Interoperability and Explicable AI-based Zero-Day Attacks Detection Process in Smart Community

Attackers frequently use zero-day exploits to obtain unauthorized system access, steal sensitive information, disrupt services, or execute malicious code without being detected. As there is no prior information or defense against zero-day vulnerabilities, these attacks can be extremely harmful and difficult to remediate. Existing signature-based detection systems prove inefficient against zero-day attacks due to the Lack of Signatures, no prior knowledge, and, most importantly, polymorphic characteristics of malware [1, 2]. While some attackers employ methods like polymorphism, which alters virus properties over time, signature-based systems find it challenging to detect any anomalies or attacks. The anomaly-based detection system also failed to detect the newest attack as it lacks historical data as well as a sensitivity vs. false positive attitude. Attackers may employ sophisticated evasion techniques or mimic legitimate traffic to avoid triggering alerts and, most importantly, limited scope, which may not be adequately covered by the conventional detection system [3]. AI algorithms can effortlessly combine and analyze network logs, user activity analytics, endpoint security tools, and other data sources. This comprehensive approach improves threat detection accuracy. AI can swiftly assess data from interoperable systems and automate the reaction to zero-day assaults, minimizing the time window for an attacker to exploit the vulnerability. Interoperability enables companies and security systems to work together and share threat intelligence. In this research, we present an approach that combines interoperability with explainable artificial intelligence (XAI) to discover an optimal solution for detecting zero-day attacks [4, 5].

Interoperability facilitates seamless communication between disparate systems. This is necessary to combine different technologies into a coherent network, including Wi-Fi 8, 6G, and the Internet of Everything IoE [6, 7]. Fig. 1 explains the concept of interoperability in the context of technology, which refers to making sure that various platforms, networks, and devices can communicate with each other and function as a single unit, particularly in the areas of networking and cybersecurity. Systems can cooperate regardless of the underlying architecture when they are constructively interoperable [8]. Creating integrated networks—especially helpful for IoE ecosystems and multi-network environments—where different devices and technologies coexist and collaborate requires cross-platform interoperability. Through the facilitation of unified threat identification and response, interoperability can enhance security. Faster incident response and a wider understanding of security threats are made possible by this shared knowledge. Information sharing between systems makes it simpler to identify and address security risks, such as zero-day attacks. Interoperability guarantees that new technologies can be integrated into current systems with minimal effort[9].

A cyberattack that leverages an undiscovered software vulnerability is known as a zero-day assault. Because the vulnerability is unknown to the software vendor or security community, no patch or remedy was available at the time of the attack. Fig. 2 describes the life cycle of a zero-day attack, highlighting its essential stages [10]:

• •

  Search and Discover: A zero-day vulnerability is found by an individual or group, such as a researcher, hacker, or member of a security organization. The discovery could be made by code analysis, fuzzing, or exploiting other security issues.

• •

  Development and Weaponizing: Once the vulnerability has been identified, attackers create an exploit to take advantage of it. This entails writing code or developing a method for exploiting the vulnerability to infiltrate systems. In some circumstances, attackers may tailor the exploit to specific targets or conditions.

• •

  Deploy and Explore: The exploit is converted into a format that can be utilized in a real-world attack. This could include generating malware, incorporating the exploit into existing malware, or launching a phishing effort to deliver the exploit to targets. Attackers frequently package their exploits to avoid detection by security software.

• •

  Impact and Disclosure: Exploitation of the zero-day vulnerability can have serious implications. This could include data breaches, ransomware attacks, financial losses, espionage, and other harmful acts. The impact is often determined by the importance of the target, the sort of data or systems compromised, and the attacker’s goals.

• •

  Response, Mitigation, and Learning: The software provider provides a patch or upgrade to address the vulnerability. This approach can take some time, particularly if the vulnerability is complicated or impacts key systems. Security teams may undertake postmortem investigations to determine how the zero-day attack occurred, assess its tactics, and identify security process improvements to prevent such attacks in the future.

