請用此 Handle URI 來引用此文件：
http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/101374完整後設資料紀錄
| DC 欄位 | 值 | 語言 |
|---|---|---|
| dc.contributor.advisor | 林宗男 | zh_TW |
| dc.contributor.advisor | Tsung-Nan Lin | en |
| dc.contributor.author | 張育維 | zh_TW |
| dc.contributor.author | Yu Wei Chang | en |
| dc.date.accessioned | 2026-01-27T16:19:28Z | - |
| dc.date.available | 2026-01-28 | - |
| dc.date.copyright | 2026-01-27 | - |
| dc.date.issued | 2026 | - |
| dc.date.submitted | 2026-01-12 | - |
| dc.identifier.citation | [1] Yu-Wei Chang, Hong-Yen Chen, Chansu Han, Tomohiro Morikawa, Takeshi Takahashi, and Tsung-Nan Lin. Finish: Efficient and scalable nmf-based federated learning for detecting malware activities. IEEE Transactions on Emerging Topics in Computing, 11(4):934–949, 2023.
[2] Kai Jiang, Huan Zhou, Xin Chen, and Haijun Zhang. Mobile edge computing for ultra-reliable and low-latency communications. IEEE Communications Standards Magazine, 5(2):68–75, 2021. [3] Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. Kitsune: An ensemble of autoencoders for online network intrusion detection, 2018. [4] Haonan Yan, Xiaoguang Li, Wenjing Zhang, Rui Wang, Hui Li, Xingwen Zhao, Fenghua Li, and Xiaodong Lin. Automatic evasion of machine-learning-based network intrusion detection systems. IEEE Transactions on Dependable and Secure Computing, 2023. [5] Chansu Han, Jun’ichi Takeuchi, Takeshi Takahashi, and Daisuke Inoue. Automated detection of malware activities using nonnegative matrix factorization. In IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pages 548–556. IEEE, 2021. [6] Chansu Han, Jun’ichi Takeuchi, Takeshi Takahashi, and Daisuke Inoue. Dark-tracer: Early detection framework for malware activity based on anomalous spatiotemporal patterns. IEEE Access, 10:13038–13058, 2022. [7] Junghoon Park. An effective IoT interface considering an eye-tracking method for autonomous vehicle. Internet of Things, page 101583, 2025. [8] Wu Jianping, Qiu Guangqiu, Wu Chunming, Jiang Weiwei, and Jin Jiahe. Federated learning for network attack detection using attention-based graph neural networks. Scientific Reports, 14(1):19088, 2024. [9] Syed Wali Abbas Rizvi, Yasir Ali Farrukh, and Irfan Khan. Adversarial red teaming for NIDS: Model-agnostic physical-space attacks, 2024. [10] Giovanni Apruzzese, Mauro Andreolini, Luca Ferretti, Mirco Marchetti, and Michele Colajanni. Modeling realistic adversarial attacks against network intrusion detection systems. Digital Threats: Research and Practice (DTRAP), 3(3):1–19, 2022. [11] Taejin Kim, Jiarui Li, Shubhranshu Singh, Nikhil Madaan, and Carlee Joe-Wong. Adversarial robustness unhardening via backdoor attacks in federated learning. arXiv preprint arXiv:2310.11594, 2023. [12] Aitor Belenguer, Jose A. Pascual, and Javier Navaridas. Göwfed: A novel federated network intrusion detection system. Journal of Network and Computer Applications, 217:103653, 2023. [13] Jianbin Li, Xin Tong, Jinwei Liu, and Long Cheng. An efficient federated learning system for network intrusion detection. IEEE Systems Journal, 17(2):2455–2464, 2023. [14] Ansam Khraisat, Ammar Alazab, Sarabjot Singh, Tony Jan, and Alfredo Jr. Gomez. Survey on federated learning for intrusion detection system: Concept, architectures, aggregation strategies, challenges, and future directions. ACM Computing Surveys, 57(1):1–38, 2024. [15] Li Li. Comprehensive survey on adversarial examples in cybersecurity: Impacts, challenges, and mitigation strategies. arXiv preprint arXiv:2412.12217, 2024. [16] Walid El Maouaki, Nouhaila Innan, Alberto Marchisio, Taoufik Said, Mohamed Bennai, and Muhammad Shafique. QFAL: Quantum federated adversarial learning. arXiv preprint arXiv:2502.21171, 2025. [17] Shu Feng, Luhan Gao, and Leyi Shi. CGFL: A robust federated learning approach for intrusion detection systems based on data generation. Applied Sciences, 15(5):2416, 2025. [18] Sabrine Ennaji, Fabio De Gaspari, Dorjan Hitaj, Alicia Kbidi, and Luigi V. Mancini. Adversarial challenges in network intrusion detection systems: Research insights and future prospects. arXiv preprint arXiv:2409.18736, 2024. [19] Santosh K. Smmarwar, Govind P. Gupta, and Sanjay Kumar. Android malware detection and identification frameworks by leveraging the machine and deep learning techniques: A comprehensive review. Telematics and Informatics Reports, page 100130, 2024. [20] Shalini Saini, Anitha Chennamaneni, and Babatunde Sawyerr. A review of the duality of adversarial learning in network intrusion: Attacks and countermeasures. arXiv preprint arXiv:2412.13880, 2024. [21] Duncan Hodges and Sadie Creese. Understanding cyber-attacks. In Cyber Warfare, pages 33–60. Routledge, 2015. [22] Verizon. 2023 Data Breach Investigations Report. Technical report, Verizon, 2023. [23] Martti Lehto. Cyber-attacks against critical infrastructure. In Cyber Security: Critical Infrastructure Protection, pages 3–42. Springer, 2022. [24] Dietmar P. F. Möller. NIST cybersecurity framework and MITRE cybersecurity criteria. In Guide to Cybersecurity in Digital Transformation: Trends, Methods, Technologies, Applications and Best Practices, pages 231–271. Springer, 2023. [25] Chandra Shekhar Yadav and Sangeeta Gupta. A review on malware analysis for IoT and Android system. SN Computer Science, 4(2):118, 2022. [26] Kenneth Brezinski and Ken Ferens. Metamorphic malware and obfuscation: A survey of techniques, variants, and generation kits. Security and Communication Networks, 2023(1):8227751, 2023. [27] Constantinos Patsakis, David Arroyo, and Fran Casino. The malware as a service ecosystem. In Malware: Handbook of Prevention and Detection, pages 371–394. Springer, 2024. [28] Zainab Alkhalil, Chaminda Hewage, Liqaa Nawaf, and Imtiaz Khan. Phishing attacks: A recent comprehensive