Cross-domain intrusion detection, a critical component of cybersecurity, involves evaluating the performance of neural networks across diverse datasets or databases. The ability of intrusion detection systems to effectively adapt to new threats and data sources is paramount for safeguarding networks and sensitive information. This research delves into the intricate world of cross-domain intrusion detection, where neural networks must demonstrate their versatility and adaptability. The results of our experiments expose a significant challenge: the phenomenon known as catastrophic forgetting. This is the tendency of neural networks to forget previously acquired knowledge when exposed to new information. In the context of intrusion detection, it means that as models are sequentially trained on different intrusion detection datasets, their performance on earlier datasets degrades drastically. This degradation poses a substantial threat to the reliability of intrusion detection systems. In response to this challenge, this research investigates potential solutions to mitigate the effects of catastrophic forgetting. We propose the application of continual learning techniques as a means to address this problem. Specifically, we explore the Elastic Weight Consolidation (EWC) algorithm as an example of preserving previously learned knowledge while allowing the model to adapt to new intrusion detection tasks. By examining the performance of neural networks on various intrusion detection datasets, we aim to shed light on the practical implications of catastrophic forgetting and the potential benefits of adopting EWC as a memory-preserving technique. This research underscores the importance of addressing catastrophic forgetting in cross-domain intrusion detection systems. It provides a stepping stone for future endeavours in enhancing multi-task learning and adaptability within the critical domain of intrusion detection, ultimately contributing to the ongoing efforts to fortify cybersecurity defences.

Intrusive thoughts are aversive, private thoughts that are unwanted but intrude into consciousness, and are a ubiquitous phenomenon that approximately 93% of the population experiences (Radomsky et. al., 2014). Obsessional thoughts are a key etiological component of obsessive-compulsive disorder (OCD). Cognitive behavioral models of OCD conceptualize intrusive thoughts and obsessive thoughts as the same phenomenon occurring on a spectrum, with obsessional thoughts being a particular type of intrusion that is integral to the development and maintenance of OCD (Moulding, 2014). However, there is little evidence to demonstrate this relationship. This study examined intrusive thoughts across stratified groups based on intrusion frequency using ecological momentary assessment. This exploratory study examined potential idiographic differences in reported experiences of people ranging from low to high levels of intrusive thought frequency. Personalized contemporaneous networks were constructed from participant data and examined for differences in topography, measures of centrality, and magnitude of relationships between nodes. These networks are visually distinct, providing a glimpse into a wide variety of ways in which participants experience and relate to their intrusive thoughts.

This dissertation describes a family of models of program behavior, the Hybrid Push Down Automata (HPDA) that can be acquired using a combination of static analysis and dynamic learning in order to take advantage of the strengths of both. Static analysis is used to acquire a base model of all behavior defined in the binary source code. Dynamic learning from audit data is used to supplement the base model to provide a model that exactly follows the definition in the executable but that includes legal behavior determined at runtime. Our model is similar to the VPStatic model proposed by Feng, Giffin, et al., but with different assumptions and organization. Return address information extracted from the program call stack and system call information are used to build the model. Dynamic learning alone or a combination of static analysis and dynamic learning can be used to acquire the model. We have shown that a new dynamic learning algorithm based on the assumption of a single entry point and exit point for each function can yield models of increased generality and can help reduce the false positive rate. Previous approaches based on static analysis typically work only with statically linked programs. We have developed a new component-based model and learning algorithm that builds separate models for dynamic libraries used in a program allowing the models to be shared by different program models. Sharing of models reduces memory usage when several programs are monitored, promotes reuse of library models, and simplifies model maintenance when the system updates dynamic libraries. Experiments demonstrate that the prototype detection system built with the HPDA approach has a performance overhead of less than 6% and can be used with complex real-world applications. When compared to other detection systems based on analysis of operating system calls, the HPDA approach is shown to converge faster during learning, to detect attacks that escape other detection systems, and to have a lower false positive rate.

No description available.

No description available.

No description available.

No description available.

No description available.

No description available.

An intrusion detection system (IDS) is a software application that monitors a network forunauthorized and malicious activities or security policy violations related to confidentiality,integrity, and availability of a system. In this thesis, we performed detailed literature reviewson the different types of IDS, anomaly detection methods, and machine learning algorithmsthat can be used for detection and classification. We propose a hybrid intrusion detectionsoftware architecture for IDS using machine learning algorithms. By placing appropriatemachine learning algorithms in the existing detection systems, improvements in attack detectionand classification can be obtained. We have also attempted to compare the machine learningalgorithms by testing them in a simulated environment to make performance evaluations. Ourapproach provides indicators in selecting machine learning algorithms that can be used for ageneric intrusion detection system in the context of industrial control applications. / InSecTT - Intelligent Secure Trustable Things