Though this is a well-renowned life cycle, an attacker might change or skip any steps mentioned here. An Intrusion Detection and Prevention System (IDPS) operates by keeping an eye on system activity or network traffic, analyzing collected data for threats using a variety of techniques, identifying potentially malicious traffic, notifying relevant personnel of identified threats, taking appropriate action to stop intrusions once they are discovered, and producing reports for analysis and compliance [11]. IDPS faces significant challenges in detecting zero-day attacks, as zero-day take advantage of undiscovered vulnerabilities, which prevents IDPS from having the required signatures or patches. Zero-day attacks do not have the known threat signatures that traditional signature-based IDPS rely on, making these systems unreliable against them. In our proposed methodology to overcome this issue, we introduced an intermediate layer between interoperability and the IDPS system that added an extra layer of defense through XAI to detect the zero-day attack. The main contribution of the paper is–

• •

  To boost IDPS’s overall performance, this work couples Artificial Intelligence with interoperability among sixth-generation (6G), WiFi-8, and IoE.

• •

  The authors focus on Zero-Day attack pattern detection by combining Machine Learning with Explainable AI (XAI).

• •

  In addition, they evaluate multiple models and consolidate the results for further investigation.

Organization: This paper is structured as follows: Discussions on the previous research and the concept of Interoperability among 6G, IoE & Wifi-8 in section II, Zero-day attack and its lifecycle to prevent the attack finally after weaponizing phase. Then, the proposed AI-based IDPS for zero-day attack detection, along with prevention and procedures, is presented in section III. The dataset description part is presented in section IV. Moreover, results and a related discussion are given in section V. Lastly, section VI contains the conclusion and some thoughts, limitations, and future scopes.

Intrusion Detection Systems have been essential in identifying any abnormal or suspicious activity that could compromise general security and pave the way for significant cyberattacks since the invention of Wi-Fi technology [12]. Many researchers employ various techniques to identify and stop zero-day attacks [13]. A few work with heuristic analysis, others with behavioral analysis, others with signature-based detection, others with threat intelligence, others with endpoint protection, others with advanced threat detection solutions, and others with cloud-based solutions [14].

Kumar et al. [15] study discussed parameters that are overlooked when identifying zero-day attacks. By omitting those requirements, several organizations claim they can manage complex cyberattacks but not in practical scenarios. By ignoring those requirements, we are merely avoiding the risk, and the attacker manages to complete his mission. Hindy et al. [16] use a deep learning-based methodology to identify zero-day attacks, with the primary risk being that the decision-making process frequently misses or fails to detect the true attack. Similarly, M. Macas et al. [17] focused on different deep learning technologies for detecting attacks in various perspectives.

Zhang et al. [18] showed how aggregated vulnerability-based assessment could detect zero-day attacks. Martins et al. [19] worked on a host-based detection system. Another paper Salim et al. [20] implemented federated learning based detection system for healthcare. Zahoora et al. [21] mitigated XML injection based zero day attack via strategy-based detection system. On the other hand, Efe et al. [22] shows the comparison of host-based and network-based detection systems and what their limitations are. IDPS may be anomalous or signature-based as Nie et al. [23] focused on existing strategies and their loopholes. Recently, they began combining different technologies, such as SC and ML, to boost performance. We will describe the adoption process for AI and interoperability, followed by a review of previous work.

From the above discussion, we summarise that Numerous publications on Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) based on ML & AI were discovered throughout our investigation on this subject[24]. In certain articles, AI and ML are combined for IDS or IPS. However, there aren’t many papers that show how interoperability among cutting-edge state-of-the-art technology with AI provides threat detection feeds for IDPS that prevent zero-day attacks [25]. That is the reason for our actions. For intrusion detection, we address XAI along with recent technologies.

In the constantly changing field of cyber security, one of the most dangerous risks that businesses and individuals encounter is the feared zero-day attack. The vendors are left with little time to create and implement a patch since these attacks make use of flaws in hardware, software, or firmware that they are unaware of [26, 27]. Hence, until a fix is released, hackers may take advantage of these vulnerabilities to obtain unauthorized access, interfere with business processes, or steal sensitive data. To overcome this issue, we developed an explainable artificial intelligence (XAI) based zero-day attack detection system given in Fig. 3. Most importantly, the proposed methodology is divided into three sections: the generic layer, the intermediate layer, and the final detection layer. In the generic layer, real-time thread intelligence of smart community systems (Wi-Fi8, IoE, 6G communication) is shared by interoperability to the intermediate layer [28]. In the intermediate layer, we made use of machine learning techniques with XAI to create a robust zero-day attack detection system. The final layer analyzes the threat level and sends alerts to security teams through the IDPS system efficiently [29, 30].

