Anomaly based multi-stage attack detection method.

Multi-stage attacks are one of the most critical security threats in the current cyberspace. To accurately identify multi-stage attacks, this paper proposes an anomaly-based multi-stage attack detection method. It constructs a Multi-Stage Profile (MSP) by modeling the stable system's normal state to detect attack behaviors. Initially, the method employs Doc2Vec to vectorize alert messages generated by the intrusion detection systems (IDS), extracting profound inter-message correlations. Subsequently, Hidden Markov Models (HMM) are employed to model the normal system state, constructing an MSP, with relevant HMM parameters dynamically acquired via clustering algorithms. Finally, the detection of attacks is achieved by determining the anomaly threshold through the generation probability (GP). To evaluate the performance of the proposed method, experiments were conducted using three public datasets and compared with three advanced multi-stage attack detection methods. The experimental results demonstrate that our method achieves an accuracy of over 99% and precision of 100% in multi-stage attack detection. This confirms the effectiveness of our method in adapting to different attack scenarios and ultimately completing attack detection.

Research on Adaptive 1DCNN Network Intrusion Detection Technology Based on BSGM Mixed Sampling.

The development of internet technology has brought us benefits, but at the same time, there has been a surge in network attack incidents, posing a serious threat to network security. In the real world, the amount of attack data is much smaller than normal data, leading to a severe class imbalance problem that affects the performance of classifiers. Additionally, when using CNN for detection and classification, manual adjustment of parameters is required, making it difficult to obtain the optimal number of convolutional kernels. Therefore, we propose a hybrid sampling technique called Borderline-SMOTE and Gaussian Mixture Model (GMM), referred to as BSGM, which combines the two approaches. We utilize the Quantum Particle Swarm Optimization (QPSO) algorithm to automatically determine the optimal number of convolutional kernels for each one-dimensional convolutional layer, thereby enhancing the detection rate of minority classes. In our experiments, we conducted binary and multi-class experiments using the KDD99 dataset. We compared our proposed BSGM-QPSO-1DCNN method with ROS-CNN, SMOTE-CNN, RUS-SMOTE-CNN, RUS-SMOTE-RF, and RUS-SMOTE-MLP as benchmark models for intrusion detection. The experimental results show the following: (i) BSGM-QPSO-1DCNN achieves high accuracy rates of 99.93% and 99.94% in binary and multi-class experiments, respectively; (ii) the precision rates for the minority classes R2L and U2R are improved by 68% and 66%, respectively. Our research demonstrates that BSGM-QPSO-1DCNN is an efficient solution for addressing the imbalanced data issue in this field, and it outperforms the five intrusion detection methods used in this study.

Influence of tea saponin on enhancing accessibility of pyrene and cadmium phytoremediated with Lolium multiflorum in co-contaminated soils.

Tea saponin (TS), a kind of biodegradable surfactant, was chosen to improve the accessible solubilization of pyrene and cadmium (Cd) in co-contaminated soils cultivated Lolium multiflorum. TS obviously improved the accessibility of pyrene and Cd for L. multiflorum to accelerate the process of accumulation and elimination of the pollutants. The chemical forms of Cd was transformed from Fe-Mn oxides and associated to carbonates fractions into exchangeable fractions by adding TS in single Cd and pyrene-Cd contaminated soils. Moreover, the chemical forms of pyrene were transformed from associated fraction into bioaccessible fraction by adding TS in pyrene and pyrene-Cd contaminated soils. In pyrene-Cd contaminated soil, the exchangeable fraction of Cd was hindered in the existence of pyrene, and bioaccessible fraction of pyrene was promoted by the cadmium. Besides, in the process of the pyrene degradation and Cd accumulation, the effect could be improved by the elongation of roots with adding TS, and the microorganism activity was stimulated by TS to accelerate the removal of pollutions. Therefore, Planting L. multiflorum combined with adding TS would be an effective method on the phytoremediation of organics and heavy metals co-contaminated soils.

Identification of Scirpus triqueter root exudates and the effects of organic acids on desorption and bioavailability of pyrene and lead in co-contaminated wetland soils.

Root exudates (REs) of Scirpus triqueter were extracted from the rhizosphere soil in this study. The components in the REs were identified by GC-MS. Many organic acids, such as hexadecanoic acid, pentadecanoic acid, vanillic acid, octadecanoic acid, citric acid, succinic acid, glutaric acid, and so on, were found. Batch simulated experiments were conducted to evaluate the impacts of different organic acids, such as citric acid, artificial root exudates (ARE), succinic acid, and glutaric acid in REs of S. triqueter on desorption of pyrene (PYR) and lead (Pb) in co-contaminated wetland soils. The desorption amount of PYR and Pb increased with the rise in concentrations of organic acids in the range of 0-50 g·L(-1), within shaking time of 2-24 h. The desorption effects of PYR and Pb in soils with various organic acids treatments decreased in the following order: citric acid > ARE > succinic acid > glutaric acid. The desorption rate of PYR and Pb was higher in co-contaminated soil than in single pollution soil. The impacts of organic acids in REs of S. triqueter on bioavailability of PYR and Pb suggested that organic acids enhanced the bioavailability of PYR and Pb in wetland soil, and the bioavailability effects of organic acids generally followed the same order as that of desorption effects.

Potential of Sagittaria trifolia for Phytoremediation of Diesel.

The phytoremediation potential and responses of Sagittaria trifolia to diesel were investigated. In order to elucidate the biochemical and physiological responses of S. trifolia to diesel, the chlorophyll content, root vitality, soluble protein content and antioxidant enzymes activity (peroxidase (POD), catalase (CAT) and antioxidant enzymes superoxide dismutase (SOD)) were determined in the plant tissues after 50 d of diesel treatment. The results showed the presence of S. trifolia significantly improved the removal ratios of diesel, from 21∼36% in the control soils to 54∼85% in the planted soils. The chlorophyll content, root vitality and soluble protein content all increased at low diesel concentration, then decreased at high diesel concentration. The activities of CAT and POD exhibited peak values at 5 g·kg(-1) diesel treatment and declined at higher diesel concentrations. However, the activity of SOD kept stable at lower diesel concentration (1 and 5 g·kg(-1)), and also declined at higher diesel concentration. Collectively, S. trifolia had the ability to tolerate certain amount of diesel, but when the concentration was up to 10 g·kg(-1), the growth of S. trifolia would be restrained. The results also showed that variation of antioxidant enzyme activity was an important response in plants to diesel pollution.