study and a new anatomy. Frontiers in Computer Science, 3:563060, 2021. [29] Thomas S. Hyslip and George W. Burruss. Ransomware. In Handbook on Crime and Technology, pages 86–104. Edward Elgar Publishing, 2023. [30] Timothy McIntosh, Teo Susnjak, Tong Liu, Dan Xu, Paul Watters, Dongwei Liu, Yaqi Hao, Alex Ng, and Malka Halgamuge. Ransomware reloaded: Re-examining its trend, research and mitigation in the era of data exfiltration. ACM Computing Surveys, 57(1):1–40, 2024. [31] Jun Zhang and Dan Tenney. The evolution of integrated advance persistent threat and its defense solutions: A literature review. Open Journal of Business and Management, 12(1):293–338, 2023. [32] Anderson Bergamini De Neira, Burak Kantarci, and Michele Nogueira. Distributed denial of service attack prediction: Challenges, open issues and opportunities. Computer Networks, 222:109553, 2023. [33] N. Joychandra Singh, Nazrul Hoque, Kh. Robindro Singh, and Dhruba K. Bhattacharyya. Botnet-based IoT network traffic analysis using deep learning. Security and Privacy, 7(2):e355, 2024. [34] Amit Sharma, Brij B. Gupta, Awadhesh Kumar Singh, and V. K. Saraswat. Advanced persistent threats (APT): Evolution, anatomy, attribution and countermeasures. Journal of Ambient Intelligence and Humanized Computing, 14(7):9355–9381, 2023. [35] Rahaf Alkhadra, Joud Abuzaid, Mariam AlShammari, and Nazeeruddin Mohammad. SolarWinds hack: In-depth analysis and countermeasures. In 2021 12th International Conference on Computing Communication and Networking Technologies (ICCCNT), pages 1–7. IEEE, 2021. [36] Muhammad Syafiq Kheruddin, Muhammad Adam Emir Mohd Zuber, and Muhammad Mukhlis Mohamad Radzai. Phishing attacks: Unraveling tactics, threats, and defenses in the cybersecurity landscape. Authorea Preprints, 2024. [37] Chloe Stejskal, Alexander Perminov, Aaron Lester, Suman Bhunia, Mohammad Salman, and Paulo A. Regis. Analyzing the impact and implications of COMB: A comprehensive study of 3 billion breached credentials. In 2024 IEEE 24th International Symposium on Cluster, Cloud and Internet Computing Workshops (CCGridW), pages 158–167. IEEE, 2024. [38] Misbah Anjum, Shakshi Singhal, P. K. Kapur, Sunil Kumar Khatri, and Saurabh Panwar. Analysis of vulnerability fixing process in the presence of incorrect patches. Journal of Systems and Software, 195:111525, 2023. [39] Zhuoran Tan, Shameem Puthiya Parambath, Christos Anagnostopoulos, Jeremy Singer, and Angelos K. Marnerides. Advanced persistent threats based on supply chain vulnerabilities: Challenges, solutions & future directions. IEEE Internet of Things Journal, 2025. [40] Usman Inayat, Mashaim Farzan, Sajid Mahmood, Muhammad Fahad Zia, Shahid Hussain, and Fabiano Pallonetto. Insider threat mitigation: Systematic literature review. Ain Shams Engineering Journal, page 103068, 2024. [41] Xirong Ning and Jin Jiang. Defense-in-depth against insider attacks in cyber-physical systems. Internet of Things and Cyber-Physical Systems, 2:203–211, 2022. [42] Muhammad Fahad, Haroon Airf, Aashesh Kumar, and Hafiz Khawar Hussain. Securing against APTs: Advancements in detection and mitigation. BIN: Bulletin of Informatics, 1(2), 2023. [43] Samuel Chng, Han Yu Lu, Ayush Kumar, and David Yau. Hacker types, motivations and strategies: A comprehensive framework. Computers in Human Behavior Reports, 5:100167, 2022. [44] Joab Kose. Cyber warfare: An era of nation-state actors and global corporate espionage. ISSA Journal, 19(4):12–15, 2021. [45] Vijay Prakash Gupta. Smart sensors and industrial IoT (IIoT): A driver of the growth of Industry 4.0. In Smart Sensors for Industrial Internet of Things: Challenges, Solutions and Applications, pages 37–49, 2021. [46] Sean Cordey. Software supply chain attacks: An illustrated typological review. Technical report, ETH Zurich, 2023. [47] Abayomi Titilola Olutimehin, Sunday Joseph, Adekunbi Justina Ajayi, Olufunke Cynthia Metibemu, Adebayo Yusuf Balogun, and Oluwaseun Oladeji Olaniyi. Future-proofing data: Assessing the feasibility of post-quantum cryptographic algorithms to mitigate “harvest now, decrypt later” attacks. Decrypt Later’ Attacks (February 17, 2025), 2025. [48] Ke He, Dan Dongseong Kim, and Muhammad Rizwan Asghar. Adversarial machine learning for network intrusion detection systems: A comprehensive survey. IEEE Communications Surveys & Tutorials, 25(1):538–566, 2023. [49] Daisuke Inoue, Katsunari Yoshioka, Masashi Eto, Masaya Yamagata, Eisuke Nishino, Jun’ichi Takeuchi, Kazuya Ohkouchi, and Koji Nakao. An incident analysis system NICTER and its analysis engines based on data mining techniques. In International Conference on Neural Information Processing, pages 579–586. Springer, 2008. [50] Ruoming Pang, Vinod Yegneswaran, Paul Barford, Vern Paxson, and Larry Peterson. Characteristics of internet background radiation. In Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, pages 27–40. ACM, 2004. [51] Cliff Changchun Zou, Lixin Gao, Weibo Gong, and Don Towsley. Monitoring and early warning for internet worms. In Proceedings of the 10th ACM Conference on Computer and Communications Security, pages 190–199. ACM, 2003. [52] Mitsuaki Akiyama, Takanori Kawamoto, Masayoshi Shimamura, Teruaki Yokoyama, Youki Kadobayashi, and Suguru Yamaguchi. A proposal of metrics for botnet detection based on its cooperative behavior. In 2007 International Symposium on Applications and the Internet Workshops, pages 82–82. IEEE, 2007. [53] Philipp Richter and Arthur Berger. Scanning the scanners: Sensing the internet from a massively distributed network telescope. In Proceedings of the Internet Measurement Conference, pages 144–157, 2019. [54] Belal Ali, Mark A. Gregory, and Shuo Li. Multi-access edge computing architecture, data security and privacy: A review. IEEE Access, 9:18706–18721, 