examining the methods, advantages, and challenges associated with AI-driven security systems. Through AI, enterprises can strengthen their cyber defenses by enabling proactive, real-time responses to increasingly sophisticated cyber threats.

2020

Large CSOCs (cybersecurity operation centers) must analyze tens of thousands of security incidents per day. Not only that there are not enough cybersecurity analysts available but the average cost of a cybersecurity analyst keeps going up. This paper presents a novel approach to the detection of APTs (advanced persistent threats), where an expert cybersecurity analyst directly teaches (rather than programs) a cognitive agent how to investigate cybersecurity alerts, as the analyst would teach a student, through explained examples of investigations. It then presents two complementary instantiations of this approach, as implemented in ADONIS (Automating the ATT&CKTM-based Detection Of Novel Network Intrusions System) and CAAPT (Cognitive Agent for APT detection). ADONIS detects adversary’s behavior in terms of MITRE’s ATT&CK (Adversarial Tactics, Techniques & Common Knowledge), independent of specific malware and tools. It can therefore detect novel intrusions, but is expected to be le...

International Journal of Software Engineering & Applications

Internet usage has increased quickly, particularly in the previous decade. With the widespread use of the internet, cybercrime is growing at an alarming rate in our daily lives. However, with the growth of artificial intelligence (AI), businesses are concentrating more on preventing cybercrime. AI is becoming an essential component of every business, affecting individuals worldwide. Cybercrime is one of the most prominent domains where AI has begun demonstrating valuable inputs. As a result, AI is being deployed as the first line of defense in most firms' systems. Because AI can detect new assaults faster than humans, it is the best alternative for constructing better protection against cybercrime. AI technologies also offer more significant potential in the development of such technology. This paper discusses recent cyber intrusions and how the AI-enabled industry is preparing to defend itself in the long run.

2020

Cybersecurity attacks are considered among the top five of risks worldwide, according to the World Economic Forum in the year 2019. This context has generated the need to improve the tasks of cybersecurity defense in organizations. Improving the effectiveness in executing a cybersecurity task requires three pillars: people, processes and technologies. The proposal in this work is to analyze the integration of these three components as a strategy to improve the effectiveness of the execution of operational tasks in cyber defense, specifically the detection of anomalies. Based on the foundation that: cybersecurity operational tasks carried out daily by analysts require the use of cognitive processes, and that the use of techniques based on technologies such as machine learning, data mining and data science have generally been used to automate cybersecurity tasks, we have considered the use of cognitive security, as a strategy to improve the anomaly detection process, taking into account the cognitive processes and skills that are executed by the security analyst.

2010

Many advanced techniques have been developed recently to help fight against intrusion. Significant power in this direction can be gained by better taking advantage of the patterns available in the data passing through the network. We have conceived various software agents, distributed over a network, that are able to collect and filter the data and also consider the firewall rules. Preliminary experiments show a significant gain.

Journal of Digital Information Management

Today the security aspect is a backbone of every computer system, particularly when this system contains sensitive information. When we use our computers and connect to the network or use web services, we trust that our personal and sensitive information (images, passwords, credit card number …etc) are confidential and well secured by the used security system. Unfortunately, the hackers may succeed to gain access to the system and misuse our information. Generally, the aim of the intrusion is to find new ways to annoy, steal and harm parts of computer systems. Moreover, with the possibility of connecting several computers and networks, the necessity of protecting the whole data and machines from attackers (hackers) that try to get some confident information to use for their own benefit or just destroy or modify valuable information was born. At this point IDS appears to help users, companies or institutions to detect when they are getting compromised. In this paper, we develop an intrusion detection system using multi agent system, ontological techniques (IDSMAO) and misuse method.