Advanced Visualization of Intrusions in Flows by Means of Beta-Hebbian Learning

Ad anced isualiza ion o in usions in lows by means o Be a-Hebbian Lea ning HÉCTOR QUINTIÁN, Depa men o Indus ial Enginee ing, Uni e si y o A Co uña, CTC, CITIC A da. 19 de eb e o s/n, 15405, Fe ol, A Co uña, Spain. ESTEBAN JOVE∗, Depa men o Indus ial Enginee ing, Uni e si y o A Co uña, CTC, CITIC A da. 19 de eb e o s/n, 15405, Fe ol, A Co uña, Spain. JOSÉ-LUIS CASTELEIRO-ROCA, Depa men o Indus ial Enginee ing, Uni e si y o A Co uña, CTC, CITIC A da. 19 de eb e o s/n, 15405, Fe ol, A Co uña, Spain. DANIEL URDA,G upo de In eligencia Compu acional Aplicada (GICAP), Depa amen o de Ingenie ía In o má ica, Escuela Poli écnica Supe io , Uni e sidad de Bu gos, A . Can ab ia s/n, 09006, Bu gos, Spain. ÁNGEL ARROYO,G upo de In eligencia Compu acional Aplicada (GICAP), Depa amen o de Ingenie ía In o má ica, Escuela Poli écnica Supe io , Uni e sidad de Bu gos, A . Can ab ia s/n, 09006, Bu gos, Spain. JOSÉ LUIS CALVO-ROLLE, Depa men o Indus ial Enginee ing, Uni e si y o A Co uña, CTC, CITIC A da. 19 de eb e o s/n, 15405, Fe ol, A Co uña, Spain. ÁLVARO HERRERO,G upo de In eligencia Compu acional Aplicada (GICAP), Depa amen o de Ingenie ía In o má ica, Escuela Poli écnica Supe io , Uni e sidad de Bu gos, A . Can ab ia s/n, 09006, Bu gos, Spain. EMILIO CORCHADO,Edi icio Depa amen al, Uni e si y o Salamanca, Campus Unamuno, 37007 Salamanca, Spain. Abs ac De ec ing in usions in la ge ne wo ks is a highly demanding ask. In o de o educe he compu a ion demand o analysing e e y single packe a elling along one o such ne wo ks, some yea s ago lows we e p oposed as a way o summa izing a ic in o ma ion. Ve y ew esea ch wo ks ha e add essed in usion de ec ion in lows om a isualiza ions pe spec i e. In o de o b idge his gap, he p esen pape p oposes he applica ion o a no el p ojec ion me hod (Be a Hebbian Lea ning) unde his amewo k. Wi h he aim o alida e his me hod, 8 a ic segmen s, con aining many lows, ha e been analysed by ∗E-mail: es eban.jo[email p o ec ed] Vol. 30, No. 6, © The Au ho (s) 2022. Published by Ox o d Uni e si y P ess. This is an Open Access a icle dis ibu ed unde he e ms o he C ea i e Commons A ibu ion License (h p:// c ea i ecommons.o g/licenses/by/4.0/), which pe mi s un es ic ed euse, dis ibu ion, and ep oduc ion in any medium, p o ided he o iginal wo k is p ope ly ci ed. Ad ance Access published 16 Feb ua y 2022 h ps://doi.o g/10.1093/jigpal/jzac013 Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 Ad anced Visualiza ion o In usions in Flows 1057 means o his p ojec ion me hod. The p omising esul s ob ained o hese segmen s, ex ac ed om he Uni e si y o Twen e da ase , alida e he p oposed applica ion. Keywo ds:In usion de ec ion, a ic low, explo a o y p ojec ion pu sui , isualiza ion, a i icial neu al ne wo ks, unsupe ised lea ning 1 In oduc ion In a digi ized wo ld, he secu i y o in o ma ion and sys ems is a majo conce n. Wi hin his ield, in usion de ec ion (ID) can be de ined as he iden i ica ion o in usi e ac ions when o a e hey a e pe o med. The con inuous e olu ion o bo h echnologies and s a egies o comp omising in o ma ion sys ems is one o he main obs acles o ID [11]. To add ess his challenge, ID Sys ems (IDSs) we e p oposed some decades ago, being acknowledged a p esen ime as one o he essen ial cybe secu i y ools. The main a ge is iden i ying a emp ed o ongoing a acks, based on he anomalous de ec ion idea. To p ocess he high olume o da a ga he ed om he a ic a elling along