2021. [55] Ahmad Alalewi, Iyad Dayoub, and Soumaya Cherkaoui. On 5G-V2X use cases and enabling technologies: A comprehensive survey. IEEE Access, 9:107710–107737, 2021. [56] Bin Liu, Zhongqiang Luo, Hongbo Chen, and Chengjie Li. A survey of state-of-the-art on edge computing: Theoretical models, technologies, directions, and development paths. IEEE Access, 10:54038–54063, 2022. [57] Salmane Douch, Mohamed Riduan Abid, Khalid Zine-Dine, Driss Bouzidi, and Driss Benhaddou. Edge computing technology enablers: A systematic lecture study. IEEE Access, 10:69264–69302, 2022. [58] Prabhu Kaliyammal Thiruvasagam, Abhishek Chakraborty, and C. Siva Ram Murthy. Resilient and latency-aware orchestration of network slices using multi-connectivity in MEC-enabled 5G networks. IEEE Transactions on Network and Service Management, 18(3):2502–2514, 2021. [59] Khizar Abbas, Yeongpil Cho, Ali Nauman, Prince Waqas Khan, Talha Ahmed Khan, and Koteswararao Kondepu. Convergence of AI and MEC for autonomous IoT service provisioning and assurance in B5G. IEEE Open Journal of the Communications Society, 4:2913–2929, 2023. [60] Mobasshir Mahbub and Raed M. Shubair. Contemporary advances in multi-access edge computing: A survey of fundamentals, architecture, technologies, deployment cases, security, challenges, and directions. Journal of Network and Computer Applications, 219:103726, 2023. [61] Shin-Ming Cheng, Bing-Kai Hong, and Cheng-Feng Hung. Attack detection and mitigation in MEC-enabled 5G networks for AIoT. IEEE Internet of Things Magazine, 5(3):76–81, 2022. [62] Muhammad Ilyas Khattak, Hui Yuan, Ajmal Khan, Ayaz Ahmad, Inam Ullah, and Manzoor Ahmed. Evolving multi-access edge computing (MEC) for diverse ubiquitous resources utilization: A survey. Telecommunication Systems, 88(2):1–41, 2025. [63] David Kolevski and Katina Michael. Edge computing and IoT data breaches: Security, privacy, trust, and regulation. IEEE Technology and Society Magazine, 43(1):22–32, 2024. [64] Tomasz W. Nowak, Mariusz Sepczuk, Zbigniew Kotulski, Wojciech Niewolski, Rafal Artych, Krzysztof Bocianiak, Tomasz Osko, and Jean-Philippe Wary. Verticals in 5G MEC-use cases and security challenges. IEEE Access, 9:87251–87298, 2021. [65] Nabil El Ioini, Hamid R. Barzegar, Claus Pahl, et al. Trust management for service migration in multi-access edge computing environments. Computer Communications, 194:167–179, 2022. [66] Yaochu Jin, Hangyu Zhu, Jinjin Xu, and Yang Chen. Federated Learning. Springer, 2023. [67] Bin Gu, An Xu, Zhouyuan Huo, Cheng Deng, and Heng Huang. Privacy-preserving asynchronous vertical federated learning algorithms for multiparty collaborative learning. IEEE Transactions on Neural Networks and Learning Systems, 33(11):6103–6115, 2021. [68] Maram Fahaad Almufareh, Noshina Tariq, Mamoona Humayun, and Bushra Almas. A federated learning approach to breast cancer prediction in a collaborative learning framework. In Healthcare, volume 11, page 3185. MDPI, 2023. [69] Katharine Daly, Hubert Eichner, Peter Kairouz, H. Brendan McMahan, Daniel Ramage, and Zheng Xu. Federated learning in practice: Reflections and projections. In 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA), pages 148–156. IEEE, 2024. [70] Nguyen Truong, Kai Sun, Siyao Wang, Florian Guitton, and YiKe Guo. Privacy preservation in federated learning: An insightful survey from the GDPR perspective. Computers & Security, 110:102402, 2021. [71] Ji Liu, Jizhou Huang, Yang Zhou, Xuhong Li, Shilei Ji, Haoyi Xiong, and Dejing Dou. From distributed machine learning to federated learning: A survey. Knowledge and Information Systems, 64(4):885–917, 2022. [72] Jie Wen, Zhixia Zhang, Yang Lan, Zhihua Cui, Jianghui Cai, and Wensheng Zhang. A survey on federated learning: Challenges and applications. International Journal of Machine Learning and Cybernetics, 14(2):513–535, 2023. [73] Durjoy Mistry, Muhammad Firoz Mridha, Mejdl Safran, Sultan Alfarhood, Aloke Kumar Saha, and Dunren Che. Privacy-preserving on-screen activity tracking and classification in e-learning using federated learning. IEEE Access, 11:79315–79329, 2023. [74] Omair Rashed Abdulwareth Almanifi, Chee-Onn Chow, Mau-Luen Tham, Joon Huang Chuah, and Jeevan Kanesan. Communication and computation efficiency in federated learning: A survey. Internet of Things, 22:100742, 2023. [75] Mang Ye, Xiuwen Fang, Bo Du, Pong C. Yuen, and Dacheng Tao. Heterogeneous federated learning: State-of-the-art and research challenges. ACM Computing Surveys, 56(3):1–44, 2023. [76] Wei Huang, Tianrui Li, Dexian Wang, Shengdong Du, Junbo Zhang, and Tianqiang Huang. Fairness and accuracy in horizontal federated learning. Information Sciences, 589:170–185, 2022. [77] Yang Liu, Yan Kang, Tianyuan Zou, Yanhong Pu, Yuanqin He, Xiaozhou Ye, Ye Ouyang, Ya-Qin Zhang, and Qiang Yang. Vertical federated learning: Concepts, advances, and challenges. IEEE Transactions on Knowledge and Data Engineering, 36(7):3615–3634, 2024. [78] Yang Liu, Yan Kang, Chaoping Xing, Tianjian Chen, and Qiang Yang. A secure federated transfer learning framework. IEEE Intelligent Systems, 35(4):70–82, 2020. [79] Rodolfo Stoffel Antunes, Cristiano André da Costa, Arne Küderle, Imrana Abdullahi Yari, and Björn Eskofier. Federated learning for healthcare: Systematic review and architecture proposal. ACM Transactions on Intelligent Systems and Technology (TIST), 13(4):1–23, 2022. [80] Guodong Long, Yue Tan, Jing Jiang, and Chengqi Zhang. Federated learning for open banking. In Federated Learning: Privacy and Incentive, pages 240–254. Springer, 2020. [81] Alexander Brecko, Erik Kajati, Jiri Koziorek, and Iveta Zolotova. Federated learning for edge computing: A survey. Applied Sciences, 12(18):9124, 2022. [82] Tuo Zhang, Lei Gao, Chaoyang He, Mi Zhang, Bhaskar Krishnamachari, and A. Salman