Intelligent Security Systems. How Artificial Intelligence, Machine Learning and Data Science Work For and Against Computer Security

Description

Cover Title Page Copyright Page Contents Acknowledgments Introduction Chapter 1 Computer Security with Artificial Intelligence, Machine Learning, and Data Science Combination: What? How? Why? And Why Now and Together? 1.1 The Current Security Landscape 1.2 Computer Security Basic Concepts 1.3 Sources of Security Threats 1.4 Attacks Against IoT and Wireless Sensor Networks 1.4.1 Preliminary and Simple Attacks 1.4.2 Active Attacks 1.5 Introduction into Artificial Intelligence, Machine Learning, and Data Science 1.5.1 Why Is AI Needed in Computer Security? 1.5.2 Artificial Intelligence – A Brief Introduction 1.5.3 Difference Between AI, ML, and DS 1.5.4 AI Techniques 1.5.5 Rules Based and ES 1.6 Fuzzy Logic and Systems 1.7 Machine Learning 1.7.1 ML Algorithms Introduction 1.7.2 ML Classification for Cybersecurity 1.8 Artificial Neural Networks (ANN) 1.8.1 What Is an ANN? 1.8.2 ANN Architecture 1.8.3 ANN Classification 1.9 Genetic Algorithms (GA) 1.10 Hybrid Intelligent Systems Review Questions Exercises References Chapter 2 Firewall Design and Implementation: How to Configure Knowledge for the First Line of Defense? 2.1 Firewall Definition, History, and Functions: What Is It? And Where Does It Come From? 2.1.1 Firewall Functions 2.2 Firewall Operational Models or How Do They Work? 2.3 Basic Firewall Architectures or How Are They Built Up? 2.3.1 Screening Router 2.3.2 Dual-homed Gateway 2.3.3 Screened Host Gateway 2.3.4 Screened Subnet Architecture 2.4 Process of Firewall Design, Implementation, and Maintenance or What Is the Right Way to Put All Things Together? 2.4.1 Planning 2.4.2 Configuration 2.4.3 Testing 2.4.4 Deployment 2.4.5 Management 2.5 Firewall Policy Formalization with Rules or How Is the Knowledge Presented? 2.5.1 Rules Presentation 2.5.2 Policy Rule Types 2.5.3 Firewall Rules Samples 2.5.4 Firewall Rulesets Composition 2.6 Firewalls Evaluation and Current Developments or How Are They Getting More and More Intelligent? 2.6.1 Firewall Evaluation 2.6.2 Making Firewalls Robust with Fuzzy Logic 2.6.3 Dynamic Firewall Updating with Machine Learning 2.6.4 Next-generation Firewalls Review Questions Exercises References Chapter 3 Intrusion Detection Systems: What Do They Do Beyond the First Line of Defense? 3.1 Definition, Goals, and Primary Functions 3.2 IDS from a Historical Perspective 3.2.1 Conceptualization and Early Years (1980–Mid-1990s) 3.2.2 Commercialization of IDS (Mid-1990s–2005) 3.2.3 Proliferation of Intrusion Detection and Prevention Systems (2006–2015) 3.2.4 AI and ML in IDS Design (2016–) 3.3 Typical IDS Architecture Topologies, Components, and Operational Ranges 3.4 IDS Types: Classification Approaches 3.4.1 IDS Classification Scheme 3.4.2 Time Layer Classification 3.4.3 Classification Layer: Intrusion Detection Techniques 3.4.4 Hybrid Intrusion Detection 3.5 IDS Performance Evaluation 3.6 Artificial Intelligence and Machine Learning Techniques in IDS Design 3.6.1 Intelligent Techniques Used in IDS Design and Their Characteristics 3.6.2 IDS Design Based on k-means Algorithm 3.6.3 IDS Design Based on k-Nearest Neighbor Algorithm 3.6.4 IDS Design Based on Genetic Algorithms 3.6.5 Artificial Neural Network Structures and Their Choice for Intrusion Detection 3.7 Intrusion Detection Challenges and Their Mitigation in IDS Design and Deployment 3.7.1 Data Fluctuations 3.7.2 Attack Changes and Modifications 3.7.3 