la ge ne wo ks, se e al al e na i es exis . The wo main ones a e he analysis o he da a a packe -le el and educing he da a o a ic lows [21]. The la e one is he app oach ollowed in he p esen s udy due o he educed compu a ional demands when compa ed wi h he o me . A wide a ie y o me hods ha e been esea ched so a o be applied o ID. Among hese me hods, many o hem come om he a i icial in elligence (AI) ield, while hose based on supe ised lea ning [9] a e he mos popula ones. ID, as well as o he cybe secu i y sub ields such as he de ec ion o malwa e [27] and web a acks [3], ha e also been add essed om he isualiza ion pe spec i e based on unsupe ised lea ning. Di e en ia ing om he supe ised app oach, he isualiza ion one does no y o decide whe he a new da a ins ance (a a ic low in he p esen s udy) is ‘no mal’ o ‘anomalous’ (i.e. classi ying i ). The isualiza ion p oposal ies o depic all he da a in such and in ui i e way ha he anomalous da a can be iden i ied wi h he naked eye. This is based on he human inna e abili y o isually iden i ying anomalous pa e ns. Among all he me hods in he unsupe ised-lea ning amily, explo a o y p ojec ion pu sui (EPP) is ocused in he p esen pape as i ies o sol e he ‘cu se o dimensionali y’ p oblem by e ealing he hidden s uc u e o a da ase . In o de o do i , his me hod p ojec s he da a unde analysis on o a low dimensional subspace whe e he s uc u es can be iden i ied isually. Mo e p ecisely, he p esen wo k p oposes Be a Hebbian Lea ning (BHL), a no el neu al p ojec ion me hod, o isualize a ic lows in o de o de ec he anomalous ones. BHL is compa ed and alida ed in his pape when applied o low-based da a; he analysed segmen s con ain lows ha ha e some in usi e ins ances. These segmen s we e ob ained om eal-li e a acks and a e publicly a ailable in he open da ase om he Uni e si y o Twen e [24]. The aw da a we e ga he ed om a honeypo di ec ly connec ed o he In e ne , gi ing o g an ed ha such asse was he a ge o many a acke s. 1.1 P e ious wo k In he ield o cybe secu i y, se e al au ho s ha e p e iously s udied he in e play be ween isualiza ion me hods and anomaly de ec ion. Malwa e de ec ion can be conside ed as one o he ields whe e he isualiza ion app oach has been widely explo ed [2]. This is he case o [23], which desc ibes a amewo k o moni o and isualize anomalous unc ion calls by And oid applica ions. The applied isualiza ion me hod is a g aph on a ee-like s uc u e named dend og ams, using con en ional da abase ables. In [18] G oDDViewe is p oposed as a ool ha o e s wo iews o he execu ion o an And oid malwa e. The i s o hem ep esen s he execu ion a ope a ing sys em Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 1058 Ad anced Visualiza ion o In usions in Flows le el (all he in o ma ion low be ween iles, p ocesses and socke s is conside ed). Wha happened in he code o he applica ion, du ing i s execu ion, is isualized in he second one. In [1] he au ho s p opose a isualiza ion-based app oach o ackle he p oblem o in es iga ing la ge and complex aw da a se s om he In e ne o Medical Things. G aph o ien ed da a a e depic ed on a ime wise line cha . In addi ion o his ela ed wo k on isualiza ion o Malwa e, ecen ly iNe [12] has been p oposed as a combina ion o a a e ca ego y de ec ion me hod and isualiza ion echniques. I s main a ge is o iden i y and analyse anomalies in mul i a ia e dynamic ne wo ks. I in eg a es wo majo isualiza ion componen s, including a glyph-based a e ca ego y iden i ie . Some o he esea che s ha e also in es iga ed he