Avestimehr. Federated learning for the internet of things: Applications, challenges, and opportunities. IEEE Internet of Things Magazine, 5(1):24–29, 2022. [83] Utpal Mangla. Application of federated learning in telecommunications and edge computing. In Federated Learning: A Comprehensive Overview of Methods and Applications, pages 523–534. Springer, 2022. [84] Farshid Varno, Marzie Saghayi, Laya Rafiee Sevyeri, Sharut Gupta, Stan Matwin, and Mohammad Havaei. AdaBest: Minimizing client drift in federated learning via adaptive bias estimation. In European Conference on Computer Vision, pages 710–726. Springer, 2022. [85] Bing Luo, Wenli Xiao, Shiqiang Wang, Jianwei Huang, and Leandros Tassiulas. Tackling system and statistical heterogeneity for federated learning with adaptive client sampling. In IEEE INFOCOM 2022—IEEE Conference on Computer Communications, pages 1739–1748. IEEE, 2022. [86] Yanli Ren, Yerong Li, Guorui Feng, and Xinpeng Zhang. Privacy-enhanced and verification-traceable aggregation for federated learning. IEEE Internet of Things Journal, 9(24):24933–24948, 2022. [87] Ruchi Gupta and Tanweer Alam. Survey on federated-learning approaches in distributed environment. Wireless Personal Communications, pages 1–22, 2022. [88] Hongkyu Lee, Jeehyeong Kim, Seyoung Ahn, Rasheed Hussain, Sunghyun Cho, and Junggab Son. Digestive neural networks: A novel defense strategy against inference attacks in federated learning. Computers & Security, 109:102378, 2021. [89] Devrim Unal, Mohammad Hammoudeh, Muhammad Asif Khan, Abdelrahman Abuarqoub, Gregory Epiphaniou, and Ridha Hamila. Integration of federated machine learning and blockchain for the provision of secure big data analytics for internet of things. Computers & Security, 109:102393, 2021. [90] Tien-Dung Cao, Tram Truong-Huu, Hien Tran, and Khanh Tran. A federated deep learning framework for privacy preservation and communication efficiency. Journal of Systems Architecture, 124:102413, 2022. [91] Anastasia Pustozerova, Andreas Rauber, and Rudolf Mayer. Training effective neural networks on structured data with federated learning. In International Conference on Advanced Information Networking and Applications, pages 394–406. Springer, 2021. [92] Shenglai Zeng, Zonghang Li, Hongfang Yu, Yihong He, Zenglin Xu, Dusit Niyato, and Han Yu. Heterogeneous federated learning via grouped sequential-to-parallel training. In International Conference on Database Systems for Advanced Applications, pages 455–471. Springer, 2022. [93] Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Foundations and Trends® in Machine Learning, 14(1–2):1–210, 2021. [94] Nicolas Gillis and François Glineur. A multilevel approach for nonnegative matrix factorization. Journal of Computational and Applied Mathematics, 236(7):1708–1723, 2012. [95] Daniel Lee and H. Sebastian Seung. Algorithms for non-negative matrix factorization. Advances in Neural Information Processing Systems, 13, 2000. [96] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics, pages 1273–1282. PMLR, 2017. [97] Yuqiu Qian, Conghui Tan, Danhao Ding, Hui Li, and Nikos Mamoulis. Fast and secure distributed nonnegative matrix factorization. IEEE Transactions on Knowledge and Data Engineering, 2020. [98] Chao Liu, Hung-chih Yang, Jinliang Fan, Li-Wei He, and Yi-Min Wang. Distributed nonnegative matrix factorization for web-scale dyadic data analysis on MapReduce. In Proceedings of the 19th International Conference on World Wide Web, pages 681–690. 2010. [99] Ramakrishnan Kannan, Grey Ballard, and Haesun Park. A high-performance parallel algorithm for nonnegative matrix factorization. ACM SIGPLAN Notices, 51(8):1–11, 2016. [100] Nicolas Gillis and François Glineur. Accelerated multiplicative updates and hierarchical ALS algorithms for nonnegative matrix factorization. Neural Computation, 24(4):1085–1105, 2012. [101] Tao Ban, Lei Zhu, Jumpei Shimamura, Shaoning Pang, Daisuke Inoue, and Koji Nakao. Detection of botnet activities through the lens of a large-scale darknet. In International Conference on Neural Information Processing, pages 442–451. Springer, 2017. [102] Sadegh Torabi, Elias Bou-Harb, Chadi Assi, ElMouatez Billah Karbab, Amine Boukhtouta, and Mourad Debbabi. Inferring and investigating IoT-generated scanning campaigns targeting a large network telescope. IEEE Transactions on Dependable and Secure Computing, 2020. [103] Fei Sha and Lawrence Saul. Real-time pitch determination of one or more voices by nonnegative matrix factorization. Advances in Neural Information Processing Systems, 17, 2004. [104] Ossama S. Alshabrawy, M. E. Ghoneim, W. A. Awad, and Aboul Ella Hassanien. Underdetermined blind source separation based on fuzzy c-means and semi-nonnegative matrix factorization. In 2012 Federated Conference on Computer Science and Information Systems (FedCSIS), pages 695–700. IEEE, 2012. [105] Antoine Rolet, Vivien Seguy, Mathieu Blondel, and Hiroshi Sawada. Blind source separation with optimal transport non-negative matrix factorization. EURASIP Journal on Advances in Signal Processing, 2018(1):1–16, 2018. [106] Jiali Mei, Yohann De Castro, Yannig Goude, Jean-Marc Azaïs, and Georges Hébrail. Nonnegative matrix factorization with side information for time series recovery and prediction. IEEE Transactions on Knowledge and Data Engineering, 31(3):493–506, 2018. [107] Lihua Zhou, Guowang Du, Dapeng Tao, Hongmei Chen, Jun Cheng, and Libo Gong. Clustering multivariate time series data via multi-nonnegative matrix factorization in multi-relational networks. IEEE Access, 6:74747–74761, 2018. [108] Zahir Alsulaimawi. A non-negative matrix factorization framework for privacy-preserving and federated learning. In 2020 IEEE 22nd International Workshop on Multimedia Signal Processing (MMSP), pages 1–6. IEEE, 2020. [109] Xiang