Delay Between a New Attack Signature Identification and Database Upgrading 3.7.4 Neglecting the Alarms 3.7.5 Software Bugs and Vulnerabilities 3.7.6 Overreliance on IDS and Relaxing Other Security Mechanisms 3.7.7 Encrypted Traffic and Other Data 3.7.8 Inaccurate Data 3.7.9 Attacks Against IDS Themselves 3.7.10 Human Intervention and High Experience is Required in IDS Maintenance 3.7.11 Lack of Resources for Big Data Analytics 3.7.12 IDS Deployment Advance Planning 3.7.13 Sensor to Manager Ratio 3.7.14 False Positive and False Negative Rates 3.7.15 Monitoring Traffic in Large Networks 3.8 Intrusion Detection Tools 3.8.1 SNORT 3.8.2 Other IDS Tools 3.8.3 Host-based IDS Tools and Systems Review Questions Exercises References Chapter 4 Malware and Vulnerabilities Detection and Protection: What Are We Looking for and How? 4.1 Malware Definition, History, and Trends in Development 4.2 Malware Classification 4.2.1 Malware Types 4.2.2 Viruses 4.2.3 Worms 4.2.4 Trojan Horses (aka Trojans) 4.2.5 Spyware 4.2.6 Adware 4.2.7 Ransomware 4.2.8 Rootkits 4.2.9 Botnets 4.3 Spam 4.3.1 Spam and Malicious Email 4.4 Software Vulnerabilities 4.5 Principles of Malware Detection and Anti-malware Protection 4.5.1 Ways of Malware Infection and Spread 4.5.2 Malware Detection Techniques 4.5.3 Content Analysis Techniques for Malware Prevention 4.5.4 Anti-spam Technologies and Techniques 4.6 Malware Detection Algorithms 4.6.1 Conventional Signature Scanning Techniques 4.6.2 Machine Learning Techniques for Signature Match and Anomaly Detection 4.6.3 Behavioral Analysis with Artificial Neural Networks 4.7 Anti-malware Tools 4.7.1 Anti-spam Tools Review Questions Exercises References Chapter 5 Hackers versus Normal Users: Who Is Our Enemy and How to Differentiate Them from Us? 5.1 Hacker’s Activities and Protection Against 5.1.1 Definition or Who Is a Hacker? 5.1.2 History and Philosophy of Hackers 5.1.3 Hacker’s Classification 5.1.4 Hacker’s Motives 5.1.5 Typical Hacker Activities 5.1.6 Hacking Tools 5.1.7 Anti-hacking Protection 5.1.8 Use Design Case: Recurrent Neural Networks for Colluded Applications Attack Detection in Android OS Devices 5.2 Data Science Investigation of Ordinary Users’ Practice 5.2.1 How Secure Is a Computer Practice of a General Public? 5.2.2 Data Analysis 5.2.3 Security Practice Analysis 5.2.4 Analysis Observations 5.2.5 Mobile Device Security Evaluation with Explicit Fuzzy Rules 5.3 User’s Authentication 5.3.1 What Is a Good Authentication? 5.3.2 Types of Authentication 5.3.3 Continuous Authentication 5.3.4 Continuous Authentication with Keyboard Typing Biometrics: Problems and Solutions 5.3.5 Keyboard Continuous Authentication System Design Use Case 5.4 User’s Anonymity, Attacks Against It, and Protection 5.4.1 TOR 5.4.2 Web Fingerprinting Attack 5.4.3 Defense Against the WF Attacks Review Questions Exercises References Chapter 6 Adversarial Machine Learning: Who Is Machine Learning Working For? 6.1 Adversarial Machine Learning Definition 6.2 Adversarial Attack Taxonomy 6.3 Defense Strategies 6.3.1 Countermeasures in the Training Phase 6.3.2 Countermeasures in the Execution/Testing Phase 6.4 Investigation of the Adversarial Attacks Influence on the Classifier Performance Use Case 6.4.1 Data Corruption by the Poisoning Attacks 6.4.2 Data Restoration Procedures 6.4.3 Classifier Performance Change with Corrupted and Restored Data 6.5 Generative Adversarial Networks 6.5.1 GAN Composition 6.5.2 Unsupervised Learning with GANs 5 Review Questions Exercises References Index EULA