applica ion o unsupe ised lea ning o isualize ne wo k da a using sca e plo s [5,7,10,14,17]. Di e en ia ing om all hese p e ious pape s, he no el me hod BHL is applied o he i s ime in he p esen s udy. This me hod has been applied o da a ID o di e en ypes o cybe -a acks [25–27], ob aining much be e esul s han o he well-known algo i hms. Fu he mo e, in [20] i was applied o he i s ime o ID in a ic lows. Ex ending his seminal wo k, he p esen pape alida es BHL when isualizing a acks in a la ge and mo e complex ange o a ic segmen s. BHL has also been employed o analyse he in e nal s uc u e o a se ies o da ase s [15,16], p o iding a clea p ojec ion o he o iginal da a. Going one s ep u he , his esea ch p oposes he applica ion o BHL o he da ase s ha ha e been p e iously analysed by MOVICAB-IDS [13], o imp o e he ob ained p ojec ions and p o ide a be e isual ep esen a ion o he in e nal s uc u e o he da ase , in o de o easily de ec in usions and o he ypes o cybe -a acks. This acili a es he ea ly iden i ica ion o anomalous si ua ions, which may be indica i e o a cybe -a ack in he compu e ne wo k. The es o his pape is o ganized as ollows: sec ion 3in oduces he applied neu al echniques while he analysed da ase is desc ibed in sec ion 4. Expe imen s and he ob ained esul s a e discussed in sec ion 5while he main conclusions o his s udy a e p esen ed in sec ion 6, oge he wi h some p oposals o u he esea ch. 2Unsupe ised-lea ning models o in usion isualiza ion The neu al EPP me hods applied in he p esen wo k a e desc ibed in he ollowing subsec ion. 2.1 Coope a i e maximum likelihood Hebbian lea ning Coope a i e maximum likelihood Hebbian lea ning (CMLHL) is a amily o ules based on expo- nen ial, which ex ends he likelihood Hebbian lea ning (MLHL) [16] by adding la e al connec ions o MLHL ne wo k, imp o ing he esul s ob ained by i . CMLHL can be exp essed as: Feed − o wa d :yi= N  j=1 Wijxj,∀i(1) La e alac i a ionpassing :yi( +1)=[yi( )−τ(b−Ay)2](2) Feedback :ej=xj− M  i=1 Wijyi(3) Weigh upda e :Wij =η·yisign(ej)|ej|p(4) Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 Ad anced Visualiza ion o In usions in Flows 1059 whe e xand ya e inpu (N-dimensional) and ou pu (M-dimensional) ec o s, wi h Wij weigh connec ions be ween bo h. And η he lea ning a e, τ he ‘s eng h’ o he la e al connec ions, b he bias pa ame e , and pa pa ame e ela ed o he ene gy unc ion. Finally, Ais a symme ic ma ix used o modi y he esponse o he da a whose e ec is based on he ela ion be ween he dis ances among he ou pu neu ons [6]. 2.2 Be a Hebbian lea ning A i icial neu al ne wo ks (ANNs) a e ypically so wa e simula ions ha emula e some o he ea u es o eal neu al ne wo ks ound in he animal b ain. Among he ange o applica ions o unsupe ised a i icial neu al ne wo ks, da a p ojec ion o isualiza ion is he one ha acili a es, human expe s, he analysis o he in e nal s uc u e o a da ase . This can be achie ed by p ojec ing da a on a mo e in o ma i e axis o by gene a ing maps ha ep esen he inne s uc u e o da ase s. This kind o da a isualiza ion can usually be achie ed wi h echniques such as EPP [4,19], which p ojec he da a on o a low dimensional subspace, enabling he expe o sea ch o s uc u es h ough isual inspec ion. The Be a Hebbian Lea ning echnique [31] is an ANN belonging o he amily o unsupe ised EPP, which uses Be a dis ibu ion as pa o he weigh upda e p ocess, o he ex ac ion o in o ma ion om high dimensional da ase s by p ojec ing he da a on o low dimensional ( ypically 2 dimensional) subspaces. This echnique