Redefinition of Inter-Message Arrival Time for Robust Controller Area Network Intrusion Detection

Behavioral Residualization for Unsupervised Intrusion Detection in Automotive CAN Networks

Per-ID behavioral residualization is presented, a CAN-specific representation that extracts fourteen temporal, protocol, and payload features from sliding windows and residualizes them against each arbitration ID's normal baseline, which improves mean F1 in the majority of evaluations.

Real-Time DDoS Detection by Integrated eBPF Telemetry and Machine Learning-enhanced SIEM

Distributed Denial-of-Service (DDoS) attacks remain one of the most disruptive threats to modern web services, overwhelming application resources and degrading service availability. This paper presents a lightweight, virtualized system architecture for real-time DDoS detection that combines kernellevel telemetry collection with machine learning (ML) based analysis. The proposed architecture enables fine-grained, lowoverhead log collection without modifying the web applications because the network and application-level events generated during normal and attack traffic are captured directly at the kernel layer by means of an extended Berkeley Packet Filter (eBPF). The collected logs are then processed within a Security Information and Event Management (SIEM) platform, where ML–based detection models analyze traffic patterns and behavioral features to identify DDoS attacks in near real-time. This architecture improves visibility into attack characteristics while maintaining minimal performance impact on the protected services. The proposed system demonstrates how eBPF-based observability, when integrated with SIEM and ML techniques, can provide an effective, scalable, and modular approach for DDoS detection in virtualized environments. The design is particularly suited for cloud and multi-VM deployments, offering enhanced security monitoring, faster attack detection, and improved operational resilience.

Automatic Cyberattack Detection and Eradication System using Intelligent Network Traffic Analysis

The fast-growing interconnectivity of networks and digital communication platforms, along with extensive information exchange, has made cybersecurity issues in modern computing environments more severe. The expansion of networking infrastructures always results in a massive flow of traffic, thus rendering traditional monitoring techniques and security tools ineffective. Modern cybersecurity systems often have problems detecting the changing nature of cyber threats since some of these have behaviors different from those associated with cyber attack signatures. This not only limits their effectiveness but also causes high rates of false alerts and late responses to complex threats like phishing, ransomware communications, distributed denial of service attacks, key logging activities, bot attacks, and packet sniffing. These all highlight the need for smart cybersecurity solutions that can analyze network activities effectively and detect any kind of threats. The designed model comprises two major layers, which are referred to as the data collection layer and the analysis layer. Network traffic details and system logs are collected using simulated or live data from either simulated or live environment and transformed into structured datasets to undergo the subsequent process steps. Preprocessing involves the removal of unnecessary data instances, cleansing of noise, and feature extraction to enable successful attack detection. This framework uses a combination of signature-based detection and anomaly detection methods to detect attacks through analysis of patterns that are consistent with an attack and patterns that are abnormal in terms of network behavior. This allows better detection of both current and new types of attacks. If a suspicious activity is observed in the network, then the design generates security alerts, stores the incident logs, and automatically responds by blocking the suspicious IP address.

Schedule-Based Attack Against TSN TAS with Frame Preemption

Observability-Driven, Sniffer-Free Intrusion Detection for RPL: Closing the Detection Ceiling With On-Mote Control-Plane Features

Intrusion detection in resource-constrained IoT networks typically relies on dedicated sniffer nodes, an architecture that does not transfer to heterogeneous deployments where adding monitoring hardware is operationally impractical. This paper presents a sniffer-free detection pipeline that operates exclusively on the integer counters each mote already maintains for normal operation of RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks). Behavioral features are derived from these counters through configurable layers spanning statistical transforms, time-series characteristics, and dynamical complexity measures. The central mechanism is an observability-driven loop in which feature attribution is used not only to explain the trained model but to diagnose which behavioral signals the counter set fails to expose. The identified gaps motivate a firmware extension that exposes them. The pipeline is evaluated across $1{\,}200$ simulation runs spanning eight topology scales (25 to 400 nodes) under cross-topology evaluation, and on two public datasets. A diagnostic stage with standard counters reveals detection ceilings traced to specific control-plane signals absent from the default firmware. Retraining with the extended counter set raises every attack above 89% F1, with a unified detector reaching 94.2%, which confirms that the ceiling was an observability limit rather than a limit of classifier capacity. The machine-learning components are established tools, and the contribution is their coupling into this diagnostic loop together with the on-mote architecture that makes it deployable. The results indicate that detection in constrained IoT networks is bounded by what the mote reports, not by classifier sophistication.

MODELING AND EVALUATING THE IMPACT OF INTRUSION DETECTION SYSTEMS ON THE PERFORMANCE OF ISOLATED INFORMATION AND COMMUNICATION SYSTEMS

Topicality. Today’s information and communication systems (ICS) face a growing number of complex cyber threats, making active defense mechanisms absolutely necessary. Yet, running these security tools constantly, especially Intrusion Detection and Prevention Systems (IDS/IPS), takes a toll on network bandwidth and creates heavy computational loads at the routing level. The subject of the study is the direct impact of IDS/IPS on the performance characteristics of an isolated network segment under various load conditions, with an emphasis on resource depletion due to fragmentation at layer 3 of the OSI model. The purpose of this work is to measure the real-world trade-off between security and performance. We aim to assess how much computational power is lost and precisely measure the latency caused by deep packet inspection and interrupt handling. The following results were obtained. We built a complete field-testing environment using isolated virtual machines. We carefully tracked packet processing latency and CPU usage across three states: a baseline with no security, standard traffic with IDS logging enabled, and a simulated high-volume fragmented DDoS attack. The data showed that a basic unprotected router uses very few resources (about 3% CPU, 2.2 ms latency). Turning on security rules bumped the latency to 4.3 ms. More importantly, when hit with a fragmented flood attack, the router’s CPU load spiked to 48%. This spike was mostly caused by the kernel handling software interrupts (ksoftirqd), which eventually caused legitimate packets to drop. Conclusion. Securing a network strongly increases the computational strain on the router. We observed significant performance drops, including CPU exhaustion and denial of service for regular users during volumetric fragmentation attacks. This shows that organizations must constantly refine their firewall policies and look into kernel-bypass technologies to keep their ICS networks running smoothly.