Opin vísindi

 

Nýlega bætt við

Verk
Identifying malicious hosts involved in periodic communications
(Institute of Electrical and Electronics Engineers Inc., 2017-12-08) Apruzzese, Giovanni; Marchetti, Mirco; Colajanni, Michele; Zoccoli, Gabriele Gambigliani; Guido, Alessandro; Avresky, Dimiter R.; Gkoulalas-Divanis, Aris; Avresky, Dimiter R.; Correia, Miguel P.; Department of Computer Science
After many research efforts, Network Intrusion Detection Systems still have much room for improvement. This paper proposes a novel method for automatic and timely analysis of traffic generated by large networks, which is able to identify malicious external hosts even if their activities do not raise any alert by existing defensive systems. Our proposal focuses on periodic communications, since our experimental evaluation shows that they are more related to malicious activities, and it can be easily integrated with other detection systems. We highlight that periodic network activities can occur at very different intervals ranging from seconds to hours, hence a timely analysis of long time-windows of the traffic generated by large organizations is a challenging task in itself. Existing work is primarily focused on identifying botnets, whereas the method proposed in this paper has a broader target and aims to detect external hosts that are likely involved in any malicious operation. Since malware-related network activities can be considered as rare events in the overall traffic, the output of the proposed method is a manageable graylist of external hosts that are characterized by a considerably higher likelihood of being malicious compared to the entire set of external hosts contacted by the monitored large network. A thorough evaluation on a real large network traffic demonstrates the effectiveness of our proposal, which is capable of automatically selecting only dozens of suspicious hosts from hundreds of thousands, thus allowing security operators to focus their analyses on few likely malicious targets.
Verk
High Resolution In-Situ Skin Cancer Microwave Imaging Using Super Wideband Antenna
(Institute of Electrical and Electronics Engineers Inc., 2023) Alamro, Wasan; Seet, Boon Chong; Wang, Lulu; Parthiban, Prabakar; Zhao, XiaoMing; Li, Qingli; Wang, Lipo; Department of Engineering
This paper investigates the capability of a super wideband (SWB) antenna based imaging system in early-stage skin cancer detection. The imaging system consists of eight antenna elements in a circular array positioned around a human trunk phantom modeled as five concentric layers of skin, fat, muscle, rib bone and lung tissues. The dielectric properties of the phantom tissues are calculated using Cole-Cole model. The skin tumor is modeled as cylindrical shape on the outer skin layer with 1mm thickness and 15mm diameter. The resulting S-parameters of healthy and malignant phantoms obtained over different frequency ranges are compared and used to reconstruct the 2D images of the trunk area. The results show that the proposed SWB imaging system can detect and localize in-situ skin cancer with relatively high accuracy.
Verk
Evaluating the effectiveness of Adversarial Attacks against Botnet Detectors
(Institute of Electrical and Electronics Engineers Inc., 2019-09) Apruzzese, Giovanni; Colajanni, Michele; Marchetti, Mirco; Gkoulalas-Divanis, Aris; Marchetti, Mirco; Avresky, Dimiter R.; Department of Computer Science
Classifiers based on Machine Learning are vulnerable to adversarial attacks, which involve the creation of malicious samples that are not classified correctly. While this phenomenon has been extensively studied within the image processing domain, comprehensive analyses are scarce in the cybersecurity field. This is a critical problem because cyber-detectors are being increasingly integrated with machine learning methods, making them suitable targets for skilled attackers leveraging adversarial samples to evade detection. In this paper, we propose a thorough analysis of realistic adversarial attacks performed against network intrusion detection systems that focus on identifying botnet traffic through machine learning classifiers. Our large campaign of experiments involves the most recent public datasets, representing multiple realistic network scenarios. Moreover, we evaluate the impact of these attacks against state-of-the-art detectors relying on different machine learning algorithms, providing a clear overview of this problem. The results outline the fragility of these methods. Our study represent a stepping stone for devising suitable countermeasures to the menace of adversarial attacks against cyber-detectors.
Verk
Evading botnet detectors based on flows and random forest with adversarial samples
(Institute of Electrical and Electronics Engineers Inc., 2018-11-26) Apruzzese, Giovanni; Colajanni, Michele; Department of Computer Science
Machine learning is increasingly adopted for a wide array of applications, due to its promising results and autonomous capabilities. However, recent research efforts have shown that, especially within the image processing field, these novel techniques are susceptible to adversarial perturbations. In this paper, we present an analysis that highlights and evaluates experimentally the fragility of network intrusion detection systems based on machine learning algorithms against adversarial attacks. In particular, our study involves a random forest classifier that utilizes network flows to distinguish between botnet and benign samples. Our results, derived from experiments performed on a public real dataset of labelled network flows, show that attackers can easily evade such defensive mechanisms by applying slight and targeted modifications to the network activity generated by their controlled bots. These findings pave the way for future techniques that aim to strengthen the performance of machine learning-based network intrusion detection systems.
Verk
E-PhishGEN : Unlocking Novel Research in Phishing Email Detection
(Association for Computing Machinery, Inc, 2025-12-30) Pajola, Luca; Caripoti, Eugenio; Banzer, Stefan; Pizzi, Simeone; Conti, Mauro; Apruzzese, Giovanni; Department of Computer Science
Every day, our inboxes are flooded with unsolicited emails, ranging between annoying spam to more subtle phishing scams. Unfortunately, despite abundant prior efforts proposing solutions achieving near-perfect accuracy, the reality is that countering malicious emails still remains an unsolved dilemma. This "open problem"paper carries out a critical assessment of scientific works in the context of phishing email detection. First, we focus on the benchmark datasets that have been used to assess the methods proposed in research. We find that most prior work relied on datasets containing emails that - we argue - are not representative of current trends, and mostly encompass the English language. Based on this finding, we then re-implement and re-assess a variety of detection methods reliant on machine learning (ML), including large-language models (LLM), and release all of our codebase - an (unfortunately) uncommon practice in related research. We show that most such methods achieve near-perfect performance when trained and tested on the same dataset - a result which intrinsically hinders development (how can future research outperform methods that are already near perfect?). To foster the creation of "more challenging benchmarks"that reflect current phishing trends, we propose E-PhishGEN, an LLM-based (and privacy-savvy) framework to generate novel phishing-email datasets. We use our E-PhishGEN to create E-PhishLLM, a novel phishing-email detection dataset containing 16616 emails in three languages. We use E-PhishLLM to test the detectors we considered, showing a much lower performance than that achieved on existing benchmarks - indicating a larger room for improvement. We also validate the quality of E-PhishLLM with a user study (n=30). To sum up, we show that phishing email detection is still an open problem - and provide the means to tackle such a problem by future research.

Flokkar í Opnum vísindum

Veldu flokk til að skoða.

Niðurstöður 1 - 9 af 9

Öll gögn í Opnum vísindum eru vernduð af ákvæðum höfundalaga og með öllum réttindum áskildum, nema annað sé tekið fram.