An enhanced network intrusion detection system for malicious crawler detection and security event correlations in ubiquitous banking infrastructure. Issue 1 (6th September 2021)

• Record Type: Journal Article
• Authors: Eswaran, Sivaraman; Rani, Vakula; D., Daniel; Ramakrishnan, Jayabrabu; Selvakumar, Sadhana
• Is Part Of: International journal of pervasive computing and communications. Volume 18:Issue 1(2022)
• Page Start: 59
• Page End: 78
• Publication Date: 2021-09-06
• Subjects: Intrusion detection system (IDS) -- Support vector machine -- Bayesian network -- Malicious crawlers -- Security correlations; Ubiquitous computing -- Periodicals; Mobile computing -- Periodicals; Computer network protocols -- Periodicals; Computer network architectures -- Periodicals; Application software -- Development -- Periodicals; 004.6
• DOI: 10.1108/IJPCC-04-2021-0102
• Languages: English
• ISSNs: 1742-7371

Abstract

Abstract : Purpose: In the recent era, banking infrastructure constructs various remotely handled platforms for users. However, the security risk toward the banking sector has also elevated, as it is visible from the rising number of reported attacks against these security systems. Intelligence shows that cyberattacks of the crawlers are increasing. Malicious crawlers can crawl the Web pages, crack the passwords and reap the private data of the users. Besides, intrusion detection systems in a dynamic environment provide more false positives. The purpose of this research paper is to propose an efficient methodology to sense the attacks for creating low levels of false positives. Design/methodology/approach: In this research, the authors have developed an efficient approach for malicious crawler detection and correlated the security alerts. The behavioral features of the crawlers are examined for the recognition of the malicious crawlers, and a novel methodology is proposed to improvise the bank user portal security. The authors have compared various machine learning strategies including Bayesian network, support sector machine (SVM) and decision tree. Findings: This proposed work stretches in various aspects. Initially, the outcomes are stated for the mixture of different kinds of log files. Then, distinct sites of various log files are selected for the construction of the acceptable data sets. Session identification, attribute extraction, session labeling and classification were held. Moreover, this approach clustered the meta-alerts into higher level meta-alerts for fusing multistages of attacks and the various types of attacks. Originality/value: This methodology used incremental clustering techniques and analyzed the probability of existing topologies in SVM classifiers for more deterministic classification. It also enhanced the taxonomy for various domains.