arXiv subjects

Michele Nogueira

Publications and source records attributed to Michele Nogueira.

15 recordsLinked to original sources

arXiv2025

Anomaly-Flow: A Multi-domain Federated Generative Adversarial Network for Distributed Denial-of-Service Detection

Distributed denial-of-service (DDoS) attacks remain a critical threat to Internet services, causing costly disruptions. While machine learning (ML) has shown promise in DDoS detection, current solutions struggle with multi-domain environments where attacks must be detected across heterogeneous networks and organizational boundaries. This limitation severely impacts the practical deployment of ML-based defenses in real-world settings. This paper introduces Anomaly-Flow, a novel framework that addresses this critical gap by combining Federated Learning (FL) with Generative Adversarial Networks (GANs) for privacy-preserving, multi-domain DDoS detection. Our proposal enables collaborative learning across diverse network domains while preserving data privacy through synthetic flow generation. Through extensive evaluation across three distinct network datasets, Anomaly-Flow achieves an average F1-score of $0.747$, outperforming baseline models. Importantly, our framework enables organizations to share attack detection capabilities without exposing sensitive network data, making it particularly valuable for critical infrastructure and privacy-sensitive sectors. Beyond immediate technical contributions, this work provides insights into the challenges and opportunities in multi-domain DDoS detection, establishing a foundation for future research in collaborative network defense systems. Our findings have important implications for academic research and industry practitioners working to deploy practical ML-based security solutions.

cs.CR↗

arXiv2023

Multidomain transformer-based deep learning for early detection of network intrusion

Timely response of Network Intrusion Detection Systems (NIDS) is constrained by the flow generation process which requires accumulation of network packets. This paper introduces Multivariate Time Series (MTS) early detection into NIDS to identify malicious flows prior to their arrival at target systems. With this in mind, we first propose a novel feature extractor, Time Series Network Flow Meter (TS-NFM), that represents network flow as MTS with explainable features, and a new benchmark dataset is created using TS-NFM and the meta-data of CICIDS2017, called SCVIC-TS-2022. Additionally, a new deep learning-based early detection model called Multi-Domain Transformer (MDT) is proposed, which incorporates the frequency domain into Transformer. This work further proposes a Multi-Domain Multi-Head Attention (MD-MHA) mechanism to improve the ability of MDT to extract better features. Based on the experimental results, the proposed methodology improves the earliness of the conventional NIDS (i.e., percentage of packets that are used for classification) by 5x10^4 times and duration-based earliness (i.e., percentage of duration of the classified packets of a flow) by a factor of 60, resulting in a 84.1% macro F1 score (31% higher than Transformer) on SCVIC-TS-2022. Additionally, the proposed MDT outperforms the state-of-the-art early detection methods by 5% and 6% on ECG and Wafer datasets, respectively.

cs.CR↗

arXiv2021

An Access Control for IoT Based on Network Community Perception and Social Trust Against Sybil Attacks

The evolution of the Internet of Things (IoT) has increased the connection of personal devices, mainly taking into account the habits and behavior of their owners. These environments demand access control mechanisms to protect them against intruders, like Sybil attacks. that can compromise data privacy or disrupt the network operation. The Social IoT paradigm enables access control systems to aggregate community context and sociability information from devices to enhance robustness and security. This work introduces the ELECTRON mechanism to control access in IoT networks based on social trust between devices to protect the network from Sybil attackers. ELECTRON groups IoT devices into communities by their social similarity and evaluates their social trust, strengthening the reliability between legitimate devices and their resilience against the interaction of Sybil attackers. NS-3 Simulations show the ELECTRON performance under Sybil attacks on several IoT communities so that it has gotten to detect more than 90% of attackers in a scenario with 150 nodes into offices, schools, gyms, and~parks communities, and in other scenarios for same communities it achieved around of 90\% of detection. Furthermore, it provided high accuracy, over 90-95%, and false positive rates closer to zero.