Li, Shusen Wang, Kun Chen, and Zhihua Zhang. Communication-efficient distributed SVD via local power iterations. In International Conference on Machine Learning, pages 6504–6514. PMLR, 2021. [110] ETSI. Multi-access edge computing (MEC) framework and reference architecture. ETSI GS MEC, 3:V2.2.1, 2020. [111] Chansu Han, Jumpei Shimamura, Takeshi Takahashi, Daisuke Inoue, Jun’ichi Takeuchi, and Koji Nakao. Real-time detection of global cyberthreat based on darknet by estimating anomalous synchronization using graphical lasso. IEICE Transactions on Information and Systems, 103(10):2113–2124, 2020. [112] ETSI. TS 123 501: “5G; system architecture for the 5G system (3GPP TS 23.501 version 15.3.0 release 15).” European Telecommunications Standards Institute, Tech. Rep. V15, 2018. [113] Oluwadamilare Harazeem Abdulganiyu, Taha Ait Tchakoucht, and Yakub Kayode Saheed. A systematic literature review for network intrusion detection system (IDS). International Journal of Information Security, 22(5):1125–1162, 2023. [114] Mohammed Y. Aldarwbi, Arash H. Lashkari, and Ali A. Ghorbani. The sound of intrusion: A novel network intrusion detection system. Computers and Electrical Engineering, 104:108455, 2022. [115] Ahmet Efe and İrem Nur Abacı. Comparison of the host based intrusion detection systems and network based intrusion detection systems, 2022. [116] Adabi Raihan Muhammad, Parman Sukarno, and Aulia Arif Wardana. Integrated security information and event management (SIEM) with intrusion detection system (IDS) for live analysis based on machine learning. Procedia Computer Science, 217:1406–1415, 2023. [117] Wikipedia. Intrusion detection system, 2025. [Online; accessed 11-April-2025]. [118] Bashar Hameed, AbdAllah A. AlHabshy, and Kamal A. ElDahshan. Distributed intrusion detection systems in big data: A survey. Al-Azhar Bulletin of Science, 32(1-B):27–44, 2021. [119] Vinod Kumar and Om Prakash Sangwan. Signature based intrusion detection system using Snort. International Journal of Computer Applications & Information Technology, 1(3):35–41, 2012. [120] Rafath Samrin and D. Vasumathi. Review on anomaly based network intrusion detection system. In 2017 International Conference on Electrical, Electronics, Communication, Computer, and Optimization Techniques (ICEECCOT), pages 141–147. IEEE, 2017. [121] Fadwa Abdul-Bari Mohammed, Nagham Mekky, Hassan Suleiman, and Noha Hikal. Sinkhole attack detection by enhanced reputation-based intrusion detection system. IEEE Access, 2024. [122] Martin Roesch et al. Snort: Lightweight intrusion detection for networks. In LISA, volume 99, pages 229–238, 1999. [123] Nathan Shone, Tran Nguyen Ngoc, Vu Dinh Phai, and Qi Shi. A deep learning approach to network intrusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1):41–50, 2018. [124] F. Folino, G. Folino, M. Guarascio, F. S. Pisani, and L. Pontieri. On learning effective ensembles of deep neural networks for intrusion detection. Information Fusion, 72:48–69, 2021. [125] Othmane Belarbi, Aftab Khan, Pietro Carnelli, and Theodoros Spyridopoulos. An intrusion detection system based on deep belief networks. In Springer International Publishing, pages 377–392, 2022. [126] Guansong Pang, Chunhua Shen, Huidong Jin, and Anton van den Hengel. Deep weakly-supervised anomaly detection, 2023. [127] Seffi Cohen, Niv Goldshlager, Bracha Shapira, and Lior Rokach. TTANAD: Test-time augmentation for network anomaly detection. Entropy, 25(5), 2023. [128] Soumyadeep Hore, Quoc H. Nguyen, Yulun Xu, Ankit Shah, Nathaniel D. Bastian, and Trung Le. Empirical evaluation of autoencoder models for anomaly detection in packet-based NIDS. In 2023 IEEE Conference on Dependable and Secure Computing (DSC), pages 1–8. IEEE, 2023. [129] Gustavo de Carvalho Bertoli, Lourenço Alves Pereira Junior, Osamu Saotome, and Aldri Luiz dos Santos. Generalizing intrusion detection for heterogeneous networks: A stacked-unsupervised federated learning approach. Computers & Security, 127:103106, 2023. [130] Zhen Yang, Xiaodong Liu, Tong Li, Di Wu, Jinjiang Wang, Yunwei Zhao, and Han Han. A systematic literature review of methods and datasets for anomaly-based network intrusion detection. Computers & Security, 116:102675, 2022. [131] Mark Handley, Vern Paxson, and Christian Kreibich. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In 10th USENIX Security Symposium (USENIX Security 01), 2001. [132] Thomas H. Ptacek and Timothy N. Newsham. Insertion, evasion, and denial of service: Eluding network intrusion detection. Technical report, Secure Networks, Inc., 1998. [133] Tsung-Huan Cheng, Ying-Dar Lin, Yuan-Cheng Lai, and Po-Ching Lin. Evasion techniques: Sneaking through your intrusion detection/prevention systems. IEEE Communications Surveys & Tutorials, 14(4):1011–1020, 2011. [134] Steven J. Templeton and Karl E. Levitt. Detecting spoofed packets. In Proceedings DARPA Information Survivability Conference and Exposition, volume 1, pages 164–175. IEEE, 2003. [135] Nour Alhussien, Ahmed Aleroud, Abdullah Melhem, and Samer Y. Khamaiseh. Constraining adversarial attacks on network intrusion detection systems: Transferability and defense analysis. IEEE Transactions on Network and Service Management, 2024. [136] Chaoyun Zhang, Xavier Costa-Perez, and Paul Patras. Adversarial attacks against deep learning-based network intrusion detection systems and defense mechanisms. IEEE/ACM Transactions on Networking, 30(3):1294–1311, 2022. [137] Khushnaseeb Roshan, Aasim Zafar, and Shiekh Burhan Ul Haque. Untargeted white-box adversarial attack with heuristic defence methods in real-time deep learning based network intrusion detection system. Computer Communications, 218:97–113, 2024. [138] Dongqi Han, Zhiliang Wang, Ying Zhong, Wenqi Chen, Jiahai Yang, Shuqiang Lu, Xingang Shi, Xingang