is be e han o he explo a o y me hods in ha i p o ides a clea ep esen a ion o he in e nal s uc u e o da a. BHL uses Be a dis ibu ion o upda e i s lea ning ule o ma ch he p obabili y densi y unc ion (PDF) o he esidual (e) wi h he da ase dis ibu ion, whe e he esidual is he di e ence be ween inpu and ou pu eedback h ough he weigh s (8). Thus, he op imal cos unc ion can be ob ained i he PDF o he esiduals is known. The e o e, he esidual (e) can be exp essed by 5in e ms o Be a dis ibu ion pa ame e s (B(α and β)): p(e)=eα−1(1−e)β−1=(x−Wy)α−1(1−x+Wy)β−1(5) whe e αand βcon ol he PDF shape o he Be a dis ibu ion, eis he esidual, xa e he inpu s o he ne wo k, Wis he weigh ma ix and yis he ou pu o he ne wo k. Finally, g adien descen can be used o maximize he likelihood o he weigh s (Eq. 6): ∂pi ∂Wij =(eα−2 j(1−ej)β−2(−(α −1)(1−ej)+ej(β −1))) = (eα−2 j(1−ej)β−2(1−α+ej(α +β−2))) (6) The e o e, BHL a chi ec u e can be exp essed by means o he ollowing equa ions: Feed − o wa d :yi= N  j=1 Wijxj,∀i(7) Feedback :ej=xj− M  i=1 Wijyi(8) Weigh upda e :Wij =η(eα−2 j(1−ej)β−2(1−α+ej(α +β−2)))yi(9) whe e ηis he lea ning a e Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 1060 Ad anced Visualiza ion o In usions in Flows 3Analysed da ase In he p esen esea ch, he me hods desc ibed in sec ion 2a e applied o he benchma k da ase con aining a ic lows eleased by he Uni e si y o Twen e [24]. This is a publicly a ailable and widely used da ase s o assess IDS based on low-based da a [8]. Mo e han 155 M packe s, a elling along a la ge academic ne wo k, we e collec ed in a 24 GB dump ile. Du ing 6 days, a ic add essed o a honeypo connec ed o he In e ne was ga he ed. The ollowing ypical ne wo k se ices we e unning in he a ge se e : •Apache web se e : jus a basic login page was s o ed in his se e . • p: P oFTPd ha uses he au h/iden se ice was chosen o addi ional au hen ica ion in o ma ion abou incoming connec ions. •ssh: he OpenSSH se ice unning on Debian was pa ched o ack ac i e hacking ac i i ies by logging sessions: o each login, he ansc ip (use yped commands) and he iming o he session was eco ded. Among he unning se ices, hose mo e equen ly add essed by a acke s we e ssh and h p. In o de o ease he analysis, he millions o cap u ed packe s we e summa ized in 14.2 M lows. Based on he cap u ed a ic, he esul ing da ase con ains se e al ypes o lows: ssh-scan, ssh- conn, p-scan, p-conn, h p-scan, h p-conn, au hiden -sidee ec , i c-sidee ec , icmp-sidee ec . Only 6 connec ions o he p se ice a e con ained in he da ase . All o hem con ain da a ela ed o an opening o an p session, ha is immedia ely closed. The majo i y o he a acks a ge ed he ssh se ice and hey can be di ided in o wo ca ego ies: •Manual: hese a e manual connec ion a emp s, amoun ing o 28 in he da ase (among hem 20 succeed). Di e en ia ing om he p e ious ones, i is much mo e di icul o de ec his ype o a acks. •Au oma ed: hese unmanned a acks a e gene a ed by speci ic-pu pose ools and mainly comp ise b u e o ce scans, whe e a p og am enume a es use names and passwo ds om la ge dic iona y iles. As each connec ion come o a new low, i is pa icula ly easy o iden i y such a acks a low le el. All he h p ale s labelled in he da ase a e conside ed as a acks pe o med by hacke s. This is mainly because no h p a acks we e a i icially gene a ed in he da ase . By execu ing a sc ip ed se ies o connec ions, hacke s ied o comp omise he h p se ice. The ollowing low ea u es a e used by he EPP me hods o de ec in usi e ac ions: •s c-ip: anonymized sou ce IP add ess (encoded as 32-bi numbe ). •ds -ip: anonymized des ina ion IP add ess (encoded as 32-bi numbe ). •packe s: numbe o packe s in he low. •oc e s: numbe o by es in he low. •s a - ime: UNIX s a ime (numbe o seconds). •s a -msec: s a ime (milliseconds pa ). •end- ime: UNIX end ime (numbe o seconds). •end-msec: end ime (milliseconds pa ). •s c-po : sou ce po numbe . •ds -po : des ina ion po numbe . • cp- lags: TCP lags ob ained by ORing he TCP lags ield o all packe s o he low. •p o : IP p o ocol numbe . Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 Ad anced Visualiza ion o In usions in Flows 1061 TABLE 1. In o ma ion abou he analysed segmen s. Segmen ID Flows A acks 112,179 ssh-conn, p-conn and i c-sidee ec 30 12,172 ssh-conn, p-conn and i c-sidee ec 58 1,214 ssh-conn, h p-conn and i c-sidee ec 59 1,216 ssh-conn and i c-sidee ec 107 19,061 ssh-conn, au hiden -sidee ec , i c-sidee ec and icmp-sidee ec 131 122,274 ssh-conn, h p-conn, i c-sidee ec and icmp-sidee ec 211 80,944 au hiden -sidee ec , i c-sidee ec and icmp-sidee ec 545 731 ssh-conn and h p-conn TABLE 2. CMLHL and BHL pa ame e s o segmen 545. Algo i hm Pa ame e s CMLHL i e s=5000, l a e=0.01, p=1.2 BHL i e s=5000, l a e=0.001, α=4, β=3 Addi ionally, he ale - ype ea u e (also con ained in he da ase ) is used o depic ing he da a and alida ing he esul s. The analysed da ase is pa i ioned, acco ding o he segmen a ion s a egy ini ially p oposed unde he ame o MOVICAB-IDS[13]. As a esul , all he lows whose imes amp is be ween he segmen ini ial and inal ime limi a e con ained in such segmen . As he o al leng h o he da ase is 539,520 seconds, he segmen leng h has been de ined as 782 seconds. The e is an o e lap be ween consecu i e segmen s, ha is de ined as 10 seconds. As a esul , 709 segmen s we e gene a ed om he o iginal da ase . Fo b e i y, esul s on only ew o he gene a ed segmen s can be included in he p esen pape . Thus, some o he segmen s mus be selec ed. The main c i e ia o ha is p io i izing hose wi h he minimum numbe o lows p esen wi h a speci ic numbe o a ack ypes. Addi ionally, hese segmen s ha e been selec ed in o de o compa e he ob ained esul s wi h hose o p e ious wo k [22]. Basic in o ma ion abou he s udied segmen s s udied is shown in 1. 4Expe imen s and esul s As p e iously s a ed, BHL is applied o he segmen s desc ibed in he p e ious sec ion. The bes p ojec ions ob ained om such segmen s a e p esen ed in his sec ion. Addi ionally, hey a e compa ed wi h p e ious esul s ob ained by CMLHL, as i was he me hod ha p o ided bes isualiza ions, acco ding o p e ious esea ch s udies. The da e a e p ojec ed by means o he co esponding EPP me hod in a sca e plo . Addi ionally, a ack label in o ma ion is added o he p ojec ions, mainly by he glyph me apho (di e en colou s and symbols). In all cases o he BHL expe imen s a no maliza ion o each a iable be ween he ange -1 o 1 has been applied o gua an ee he s abili y o he BHL ne wo k du ing he aining p ocess [19]. Finally bes p ojec ions a e p esen ed and each ype o a ack is p esen ed in di e en colou . Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 1062 Ad anced Visualiza ion o In usions in Flows FIGURE 1. CMLHL p ojec ion o segmen 545. -2 -1.5 -1 -0.5 0 0.5 1 1.5 2 -2 -1.5 -1 -0.5 0 0.5 1 1.5 FIGURE 2. BHL p ojec ion o segmen 545. 4.1 Visualiza ions o segmen 545 This da ase con ains 2 kinds o a acks, ssh_conn and h p_conn a acks. Da ase consis s o 731 samples and 9 a iables. Table 2shows he bes combina ion o pa ame e s o he ob ained p ojec ions by BHL and CMLHL when analysing segmen 545. Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 Ad anced Visualiza ion o In usions in Flows 1063 TABLE 3. CMLHL and BHL pa ame e s o segmen 30. Algo i hm Pa ame e s CMLHL i e s=100000, l a e=0.01, p=1.1 BHL i e s=100000, l a e=0.001, α=3, β=4 FIGURE 3. CMLHL p ojec ion o segmen 30. Figu e 1shows he CMLHL p ojec ion. In such isualiza ion, bo h ypes o a acks (Ca ego y 2 and 6) a e clea ly di e en ia ed and sepa a ed in he sca e plo . Resul s ob ained by BHL on his same da ase segmen a e shown in Figu e 2. This isualiza ion also shows a clea sepa a ion be ween he 2 ypes o a acks; howe e , i is no possible o p o ide be e esul s han CMLHL as hey a e good enough and no classes a e mixed. The only ema kable di e ence wi h espec o he p e ious CMLHL p ojec ion is ha BHL sepa a es he i s ype o a ack (g een do s in Figu e 2), based on he di e en sou ce IP o each ype o a ack. 4.2 Visualiza ions o segmen 30 3 di e en a acks a e p esen in his da ase segmen , ssh_conn (ca ego y 2), p_conn (ca ego y 4) and i c_sidee ec (ca ego y 8), which ep esen s a o al o 121,72 sample and 9 a iables. Table 3shows he bes combina ion o pa ame e s o he ob ained p ojec ions in case o BHL and CMLHL o his segmen . In his case, he CMLHL p ojec ions p esen ca ego ies 2, 4 and 8 ha a e mixed as can be seen in he cen al pa o he Figu e (3(blue-ci cle, as e isk and blue-g een squa es espec i ely)). The e o e, i is di icul o di e en ia e he ype o a ack in his p ojec ion. Howe e , BHL p ojec ions shows a clea sepa a ion be ween all samples o he di e en ype o a acks, ep esen ed in Figu e 4as g een do s (ca ego y 2), ed do s (ca ego y 4) and blue do s Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 1064 Ad anced Visualiza ion o In usions in Flows -1.5 -1 -0.5 0 0.5 1 1.5 -1.5 -1 -0.5 0 0.5 1 1.5 2 FIGURE 4. BHL p ojec ion o segmen 30. TABLE 4. CMLHL and BHL pa ame e s o segmen 107. Algo i hm Pa ame e s CMLHL i e s=100000, l a e=0.01, p=1.16 BHL i e s=100000, l a e=0.001, α=5, β=3 (ca ego y 8). Again, as happened in p e ious da ase ca ego y 2 (g een do s) is di ided in 2 pa s co esponding o 2 di e en sou ce IP. 4.3 Visualiza ions o segmen 107 Da ase segmen 107 has a o al o 19,061 samples and 9 a iables, which co espond o 4 ypes o a acks (ssh_conn, au hiden _sidee ec , i c_sidee ec and icmp_sidee ec ) labeled as ca ego ies 2, 7, 8 and 9 espec i ely. Table 4shows he bes combina ion o pa ame e s o he ob ained p ojec ions in case o BHL and CMLHL. Bes CMLHL p ojec ions a e p esen ed in Figu e 5, whe e samples o ca ego ies 2 and 8 a e mixed. In spi e o samples o o he ca ego ies a e no mixed, sepa a ion be ween clus e s is qui e small, so i is di icul o clea ly di e en ia e he bounda ies be ween clus e s. The bes BHL p ojec ion is p esen ed in Figu e 6, he e i can be seen ha he e is no mixed samples o di e en clus e s, and sepa a ion be ween clus e s is g ea e han in case o CMLHL, specially be ween samples o ca ego y 2 (g een do s) and ca ego y 8 (blue do s). Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 Ad anced Visualiza ion o In usions in Flows 1071 2 0 -1.5 -2 -1 -0.5 0 0.5 1 1.5 -2.5 -2 -1.5 -1 -0.5 0 FIGURE 14. BHL 3D p ojec ion o segmen 211. 