cs.SI↗

arXiv2021

Relational Consensus-Based Cooperative Task Allocation Management for IIoT-Health Networks

IIoT services focused on industry-oriented services often require objects run more than one task. IIoT objects poses the challenge of distributing and managing task allocation among them. The fairness of task allocation brings flexible network reconfiguration and maximizes the tasks to be performed. Although existing approaches optimize and manage the dynamics of objects, not all them consider both co-relationship between tasks and object capabilities and the distributed allocation over the cluster service. This paper introduces the ACADIA mechanism for task allocation in IIoT networks in order to distribute task among objects. It relies on relational consensus strategies to allocate tasks and similarity capabilities to determine which objects can play in accomplishing those tasks. Evaluation on NS-3 showed that ACADIA achieved 98% of allocated tasks in an IIoT-Health considering all scenarios, average more than 95% of clusters apt to performed tasks in a low response time, and achieved 50% more effectiveness in task allocation compared to the literature solution CONTASKI.

cs.NI↗

arXiv2020

Detecting FDI Attack on Dense IoT Network with Distributed Filtering Collaboration and Consensus

The rise of IoT has made possible the development of %increasingly personalized services, like industrial services that often deal with massive amounts of data. However, as IoT grows, its threats are even greater. The false data injection (FDI) attack stands out as being one of the most harmful to data networks like IoT. The majority of current systems to handle this attack do not take into account the data validation, especially on the data clustering service. This work introduces CONFINIT, an intrusion detection system against FDI attacks on the data dissemination service into dense IoT. It combines watchdog surveillance and collaborative consensus among IoT devices for getting the swift detection of attackers. CONFINIT was evaluated in the NS-3 simulator into a dense industrial IoT and it has gotten detection rates of 99%, 3.2% of false negative and 3.6% of false positive rates, adding up to 35% in clustering without FDI attackers.

cs.CR↗

arXiv2020

GROWN: Local Data Compression in Real-Time To Support Energy Efficiency in WBAN

The evolution of wireless technologies has enabled the creation of networks for several purposes as health care monitoring. The Wireless Body Area Networks (WBANs) enable continuous and real-time monitoring of physiological signals, but that monitoring leads to an excessive data transmission usage, and drastically affects the power consumption of the devices. Although there are approaches for reducing energy consumption, many of them do not consider information redundancy to reduce the power consumption. This paper proposes a hybrid approach of local data compression, called GROWN, to decrease information redundancy during data transmission and reduce the energy consumption. Our approach combines local data compression methods found in WSN. We have evaluated GROWN by experimentation, and the results show a decrease in energy consumption of the devices and an increase in network lifetime.

cs.NI↗

arXiv2020

Social-based Cooperation of Vehicles for Data Dissemination of Critical Urban Events

Critical urban events need to be efficiently handled, for instance, through rapid notification. VANETs are a promising choice in supporting notification of information on arbitrary critical events. Although the dynamicity of VANETs compromises the dissemination process, the connections among vehicles based on users' social interests allow for optimizing message exchange and data dissemination. This paper introduces SOCIABLE, a robust data dissemination system for critical urban events that operates in a SIoV network. It is based on vehicles' community with common interests and/or similar routines and employs social influence of vehicles according to their network location to select relay vehicles. In a comparative analysis on NS3 with the MINUET system, SOCIABLE achieved 36.56% less packets transmitted in a dense VANET and a maximum packet delivery delay of 28ms in a sparse VANET, delivering critical event data in a real-time and robust way without overloading the~network.

cs.NI↗

arXiv2020

Managing Consensus-Based Cooperative Task Allocation for IIoT Networks

Current IoT services include industry-oriented services, which often require objects to run more than one task. However, the exponential growth of objects in IoT poses the challenge of distributing and managing task allocation among objects. One of the main goals of task allocation is to improve the quality of information and maximize the tasks to be performed. Although there are approaches that optimize and manage the dynamics of nodes, not all consider the quality of information and the distributed allocation over the cluster service. This paper proposes the mechanism CONTASKI for task allocation in IIoT networks to distribute tasks among objects. It relies on collaborative consensus to allocate tasks and similarity capabilities to know which objects can play in accomplishing those tasks. CONTASKI was evaluated on NS-3 and achieved 100% of allocated tasks incases with 75 and 100 nodes, and, on average, more than 80% clusters performed tasks in a low response time.