Shi, and Xia Yin. Evaluating and improving adversarial robustness of machine learning-based network intrusion detectors. IEEE Journal on Selected Areas in Communications, 39(8):2632–2647, 2021. [139] Shuaishuai Tan, Xiaoxiong Zhong, Zhiyi Tian, and Qingkuan Dong. Sneaking through security: Mutating live network traffic to evade learning-based NIDS. IEEE Transactions on Network and Service Management, 19(3):2295–2308, 2022. [140] Yam Sharon, David Berend, Yang Liu, Asaf Shabtai, and Yuval Elovici. Tantra: Timing-based adversarial network traffic reshaping attack. IEEE Transactions on Information Forensics and Security, 17:3225–3237, 2022. [141] Jacob Sakhnini, Hadis Karimipour, Ali Dehghantanha, and Reza M. Parizi. AI and security of critical infrastructure. In Handbook of Big Data Privacy, pages 7–36, 2020. [142] Pankaj Kumar Keserwani, Mahesh Chandra Govil, and Emmanuel S. Pilli. An effective NIDS framework based on a comprehensive survey of feature optimization and classification techniques. Neural Computing and Applications, 35(7):4993–5013, 2023. [143] Said Ouiazzane, Malika Addou, and Fatimazahra Barramou. A Suricata and machine learning based hybrid network intrusion detection system. In Advances in Information, Communication and Cybersecurity: Proceedings of ICI2C’21, pages 474–485. Springer, 2022. [144] Teodor Sommestad, Hannes Holm, and Daniel Steinvall. Variables influencing the effectiveness of signature-based network intrusion detection systems. Information Security Journal: A Global Perspective, 31(6):711–728, 2022. [145] Ansam Khraisat, Iqbal Gondal, Peter Vamplew, and Joarder Kamruzzaman. Survey of intrusion detection systems: Techniques, datasets and challenges. Cybersecurity, 2(1):1–22, 2019. [146] Nur Ilzam Che Mat, Norziana Jamil, Yunus Yusoff, and Miss Laiha Mat Kiah. A systematic literature review on advanced persistent threat behaviors and its detection strategy. Journal of Cybersecurity, 10(1):tyad023, 2024. [147] Hakan Kılıç, Neşet Sertaç Katal, and Ali Aydın Selçuk. Evasion techniques efficiency over the IPS/IDS technology. In 2019 4th International Conference on Computer Science and Engineering (UBMK), pages 542–547. IEEE, 2019. [148] Aparna Ganesan and Kamil Sarac. Mitigating evasion attacks on machine learning based NIDS systems in SDN. In 2021 IEEE 7th International Conference on Network Softwarization (NetSoft), pages 268–272. IEEE, 2021. [149] Yulong Wang, Tong Sun, Shenghong Li, Xin Yuan, Wei Ni, Ekram Hossain, and H. Vincent Poor. Adversarial attacks and defenses in machine learning-empowered communication systems and networks: A contemporary survey. IEEE Communications Surveys & Tutorials, 2023. [150] João Vitorino, Isabel Praça, and Eva Maia. SoK: Realistic adversarial attacks and defenses for intelligent network intrusion detection. Computers & Security, page 103433, 2023. [151] João Vitorino, Nuno Oliveira, and Isabel Praça. Adaptative perturbation patterns: Realistic adversarial learning for robust intrusion detection. Future Internet, 14(4):108, 2022. [152] Mohamed Amine Merzouk, Frédéric Cuppens, Nora Boulahia-Cuppens, and Reda Yaich. Investigating the practicality of adversarial evasion attacks on network intrusion detection. Annals of Telecommunications, 77(11):763–775, 2022. [153] Giovanni Apruzzese, Hyrum S. Anderson, Savino Dambra, David Freeman, Fabio Pierazzi, and Kevin Roundy. “Real attackers don’t compute gradients”: Bridging the gap between adversarial ML research and practice. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 339–364. IEEE, 2023. [154] Shunyao Wang, Ryan K. L. Ko, Guangdong Bai, Naipeng Dong, Taejun Choi, and Yanjun Zhang. Evasion attack and defense on machine learning models in cyber-physical systems: A survey. IEEE Communications Surveys & Tutorials, 2023. [155] Blake E. Strom, Andy Applebaum, Doug P. Miller, Kathryn C. Nickels, Adam G. Pennington, and Cody B. Thomas. MITRE ATT&CK: Design and philosophy. Technical report, The MITRE Corporation, 2018. [156] Roger Dingledine, Nick Mathewson, Paul F. Syverson, et al. Tor: The second-generation onion router. In USENIX Security Symposium, volume 4, pages 303–320, 2004. [157] Felipe Astolfi, Jelger Kroese, and Jeroen Van Oorschot. I2P—the invisible internet project. Leiden University Web Technology Report, 2015. [158] Iman Sharafaldin, Arash Habibi Lashkari, Ali A. Ghorbani, et al. Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSP, 1:108–116, 2018. | - |
| dc.identifier.uri | http://tdr.lib.ntu.edu.tw/jspui/handle/123456789/101374 | - |
| dc.description.abstract | 隨著 5G 通訊技術普及以及大量物聯網終端接入網路，現代網路逐步演變為分散且組成多元的系統型態，使得整體運作架構更加繁複，也同步放大了潛在資全威脅。在此情境下，現存的系統於實際部署時逐漸面臨限制，包括在流量環境中難以有效擴充、需分析的網路流量資料量急速膨脹，以及對於新興且持續變化的攻擊為缺乏調適能力。
近幾年來，物聯網成為發動資安攻擊的重要載體，相關事件不僅數量快速增加，惡意軟體在功能設計與攻擊策略上也更加多樣且精細。這類感染活動已上升為全球性的安全風險，原因是一旦應變處理延誤，會造成嚴重損害，如敏感資訊被非法存取或外洩。現有的防護與事件回應措施仍不足以有效因應此類威脅，從而凸顯出強化即時偵測機制，以及建立跨利害關係者之間高效率資訊共享體系的需求。 本論文以防禦端與攻擊端的雙重視角切入網路安全問題。首先，提出 FINISH 的分散式協同學習框架，彙整來自多個暗網感測節點的觀測資訊，在無須集中原始資料同時能建構模型與分析。此方法不僅能顯著降低節點之間的通訊成本，也能達到隱私保護需求，並具備應用於 5G 多接取邊緣運算場域的可行性。此外，論文亦提出並深入探討一種新穎的規避技術──流量偽裝攻擊，其核心概念在於將惡意行為巧妙地融合進看似正常的流量，從而有效規避現有資安系統的識別能力。 藉由將聯邦學習理念納入資安體系，FINISH 即使面對來源異質且分散的資料環境，仍能展現一致且可信的入侵偵測能力。相較之下，FCA 在極低的計算成本下即可實現高度有效的規避效果，從而暴露出當前資安系統於架構與假設上的核心缺陷。綜合來看，結果強調了在對抗的威脅中，重新評估協作式資安機制之必要性，並為後續建構兼具韌性、可擴充性與隱私保護能力的資安方案奠定了關鍵基礎。 | zh_TW |
| dc.description.abstract | The swift growth of modern networking environments, driven by the rollout of 5G systems and the explosive growth of Internet of Things (IoT) devices, has resulted in significantly more intricate infrastructures and a much broader attack surface. Consequently, traditional Network Intrusion Detection Systems (NIDS) are increasingly strained by issues such as poor scalability, massive traffic volumes, and the necessity to respond to fast-evolving threat behaviors.