0.4 0.6 0.8 1 1.2 1.4 1.6 1.8 -0.8 -0.6 -0.4 -0.2 0 0.2 0.4 0.6 FIGURE 15. BHL 2D p ojec ion o segmen 211, wi h [0,1] no maliza ion. p ojec ions a e mo e in o ma i e han hose ob ained by o he EPP me hods in mos cases. Fo he es o segmen s, hey a e a leas as good as hose ob ained by al e na i e me hods. The esul s o he conduc ed expe imen ha e p o en ha BHL’s pe o mance is supe io o ha o he echniques used in p e ious esea ches, p o ing comp ehensible p ojec ions, whe e a acks a e clea ly dis inguished om he no mal beha iou o he ne wo k, e en when di e en ypes o a acks occu a he same ime. Thanks o his ad anced AI isualiza ion, secu i y s a could easily moni o la ge ne wo ks and iden i y anomalous si ua ions a a glance. Fu he mo e, his supe ision could be pe o med wi hou Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 1072 Ad anced Visualiza ion o In usions in Flows ex ensi e aining on he applied echniques and wi hou equi ing a wide knowledge abou he isualiza ion esou ces. In o de o ex end he p esen esea ch, he au ho s p opose he combina ion o he BHL p ojec ions wi h some o he unsupe ised isualiza ion me hods such as clus e ing. Fu he mo e, he applied me hod could be also alida ed in o he cybe secu i y p oblems, including he de ec ion o malwa e and some o he a acks (such as SQL injec ion). Funding Funding o open access cha ge: Uni e sidade da Co uña/CISUG. Re e ences [1] I. Ahmad, M. A. Shah, H. A. Kha ak, Z. Amee , M. Khan and K. Han. Fi iz: o ensics in es iga ion h ough isualiza ion o malwa e in in e ne o hings. Sus ainabili y,12, 2020. [2] E. F. E. Ahme , S. Saleh Hussin and H. A. Hussin.. Malwa e isualiza ion echniques. In e na ional Jou nal o Applied Ma hema ics Elec onics and Compu e s,8, 7–20, 2020. [3] D. A ienza, Á. He e o and E. Co chado. Neu al analysis o h p a ic o web a ack de ec ion. In In e na ional Join Con e ence, , , , and Á. He e o, B. Ba uque, J. Sedano, H. Quin ián and E. Co chado., eds, pp. 201–212. Sp inge In e na ional Publishing, Cham, 2015. [4] A. Be o, S. L. Ma ie-Sain e and A. Ruiz-Gazen. Gene ic algo i hms and pa icle swa m op i- miza ion o explo a o y p ojec ion pu sui . Annals o Ma hema ics and A i icial In elligence, 60, 153–178, 10 2010. [5] V. Bula as. In es iga ion o ne wo k in usion de ec ion using da a isualiza ion me hods. In 2018 59 h In e na ional Scien i ic Con e ence on In o ma ion Technology and Managemen Science o Riga Technical Uni e si y (ITMS), pp. 1–6, 2018. [6] E. Co chado and C. Fy e. Connec ionis echniques o he iden i ica ion and supp ession o in e e ing unde lying ac o s. IJPRAI,17, 1447–1466, 2003. [7] E. Co chado and Á. He e o. Neu al isualiza ion o ne wo k a ic da a o in usion de ec ion. Applied So Compu ing,11, 2042–2056, 2011. [8] M. A. Fe ag, L. Magla as, S. Moschoyiannis and H. Janicke. Deep lea ning o cybe secu i y in usion de ec ion: app oaches, da ase s, and compa a i e s udy. Jou nal o In o ma ion Secu i y and Applica ions,50, 102419, 2020. [9] E. Gando a and D. Gup a. Imp o ing spoo ed websi e de ec ion using machine lea ning. Cybe ne ics and Sys ems,52, 169–190, 2021. [10] A. González, Á. He e o and E. Co chado. Neu al isualiza ion o and oid malwa e amilies. In P oceedings o he In e na ional Join Con e ence SOCO’16-CISIS’16-ICEUTE’16, pp. 574– 583, 2016. [11] S. Hajj, R. El Sibai, J. B. Abdo, J. Deme jian, A. Makhoul and C. Guyeux. Anomaly- based in usion de ec ion sys ems: he equi emen s, me hods, measu emen s, and da ase s. T ansac ions on Eme ging Telecommunica ions Technologies,32, e4240, 2021. [12] D. Han, J. Pan, R. Pan, D. Zhou, N. Cao, J. He, X. Mingliang and W. Chen. ine : isual analysis o i egula ansi ion in mul i a ia e dynamic ne wo ks. F on ie s o Compu e Science,16, 1–16, 2022. [13] Á. He e o, E. Co chado and J. M. Sáiz. Mo icab-ids: isual analysis o ne wo k a ic