This section focused on the proposed framework from a variety of perspectives and datasets. Initially, cupKDD99 was used to detect an intrusion. The effect of detection on performance is examined. The parameters with the best results are then picked for comparison with the centralized approach. The SHAP results are then used to explain and understand the outcomes of the proposed framework. The study concludes with a thorough discussion of the findings, providing insightful interpretations. NSL-KDD datasets are used to determine the categories of different types of attacks [40, 41]. The NSL-KDD dataset is commonly utilized in intrusion detection and cybersecurity research. It is an improved version of the original KDD Cup 1999 dataset, which addresses some of its shortcomings. The KDD Cup 1999 dataset was built on a simulation of a military network and had various flaws, including excessive redundancy and poor representation of contemporary network traffic. The NSL-KDD dataset overcomes these shortcomings by presenting a more balanced and realistic depiction of network traffic [42]. It is frequently used to assess intrusion detection systems (IDS) and machine learning models in the context of cybersecurity. Despite its improvements over the original KDD Cup 1999 dataset, NSL-KDD still contains certain flaws, such as redundant features and a lack of representation for some attacks [43, 44].

UNSW-NB15 is used for network traffic feature extraction [34]. The UNSW-NB15 dataset is another extensively used dataset in network security and intrusion detection. It was developed by academics at the University of New South Wales (UNSW) in Australia and is specifically intended for evaluating network intrusion detection systems (NIDS). Another type of intrusion detection is host-based detection systems (HBDS). The dataset is based on network traffic recorded in a controlled setting, which may not accurately reflect the complexity and variety of real-world network traffic. As a result, models trained on this dataset may not perform well in real-world circumstances. Though it has some limitations, it is very helpful for security researchers. We use this dataset to check if our system is able to detect any unknown attacks. The result is satisfactory as the system can successfully detect unknown attacks and prevent them by successfully isolating from the entire network through IDPS. The ToN-IoT dataset is a useful resource for evaluating the effectiveness of AI-enabled cybersecurity applications across IoT, network traffic, and operating systems [45]. The ToN-IoT dataset, like other intrusion detection datasets, may suffer from class imbalance, in which the number of cases reflecting typical traffic outnumbers those showing malicious or aberrant behavior. This mismatch can have an impact on the performance of machine learning models as well as how assessment results are interpreted [46].

In Table I, we compared our proposed work with some of the existing work considered during the background study. Moreover, for the experimental analysis in this work, the following parameters are used while measuring the performance and analyzing the results.

• •

  Security Metrics: Security metrics include zero-day attack detection rate, false positive rate, incident response time, attack surface reduction, and anomaly detection accuracy. The accuracy is calculated by using Equation 2.

  $\displaystyle Accuracy=$

  $\displaystyle\frac{TP+TN}{TP+TN+FP+FN},$

  (2)

• •

  Efficiency Metrics: It focuses on resource consumption, network latency, algorithm processing time, and scalability.

• •

  Effectiveness: It includes Threat prevention rate, attack vector identification, Incident resolution rate, and defensive capability.

• •

  Continuous Improvement: We prioritize feedback loop efficacy, patch management efficiency, and security training impact for optimal performance.

Zero-day is the most vulnerable attack in the cyber security system. It can not be detected by a regular system, as its pattern is unknown and unrecognizable. To address this issue in the smart community in combination with interoperability, we introduce an intermediate layer that detects the unknown pattern of zero-day by XAI and supplies it to the IDPS system, which detects the anomaly. Furthermore, this intermediate layer works as double-layer anomaly detection, where regular attacks are detected in this layer in a more efficient way in the case of time and accuracy, and zero-day is detected in the final layer as XAI detects the pattern and passes it to the IDPS system. In the case of zero-day pattern detection, AdaBoostM1 performed the highest accuracy, whereas in anomaly detection, RandomSubspace triggered the highest accuracy for both with and without XAI. LogitBoost and DecisionTable take the lowest computational time after applying XAI in case of anomaly detection. The objectives that we mentioned before have been successfully completed using our proposed methodology. It can detect any kind of attack, including the most vulnerable zero-day. In the future, we will work on zero-day attack prevention with a larger dataset.