cs.NI↗

arXiv2020

E-Health Sensitive Data Dissemination Exploiting Trust and Mobility of Users

E-health services handle a massive amount of sensitive data, requiring reliability and privacy. The advent of new technologies drives e-health services into their continuous provision outside traditional care institutions. This creates uncertain and unreliable conditions, resulting in the challenge of controlling sensitive user data dissemination. Then, there is a gap in sensitive data dissemination under situations requiring fast response (e.g., cardiac arrest). This obligates networks to provide reliable sensitive data dissemination under user mobility, dynamic network topology, and occasional interactions between the devices. In this article, we propose STEALTH, a system that employs social trust and communities of interest to address these challenges. STEALTH follows two steps: clustering and dissemination. In the first, STEALTH groups devices based on the interests of their users, forming communities of interest. A healthcare urgency launches the second, in which STEALTH disseminates user sensitive data to devices belonging to specific communities, subjected to the level of trust between devices. Simulation results demonstrate that STEALTH ensures data dissemination to people who can contribute toward an efficient service. STEALTH has achieved up to 97.14% of reliability in accessing sensitive data with a maximum latency of 170 ms, and up to 100% of availability during emergencies.

cs.CY↗

arXiv2017

Early Signals from Volumetric DDoS Attacks: An Empirical Study

Distributed Denial of Service (DDoS) is a common type of Cybercrime. It can strongly damage a company reputation and increase its costs. Attackers improve continuously their strategies. They doubled the amount of unleashed communication requests in volume, size, and frequency in the last few years. This occurs against different hosts, causing resource exhaustion. Previous studies focused on detecting or mitigating ongoing DDoS attacks. Yet, addressing DDoS attacks when they are already in place may be too late. In this article, we consider network resilience by early prediction of attack trends. We show empirically the advantage of using non-parametric leading indicators for early prediction of volumetric DDoS attacks. We report promising results over a real dataset from CAIDA. Our results raise new questions and opportunities for further research in early predicting trends of DDoS attacks.

cs.NI↗

arXiv2017

Can MPTCP Secure Internet Communications from Man-in-the-Middle Attacks?

-Multipath communications at the Internet scale have been a myth for a long time, with no actual protocol being deployed so that multiple paths could be taken by a same connection on the way towards an Internet destination. Recently, the Multipath Transport Control Protocol (MPTCP) extension was standardized and is undergoing a quick adoption in many use-cases, from mobile to fixed access networks, from data-centers to core networks. Among its major benefits -- i.e., reliability thanks to backup path rerouting; throughput increase thanks to link aggregation; and confidentiality thanks to harder capacity to intercept a full connection -- the latter has attracted lower attention. How interesting would it be using MPTCP to exploit multiple Internet-scale paths hence decreasing the probability of man-in-the-middle (MITM) attacks is a question to which we try to answer. By analyzing the Autonomous System (AS) level graph, we identify which countries and regions show a higher level of robustness against MITM AS-level attacks, for example due to core cable tapping or route hijacking practices.