da a s eams o in usion de ec ion. In In elligen Da a Enginee ing and Au oma ed Lea ning— Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022 Ad anced Visualiza ion o In usions in Flows 1073 IDEAL 2006, E. Co chado, H. Yin, V. Bo i and C. Fy e., eds, pp. 1424–1433. Sp inge Be lin Heidelbe g, Be lin, Heidelbe g, 2006. [14] Á. He e o, U. Zu u uza and E. Co chado. A neu al- isualiza ion IDS o honeyne da a. In e na ional Jou nal o Neu al Sys ems,22, 2012. [15] E. Jo e, J. L. Cas elei o-Roca, H. Quin ián, J. A. M. Pé ez and J. L. Cal o-Rolle. A new app oach o sys em mal unc ioning o e an indus ial sys em con ol loop based on unsupe ised echniques. In In e na ional Join Con e ence SOCO’18-CISIS’18-ICEUTE’18— San Sebas ián, pp. 415–425. P oceedings, Spain, June 6–8, 2018, 2018. [16] E. Jo e, J. L. Cas elei o-Roca, H. Quin ián, J. A. M. Pé ez and J. L. Cal o-Rolle. A aul de ec ion sys em based on unsupe ised echniques o indus ial con ol loops. Expe Sys ems, 36, 2019. [17] A. Ka ami. An anomaly-based in usion de ec ion sys em in p esence o benign ou lie s wi h isualiza ion capabili ies. Expe Sys ems wi h Applica ions,108, 36–60, 2018. [18] J.-F. Lalande, M. Simon and V. V. T. Tong. G odd iewe : dynamic dual iew o and oid malwa e. In G aphical Models o Secu i y, I. I. I. Ha ley Eades and O. Gadya skaya., eds, pp. 127–139. Sp inge In e na ional Publishing, Cham, 2020. [19] H. Quin ián and E. Co chado. Be a hebbian lea ning as a new me hod o explo a o y p ojec ion pu sui . In e na ional Jou nal o Neu al Sys ems,27, 1–16, 2017. [20] H. Quin ián, E. Jo e, J.-L. Cas elei o-Roca, D. U da, Á. A oyo, J. L. Cal o-Rolle, Á. He e o and E. Co chado. Be a-hebbian lea ning o isualizing in usions in lows. In 13 h In e na ional Con e ence on Compu a ional In elligence in Secu i y o In o ma ion Sys ems (CISIS 2020), Á. He e o, C. Camb a, D. U da, J. Sedano, H. Quin ián and E. Co chado., eds, pp. 446–459. Sp inge In e na ional Publishing, Cham, 2021. [21] Á. H. R. Sánchez and E. Co chado. Visualiza ion and clus e ing o snmp in usion de ec ion. Cybe ne ics and Sys ems,44, 505–532, 2013. [22] R. Sánchez, Á. He e o and E. Co chado. Clus e ing ex ension o MOVICAB-IDS o dis in- guish in usions in low-based da a. Logic Jou nal o he IGPL,25, 83–102, 2016. [23] O. Soma iba, U. Zu u uza, R. U ibee xebe ia, L. Delosie es and S. Nadjm-Teh ani. De ec ion and isualiza ion o and oid malwa e beha io . Jou nal o Elec ical and Compu e Enginee - ing,2016, 2016. [24] A. Spe o o, R. Sad e, F. Van Vlie and A. P as. A labeled da a se o low-based in usion de ec ion. In In e na ional Wo kshop on IP Ope a ions and Managemen , pp. 39–50. Sp inge , 2009. [25] R. V. Vega, P. Chamoso, A. G. B iones, J.-L. Cas elei o-Roca, E. Jo e, M. Meizoso-López, B. Rod íguez-Gómez, H. Quin ián, Á. He e o, K. Ma sui, E. Co chado and J. Cal o-Rolle. In usion de ec ion wi h unsupe ised echniques o ne wo k managemen p o ocols o e sma g ids. Applied Sciences,10, 2276, 2020. [26] R. V. Vega, H. Quin ián, C. Camb a, N. Basu o, Á. He e o and J. L. Cal o-Rolle. Del ing in o and oid malwa e amilies wi h a no el neu al p ojec ion me hod. Complexi y,2019, 6101697:1–6101697:10, 2019. [27] R. V. Vega, H. Quin ián, J. L. Cal o-Rolle, Á. He e o and E. Co chado. Gaining deep knowledge o And oid malwa e amilies h ough dimensionali y educ ion echniques. Logic Jou nal o he IGPL,27, 160–176, 09 2018. Recei ed 20 Feb ua y 2021 Downloaded om h ps://academic.oup.com/jigpal/a icle/30/6/1056/6528589 by Uni e sidad de Bu gos use on 01 Decembe 2022