In recent years, large-scale cyberattacks leveraging IoT devices have become alarmingly frequent, with IoT malware growing in both diversity and sophistication. These infections pose significant global risks, as delayed incident responses often result in severe consequences such as the leakage of sensitive information. Current countermeasures remain insufficient, underscoring the urgent need for early detection and effective information sharing among stakeholders. To address these challenges, this dissertation proposes innovative defense and attack mechanisms that (1) operate effectively in decentralized and large-scale environments and (2) preserve data privacy, and (3) advanced evasion techniques. This work tackles the problem from both defensive and offensive perspectives. First, it introduces FINISH, a federated learning framework that integrates decentralized darknet sensor data using nonnegative matrix factorization. FINISH reduces communication overhead, supports privacy-preserving collaboration, and scales to 5G multiaccess edge computing scenarios. Second, it presents the Flow Camouflage Attack (FCA), a novel evasion strategy that conceals malicious activity within benign-like network flows, effectively bypassing state-of-the-art NIDS. By integrating federated learning into network defense, FINISH demonstrates robust detection capabilities across heterogeneous data sources. In parallel, FCA achieves complete evasion with minimal computational cost, exposing critical vulnerabilities in modern NIDS. Together, these findings emphasize the necessity of evaluating collaborative intrusion detection systems under adversarial pressure and pave the way for resilient, scalable, and privacy-preserving network security solutions. | en |
| dc.description.provenance | Submitted by admin ntu (admin@lib.ntu.edu.tw) on 2026-01-27T16:19:28Z No. of bitstreams: 0 | en |
| dc.description.provenance | Made available in DSpace on 2026-01-27T16:19:28Z (GMT). No. of bitstreams: 0 | en |
| dc.description.tableofcontents | Verification Letter from the Oral Examination Committee i
Acknowledgements iii 摘要 v Abstract vii Table of Contents ix List of Figures xvii List of Tables xxi Chapter 1 Introduction 1 1.1 Motivation: Early Detection and Evasion-Resilient Network Security 2 1.2 Observation Infrastructure: Darknet and MEC as Threat Intelligence Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.3 Contributions: Toward Federated Defense and Realistic Evasion Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 1.4 Bridging Offensive and Defensive Research . . . . . . . . . . . . . . 6 1.5 Organization of the Dissertation . . . . . . . . . . . . . . . . . . . . 6 Chapter 2 An Overview of Cyberattacks and Challenges to Network Security 9 2.1 Definition and Scope of Cyberattacks . . . . . . . . . . . . . . . . . 9 2.2 Major Categories of Cyberattacks . . . . . . . . . . . . . . . . . . . 10 2.2.1 Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 2.2.2 Phishing and Social Engineering . . . . . . . . . . . . . . . . . . . 10 2.2.3 Ransomware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.2.4 Denial of Service . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 2.2.5 Advance Persistence Threat . . . . . . . . . . . . . . . . . . . . . . 12 2.3 Common Attack Vectors . . . . . . . . . . . . . . . . . . . . . . . . 12 2.4 Attacker Motivations . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.5 Challenges to Network Security . . . . . . . . . . . . . . . . . . . . 13 Chapter 3 Darknets in Cybersecurity and Network Research 15 3.1 Historical Context and Motivation . . . . . . . . . . . . . . . . . . . 16 3.2 Darknet Monitoring and Data Characteristics . . . . . . . . . . . . . 16 3.3 Darknets as a Foundation for Malware Detection . . . . . . . . . . . 17 Chapter 4 5G Multi-access Edge Computing 21 4.1 MEC Architecture and Design Principles . . . . . . . . . . . . . . . 22 4.1.1 Architecture Overview . . . . . . . . . . . . . . . . . . . . . . . . 22 4.1.2 Enabling Technologies . . . . . . . . . . . . . . . . . . . . . . . . 23 4.2 MEC Use Cases from a Security Perspective . . . . . . . . . . . . . 24 4.3 Security Challenges in MEC Environments . . . . . . . . . . . . . . 24 4.4 Towards Distributed and Privacy-Preserving Learning at the Edge . . 25 Chapter 5 Federated Learning 27 5.1 Fundamentals of FL . . . . . . . . . . . . . . . . . . . . . . . . . . 27 5.1.1 Distinction from Distributed Learning . . . . . . . . . . . . . . . . 29 5.2 Technical Architecture and Process of FL . . . . . . . . . . . . . . . 29 5.2.1 Benefits of FL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 5.2.2 Federated Learning Taxonomy . . . . . . . . . . . . . . . . . . . . 31 5.3 Applications of FL Across Domains . . . . . . . . . . . . . . . . . . 31 5.4 Challenges and Limitations of FL . . . . . . . . . . . . . . . . . . . 32 Chapter 6 Federated Learning for Malware Detection: The FINISH [1] Framework 35 6.1 Detection of Malware Activities Using Darknet Traffic . . . . . . . . 39 6.2 Decentralized and Federated Approaches for NMF . . . . . . . . . . 40 6.3 Problem Formulation . . . . . . . . . . . . . . . . . . . . . . . . . . 42 6.3.1 Detecting Malware Activities through Dark-NMF Analysis . . . . . 42 6.3.2 Complexity Analysis for Dark-NMF . . . . . . . . . . . . . . . . . 43 6.3.3 Overlapping Feature Columns in Decentralized Observation Matrices 45 6.3.4 Federated NMF in the Presence of Column Overlap . . . . . . . . . 47 6.4 Proposed Federated Learning–Based Algorithm for Malware Activity Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 6.4.1 Deriving Federated NMF in the Presence of Column Overlap . . . . 49 6.4.2 FINISH [1] Algorithm . . . . . . . . . . . . . . . . . . . . . . . . 50 6.4.3 Inner Iterative Update . . . . . . . . . . . . . . . . . . . . . . . . . 53 6.4.4 Computational Cost Analysis of FINISH . . . . . . . . . . . . . . . 54 6.5 Malware Detection in 5G Multi-Access Edge Computing via FINISH 54 6.5.1 MEC-Enabled Darknet Sensor Application . . . . . . . . . . . . . . 55 6.5.2 MEC-Enabled FINISH [1] Client Application . . . . . . . . . . . . 55 6.5.3 FINISH [1] Server . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 6.6 Evaluation of FINISH [1] for Malware Activity Detection . . . . . . 57 6.6.1 Dataset Description . . . . . . . . . . . . . . . . . . . . . . . . . . 57 6.6.2 Hyperparameters . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 6.6.3 Convergence and Detection Results of Inner-Loop . . . . . . . . . . 60 6.6.4 Impact of Port Thresholds on Detection Results . . . . . . . . . . . 63 6.6.5 Execution-Time Analysis . . . . . . . . . . . . . . . . . . . . . . . 63 6.6.6 Detection Performance Comparison . . . . . . . . . . . . . . . . . 64 6.6.7 Comparative Analysis of Computational and Communication Costs of Related Methods . . . . . . . . . . . . . . . . . . . . . . . . . . 67 6.6.8 Performance Analysis of FINISH [1] in Simulated 5G MEC: Convergence and Time Costs . . . . . . . . . . . . . . . . . . . . . . . 69 6.7 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 6.7.1 Advantages and Limitations . . . . . . . . . . . . . . . . . . . . . 72 Chapter 7 Network Intrusion Detection System 75 7.1 Definition and Fundamental Concepts . . . . . . . . . . . . . . . . . 76 7.2 Historical Development and Evolution . . . . . . . . . . . . . . . . . 76 7.3 Types and Classification of NIDS . . . . . . . . . . . . . . . . . . . 77 7.3.1 Deployment Classification . . . . . . . . . . . . . . . . . . . . . . 77 7.3.2 Detection Methodology Classification . . . . . . . . . . . . . . . . 78 7.3.3 System Interactivity Classification . . . . . . . . . . . . . . . . . . 78 7.4 Detection Methodologies and Techniques . . . . . . . . . . . . . . . 79 Chapter 8 Network Intrusion Detection System Evasion 83 8.1 Background: Evasion Threat . . . . . . . . . . . . . . . . . . . . . . 83 8.2 Evasion Techniques in Classical NIDS . . . . . . . . . . . . . . . . . 84 8.2.1 Evasion of Signature-Based NIDS . . . . . . . . . . . . . . . . . . 84 8.2.2 Evasion of Anomaly-Based NIDS . . . . . . . . . . . . . . . . . . 85 8.3 Adversarial Evasion in Learning-Based NIDS . . . . . . . . . . . . . 86 8.3.1 Adversarial Example Generation for Evasion . . . . . . . . . . . . 86 Chapter 9 Adversarial Evasion in NIDS: The Flow Camouflage Attack 89 9.1 Proposed Flow Camouflage Attack . . . . . . . . . . . . . . . . . . 93 9.1.1 Threat Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 9.1.2 Formal Definition of FCA . . . . . . . . . . . . . . . . . . . . . . 94 9.1.2.1 Packet and Network Flow . . . . . . . . . . . . . . . . 94 9.1.2.2 Operations in FCA . . . . . . . . . . . . . . . . . . . . 95 9.1.2.3 Anomalous Traffic Masquerade (ATM) . . . . . . . . . 96 9.1.2.4 Definition of FCA . . . . . . . . . . . . . . . . . . . . 96 9.1.3 Workflow of the FCA . . . . . . . . . . . . . . . . . . . . . . . . . 97 9.1.3.1 Requirement of FCA . . . . . . . . . . . . . . . . . . 98 9.1.3.2 Evasion Attack’s Proximity of FCA . . . . . . . . . . . 99 9.1.4 Scenarios of FCA . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 9.2 Experiment & Result . . . . . . . . . . . . . . . . . . . . . . . . . . 101 9.2.1 Experimental Setup of NIDS and FCA Evasion Attack . . . . . . . 101 9.2.1.1 Training Datasets . . . . . . . . . . . . . . . . . . . . 102 9.2.1.2 Evaluated NIDSs . . . . . . . . . . . . . . . . . . . . 102 9.2.1.3 Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . 103 9.2.2 Ablation Study with NIDS Performance . . . . . . . . . . . . . . . 103 9.2.3 Ablation Study of FCA . . . . . . . . . . . . . . . . . . . . . . . . 103 9.2.3.1 NIDS Performance on Various Attack and Benign Traffic of FCA . . . . . . . . . . . . . . . . . . . . . . . . 106 9.2.3.2 NIDS Performance and Benign Traffic Data Rate in FCA 107 9.2.3.3 Anomaly-based NIDS Performance on Various Attack Traffic of FCA . . . . . . . . . . . . . . . . . . . . . . 107 9.2.3.4 Signature-based NIDS Performance on Various Attack Traffic of FCA . . . . . . . . . . . . . . . . . . . . . . 109 9.2.4 Comparison with Previous Work of Evasion Attack . . . . . . . . . 110 9.2.4.1 Performance Evaluation of State-of-the-Art NIDS Under Prior Evasion Attacks . . . . . . . . . . . . . . . . 110 9.2.4.2 Computation Time Comparison of NIDS Evasion . . . 112 9.2.4.3 NIDS Evasion Effectiveness and Low Computation Time of FCA . . . . . . . . . . . . . . . . . . . . . . . . . . 114 9.2.5 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 9.2.5.1 Limitations of the Study . . . . . . . . . . . . . . . . . 114 9.2.5.2 Future Research Directions . . . . . . . . . . . . . . . 115 9.3 NTU-FCA-VIR Dataset . . . . . . . . . . . . . . . . . . . . . . . . 115 9.3.1 NTU-FCA-VIR Dataset Collection Environment . . . . . . . . . . 116 9.3.2 Dataset Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 Chapter 10 Conclusion & Future Work 10.1 119 10.1 Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 10.1.1 Federated Extension of Complementary Algorithms . . . . . . . . . 120 10.1.2 Collaborative and Hierarchical Federated Learning . . . . . . . . . 121 10.1.3 Defense Mechanisms Against FCA and Adversarial Attacks . . . . 121 10.1.4 Benchmarking, Datasets, and Standardization . . . . . . . . . . . . 122 References 123 | - |
| dc.language.iso | en | - |
| dc.subject | 惡意行為偵測 | - |
| dc.subject | 聯邦學習 | - |
| dc.subject | 對抗性攻擊 | - |
| dc.subject | 躲避偵測攻擊 | - |
| dc.subject | 流量偽裝攻擊 | - |
| dc.subject | Federated Learning | - |
| dc.subject | Malware Detection | - |
| dc.subject | Network Intrusion Detection System | - |
| dc.subject | Adversarial Evasion | - |
| dc.subject | Flow Camouflage Attack | - |
| dc.title | 邁向強健的網路安全：聯邦學習與網路入侵偵測之規避攻擊研究 | zh_TW |
| dc.title | Towards Robust Network Security: Exploring Federated Learning and Evasion Attacks in Network Intrusion Detection | en |
| dc.type | Thesis | - |
| dc.date.schoolyear | 114-1 | - |
| dc.description.degree | 博士 | - |
| dc.contributor.oralexamcommittee | 郭斯彥;鄧惟中;謝宏昀;蔡子傑;陳俊良 | zh_TW |
| dc.contributor.oralexamcommittee | Sy-Yen Kuo;Wei-Chung Teng;Hung-Yun Hsieh;Tzu-Chieh Tsai;Jiann-Liang Chen | en |
| dc.subject.keyword | 惡意行為偵測,聯邦學習對抗性攻擊躲避偵測攻擊流量偽裝攻擊 | zh_TW |
| dc.subject.keyword | Federated Learning,Malware DetectionNetwork Intrusion Detection SystemAdversarial EvasionFlow Camouflage Attack | en |
| dc.relation.page | 145 | - |
| dc.identifier.doi | 10.6342/NTU202600035 | - |
| dc.rights.note | 未授權 | - |
| dc.date.accepted | 2026-01-12 | - |
| dc.contributor.author-college | 電機資訊學院 | - |
| dc.contributor.author-dept | 電機工程學系 | - |
| dc.date.embargo-lift | N/A | - |
| 顯示於系所單位： | 電機工程學系 | |
文件中的檔案：
| 檔案 | 大小 | 格式 | |
|---|---|---|---|
| ntu-114-1.pdf 未授權公開取用 | 17.21 MB | Adobe PDF |
系統中的文件，除了特別指名其著作權條款之外，均受到著作權保護，並且保留所有的權利。