cs.NI↗

arXiv2016

Anticipating Moves to Prevent Botnet Generated DDoS Flooding Attacks

Volumetric Distributed Denial of Service (DDoS) attacks have been a recurrent issue on the Internet. These attacks generate a flooding of fake network traffic to interfere with targeted servers or network links. Despite many efforts to detect and mitigate them, attackers have played a game always circumventing countermeasures. Today, there is an increase in the number of infected devices, even more with the advent of the Internet of Things and flexible communication technologies. Leveraging device-to-device short range wireless communications and others, infected devices can coordinate sophisticated botnets, which can be employed to intensify DDoS attacks. The new generation of botnets is even harder to detect because of their adaptive and dynamic behavior yielded by infected mobile portable devices. Additionally, because there can be a large number of geographically distributed devices, botnets increase DDoS traffic significantly. In face of their new behavior and the increasing volume of DDoS traffic, novel and intelligent-driven approaches are required. Specifically, we advocate for {\em anticipating} trends of DDoS attacks in the early stages as much as possible. This work provides an overview of approaches that can be employed to anticipate trends of DDoS attacks generated by botnets in their early stages and brings an insightful discussion about the advantages of each kind of approach and open issues.

cs.NI↗

arXiv2016

MAC Protocols for IEEE 802.11ax: Avoiding Collisions on Dense Networks

Wireless networks have become the main form of Internet access. Statistics show that the global mobile Internet penetration should exceed 70\% until 2019. Wi-Fi is an important player in this change. Founded on IEEE 802.11, this technology has a crucial impact in how we share broadband access both in domestic and corporate networks. However, recent works have indicated performance issues in Wi-Fi networks, mainly when they have been deployed without planning and under high user density. Hence, different collision avoidance techniques and Medium Access Control protocols have been designed in order to improve Wi-Fi performance. Analyzing the collision problem, this work strengthens the claims found in the literature about the low Wi-Fi performance under dense scenarios. Then, in particular, this article overviews the MAC protocols used in the IEEE 802.11 standard and discusses solutions to mitigate collisions. Finally, it contributes presenting future trends in MAC protocols. This assists in foreseeing expected improvements for the next generation of Wi-Fi devices.

cs.NI↗

arXiv2016

A New Queue Discipline for Reducing Bufferbloat Effects in HetNet Concurrent Multipath Transfer

Heterogeneous wireless networks have evolved to reach application requirements for low latency and high throughput on Internet access. Recent studies have improved network performance employing the Multipath TCP, which aggregates flows from heterogeneous wireless interfaces in a single connection. Although existing proposals are powerful, coupled congestion control algorithms are currently limited because of the high variation in path delays, bandwidth and loss rate, typical from heterogeneous wireless networks, even more over concurrent multipath transmissions. These transmissions experience bufferbloat, i.e., high delays caused by long queues. Hence, to cope with the current limitations, this work presents CoDel-LIFO, a new active queue management (AQM) discipline to reduce the dropped packet ratio in the Multipath TCP congestion control mechanism. Differently from other approaches, CoDel-LIFO gives priority to the most recent packets, being then promising. This paper provides a detailed simulation analysis over congestion control algorithms by comparing CoDel-LIFO to CoDel and DropTail disciplines. Results indicate that CoDel-LIFO reduces queue drops, diminishing the impact on congestion control; improving substantially the goodput; and keeping RTT low.

cs.NI↗

arXiv2015

PBF: A New Privacy-Aware Billing Framework for Online Electric Vehicles with Bidirectional Auditability

Recently an online electric vehicle (OLEV) concept has been introduced, where vehicles are propelled through the wirelessly transmitted electrical power from the infrastructure installed under the road while moving. The absence of secure-and-fair billing is one main hurdle to widely adopt this promising technology. This paper introduces a secure and privacy-aware fair billing framework for OLEV on the move through the charging plates installed under the road. We first propose two extreme lightweight mutual authentication mechanisms, a direct authentication and a hash chain-based authentication between vehicles and the charging plates that can be used for different vehicular speeds on the road. Second we propose a secure and privacy-aware wireless power transfer on move for the vehicles with bidirectional auditability guarantee by leveraging game-theoretic approach. Each charging plate transfers a fixed amount of energy to the vehicle and bills the vehicle in a privacy-aware way accordingly. Our protocol guarantees secure, privacy-aware, and fair billing mechanism for the OLEVs while receiving electric power from the road. Moreover our proposed framework can play a vital role in eliminating the security and privacy challenges in the deployment of power transfer technology to the OLEVs.

cs.CR↗