Jul 2026· 2026 7th International Conference on Smart Systems and Inventive Technology (ICSSIT)· pp. 559-566· 0 citations· 15 references
Abstract
The fast-growing interconnectivity of networks and digital communication platforms, along with extensive information exchange, has made cybersecurity issues in modern computing environments more severe. The expansion of networking infrastructures always results in a massive flow of traffic, thus rendering traditional monitoring techniques and security tools ineffective. Modern cybersecurity systems often have problems detecting the changing nature of cyber threats since some of these have behaviors different from those associated with cyber attack signatures. This not only limits their effectiveness but also causes high rates of false alerts and late responses to complex threats like phishing, ransomware communications, distributed denial of service attacks, key logging activities, bot attacks, and packet sniffing. These all highlight the need for smart cybersecurity solutions that can analyze network activities effectively and detect any kind of threats. The designed model comprises two major layers, which are referred to as the data collection layer and the analysis layer. Network traffic details and system logs are collected using simulated or live data from either simulated or live environment and transformed into structured datasets to undergo the subsequent process steps. Preprocessing involves the removal of unnecessary data instances, cleansing of noise, and feature extraction to enable successful attack detection. This framework uses a combination of signature-based detection and anomaly detection methods to detect attacks through analysis of patterns that are consistent with an attack and patterns that are abnormal in terms of network behavior. This allows better detection of both current and new types of attacks. If a suspicious activity is observed in the network, then the design generates security alerts, stores the incident logs, and automatically responds by blocking the suspicious IP address.
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
The tremendous growth of networks and internet-based services have led to more numerous and complicated cyberattacks. Organizations today widely adopt networks for many things; like sending messages, transferring money, data storing, and using internet for communication and cloud computing. Therefore, networks are the attractive targets for the cyber-attacks and require protective mechanisms. Firewalls, antivirus program, and access controls provide the preventative means, but they are only enough for new attacks or simple kinds of attacks, they cannot provide any protection to sophisticated or newly discovered kinds of attacks. Intrusion detection systems are an unavoidable system for a cybersecurity environment, since they continuously monitor network traffic and detect malicious activity that the prevention mechanisms miss out. Machine learning methods have gained a considerable success at the field of network intrusion detection since they can analyse and learn patterns from network traffic, unlike rule-based systems, they do not require predefined signature of attacks. There are two types of machine learning algorithms, supervised learning and unsupervised learning. Unsupervised learning is more efficient for network intrusion detection and particularly Clustering as a type of unsupervised learning is used since it can help in partitioning the network traffic into various types of connection with identifying the anomalous connection without using the pre-labelled intrusion training data. The most popular methods in clustering are the K-means algorithm for its high calculation efficiency and ease of implementation, while expectation-maximization (EM) algorithms provide probabilistic model based-clustering which can model more complex kind of data. Only very few research has compared the two types of clustering, K-Means and EM algorithms for network intrusion detection system under exactly the same experimental settings and the same common dataset, The present study outlines the comparative analysis of K-Means and Expectation-Maximization clustering algorithms towards network intrusion detection through applying on the KDD Cup 1999 benchmark dataset. Experiments is setup using WEKA data mining tool for having a consistent research environment. Comparison research based on the computationally performance, clustering patterns, converging behaviours, and the execution efficiency in general manner. Data for network traffic is pre-processed and then the two clustering algorithms are analysed using exactly same parameters where appropriate. Comparison metrics for two algorithms includes the runtime, distribution patterns across clusters, speed of convergence, and clustering validity. The primary research intention is to assess the strengths and weakness of the K-means and EM algorithms for an unsupervised detection of intrusions, thus providing a guide for an appropriate clustering technique for large networks information security system.
Pratik Jain, S. Padalkar, Madhav Mohan Vagmare et al.· Journal of Intelligent Decis...· 0 citations
A thorough analysis of a modest version of a suggested system that use Support Vector Machines (SVM) to address networking anomaly and misuse detection in the face of insurmountable obstacles, foreseeing an all-encompassing solution to modern network security issues.
Gaurav Kishor Saxena, Shambhu Dayal Sahu· International Journal of Cre...· 0 citations
This paper presents a comprehensive and systematic review of deep learning techniques applied to cyber intrusion detection within IoV systems, conducted in accordance with the PRISMA framework across 83 selected studies published between 2020 and 2025.
Duygu Kayaoğlu, Eyup Emre Ulku, Onder Demir· Journal of Supercomputing· 0 citations
This review presents a comprehensive analysis of machine learning-based intrusion detection systems, covering a wide range of techniques including supervised learning, unsupervised learning, ensemble learning, and deep learning models, and discusses critical challenges affecting the deployment of ML-based IDS.
Ranobir Hasan, H. Jamal, Kamal Kamal et al.· The Eastasouth Journal of In...· 0 citations
In the ever-evolving digital era, computer networks have become the backbone of various information and communication systems. However, increased network usage has also led to increased security threats, such as Distributed Denial of Service (DDoS) attacks, ARP Spoofing, and other attacks. To address these threats, an approach capable of detecting, analyzing, and recovering networks from cyberattacks is needed. This study aims to analyze DDoS attacks using network forensics methods with an anomaly identification and attack reconstruction approach. This process includes collection, examination, analysis, and reporting stages using tools such as Wireshark and Winbox. Attack simulations were conducted using the LOIC application on a MikroTik router. The analysis results showed that the DDoS attack caused a CPU spike of up to 100%, which made the router unresponsive. Wireshark successfully identified the attack pattern in the form of UDP packet flooding, while Winbox showed a direct impact on device performance. The anomaly identification technique proved effective in detecting traffic spikes, and the reconstruction process helped understand the chronology and methods of the attack. This research contributes to the understanding and mitigation of cyber attacks through a network forensics approach, as well as being a guide in the implementation of security systems based on anomaly identification and attack reconstruction.
Mustamin Mustamin, Muhammad Na’im Al Jum’ah· Media of Computer Science· 0 citations