Cybersecurity in Intelligent Networking Systems

Shengjie Xu, PhD, is an IEEE member and is an Assistant Professor in the Management Information Systems Department at San Diego State University, USA. Yi Qian, PhD, is an IEEE Fellow and is a Professor in the Department of Electrical and Computer Engineering at the University of Nebraska-Lincoln, USA. Rose Qingyang Hu, PhD, is an IEEE Fellow. She is also a Professor with the Electrical and Computer Engineering Department and the Associate Dean for Research of the College of Engineering, Utah State University, USA.

• ContentsPreface xiiiAcknowledgments xviiAcronyms xix1 Cybersecurity in the Era of Artificial Intelligence 11.1 Artificial Intelligence for Cybersecurity . 21.1.1 Artificial Intelligence 21.1.2 Machine Learning 41.1.3 Data-Driven Workflow for Cybersecurity . 61.2 Key Areas and Challenges 71.2.1 Anomaly Detection . 81.2.2 Trustworthy Artificial Intelligence . 101.2.3 Privacy Preservation . 101.3 Toolbox to Build Secure and Intelligent Systems . 111.3.1 Machine Learning and Deep Learning . 121.3.2 Privacy-Preserving Machine Learning . 141.3.3 Adversarial Machine Learning . 151.4 Data Repositories for Cybersecurity Research . 161.4.1 NSL-KDD . 171.4.2 UNSW-NB15 . 17v1.4.3 EMBER 181.5 Summary 182 Cyber Threats and Gateway Defense 192.1 Cyber Threats . 192.1.1 Cyber Intrusions . 202.1.2 Distributed Denial of Services Attack . 222.1.3 Malware and Shellcode . 232.2 Gateway Defense Approaches 232.2.1 Network Access Control 242.2.2 Anomaly Isolation 242.2.3 Collaborative Learning . 242.2.4 Secure Local Data Learning 252.3 Emerging Data-Driven Methods for Gateway Defense 262.3.1 Semi-Supervised Learning for Intrusion Detection 262.3.2 Transfer Learning for Intrusion Detection 272.3.3 Federated Learning for Privacy Preservation . 282.3.4 Reinforcement Learning for Penetration Test 292.4 Case Study: Reinforcement Learning for Automated Post-BreachPenetration Test . 302.4.1 Literature Review 302.4.2 Research Idea 312.4.3 Training Agent using Deep Q-Learning 322.5 Summary 34vi3 Edge Computing and Secure Edge Intelligence 353.1 Edge Computing . 353.2 Key Advances in Edge Computing . 383.2.1 Security 383.2.2 Reliability . 413.2.3 Survivability . 423.3 Secure Edge Intelligence . 433.3.1 Background and Motivation 443.3.2 Design of Detection Module 453.3.3 Challenges against Poisoning Attacks . 483.4 Summary 494 Edge Intelligence for Intrusion Detection 514.1 Edge Cyberinfrastructure . 514.2 Edge AI Engine 534.2.1 Feature Engineering . 534.2.2 Model Learning . 544.2.3 Model Update 564.2.4 Predictive Analytics . 564.3 Threat Intelligence 574.4 Preliminary Study . 574.4.1 Dataset 574.4.2 Environment Setup . 594.4.3 Performance Evaluation . 59vii4.5 Summary 635 Robust Intrusion Detection 655.1 Preliminaries 655.1.1 Median Absolute Deviation . 655.1.2 Mahalanobis Distance 665.2 Robust Intrusion Detection . 675.2.1 Problem Formulation 675.2.2 Step 1: Robust Data Preprocessing 685.2.3 Step 2: Bagging for Labeled Anomalies 695.2.4 Step 3: One-Class SVM for Unlabeled Samples . 705.2.5 Step 4: Final Classifier . 745.3 Experiment and Evaluation . 765.3.1 Experiment Setup 765.3.2 Performance Evaluation . 815.4 Summary 926 Efficient Preprocessing Scheme for Anomaly Detection 936.1 Efficient Anomaly Detection . 936.1.1 Related Work . 956.1.2 Principal Component Analysis . 976.2 Efficient Preprocessing Scheme for Anomaly Detection . 986.2.1 Robust Preprocessing Scheme . 996.2.2 Real-Time Processing 103viii6.2.3 Discussions 1036.3 Case Study . 1046.3.1 Description of the Raw Data 1056.3.2 Experiment 1066.3.3 Results 1086.4 Summary 1097 Privacy Preservation in the Era of Big Data 1117.1 Privacy Preservation Approaches 1117.1.1 Anonymization 1117.1.2 Differential Privacy . 1127.1.3 Federated Learning . 1147.1.4 Homomorphic Encryption 1167.1.5 Secure Multi-Party Computation . 1177.1.6 Discussions 1187.2 Privacy-Preserving Anomaly Detection . 1207.2.1 Literature Review 1217.2.2 Preliminaries . 1237.2.3 System Model and Security Model 1247.3 Objectives and Workflow . 1267.3.1 Objectives . 1267.3.2 Workflow . 1287.4 Predicate Encryption based Anomaly Detection . 1297.4.1 Procedures 129ix7.4.2 Development of Predicate . 1317.4.3 Deployment of Anomaly Detection 1327.5 Case Study and Evaluation . 1347.5.1 Overhead . 1347.5.2 Detection . 1367.6 Summary 1378 Adversarial Examples: Challenges and Solutions 1398.1 Adversarial Examples . 1398.1.1 Problem Formulation in Machine Learning 1408.1.2 Creation of Adversarial Examples . 1418.1.3 Targeted and Non-Targeted Attacks . 1418.1.4 Black-Box and White-Box Attacks 1428.1.5 Defenses against Adversarial Examples 1428.2 Adversarial Attacks in Security Applications 1438.2.1 Malware 1438.2.2 Cyber Intrusions . 1438.3 Case Study: Improving Adversarial Attacks Against MalwareDetectors 1448.3.1 Background 1448.3.2 Adversarial Attacks on Malware Detectors 1458.3.3 MalConv Architecture 1478.3.4 Research Idea 1488.4 Case Study: A Metric for Machine Learning Vulnerability toAdversarial Examples . 1498.4.1 Background 1498.4.2 Research Idea 1508.5 Case Study: Protecting Smart Speakers from Adversarial VoiceCommands . 1538.5.1 Background 1538.5.2 Challenges 1548.5.3 Directions and Tasks 1558.6 Summary 157xi