Abstract
The tremendous development and rapid evolution in computing advancements has urged a lot of organizations to expand their data as well as computational needs. Such type of services offers security concepts like confidentiality, integrity, and availability. Thus, a highly secured domain is the fundamental need of cloud environments. In addition, security breaches are also growing equally in the cloud because of the sophisticated services of the cloud, which cannot be mitigated efficiently through firewall rules and packet filtering methods. In order to mitigate the malicious attacks and to detect the malicious behavior with high detection accuracy, an effective strategy named Multiverse Fractional Calculus (MFC) based hybrid deep learning approach is proposed. Here, two network classifiers namely Hierarchical Attention Network (HAN) and Random Multimodel Deep Learning (RMDL) are employed to detect the presence of malicious behavior. The network classifier is trained by exploiting proposed MFC, which is an integration of multi-verse optimizer and fractional calculus. The proposed MFC-based hybrid deep learning approach has attained superior results with utmost testing sensitivity, accuracy, and specificity of 0.949, 0.939, and 0.947.
Keywords
Introduction
Cloud computing is an advanced category of Information technology (IT) that provides services like infrastructures, and software services by means of a request-service and utilization [18, 23]. The ultimate need of cloud computing is the virtualization of cloud utilities, its storage and executions and the whole operation of the cloud are effectively handled using a central hypervisor machine. Hence, this advancement has become a spectacular platform for malicious attackers of application software because of a large amount of traffic caused in the cloud environment [24, 25, 19]. The major threat is mainly due to a denial of service attack (DoS), which is a commonly found cyber intruder in the cloud computing environment. In addition, packet flooding in transmitting protocols can cause huge deterioration to resources and bandwidth usage, thereby resulting in a short-term issue, or else the whole domain will be disintegrated. Such issues paved a path for the development of intrusion detection particularly to prevent zero-day attacks. The major issues associated with the Intrusion Detection System (IDS) are false alarms that lead to misuse problems and some anomaly prediction techniques are deployed in the cloud for alleviating such attacks [20, 26]. Though classical security models [21] are trustworthy in terms of identifying the user’s details, an attack recognition issue enters the platform when the model requires identifying the user’s malicious behaviors other than the log-in level. Besides, conventional security methods are still confronting a huge race between malware defenders and malware creators and recent malware defenses are not sufficient for unknown attacks due to the designing of novel attacking methods [1].
Malicious behavior is an illegitimate behavior carried out to demolish a whole online network with enormous details of advanced technology. The devastating intention of user behavior does not be stable for a time and it is highly expanding and causes severe damage to the web such attacks to cause more security issues. The threats can happen in diverse areas like IT organizations, government entities, educational institutions, financial services, Wikipedia, and online social domains. Online anonymity gives rise to crucial attacks and minimizes social restrictions and paved the way for many-to-many intervention [22, 27]. The presence of unidentified users is everywhere in the environment and they are faster in their execution when compared with the genuine users [22, 28]. Therefore, it is significant to learn and identify attacks on all web areas [9]. Most malicious attacks can be easily detected by observing Inter-Control Center Communications Protocol (ICCP) link. However, intruders make use of illegitimate authorization to control the central system through overlooked access nodes like dial-up or remote access establishments with weak access control techniques. Insider attacks, such as illegitimate data access and communication, and modifications of secure configurations are the results of a privacy breach inside a center. A DoS is caused due to the recurrent data requests that exploit the server’s utilization and protect the authorized function of the ICCP link. Moreover, malicious things attacking the ICCP server or different components in the network system can be utilized to eliminate thoughtful data for destruction, financial disruption, and certain malicious attacks [10].
Different types of artificial intelligence algorithms have been presented for IDS to improve the performance of classifiers like Naïve Bayes network, decision tree, K-nearest neighbor (K-NN), Support Vector Machine (SVM), and so forth. By analyzing the performance of classical methods, SVM is considered an efficient intrusion detection advancement when compared to various classifiers. For example, Logistics Regression, decision tree, Naïve Bayes, and other regression techniques are utilized in categorizing the KDD 99 database and outcomes revealed that SVM has achieved superior results over diverse categorization techniques. Hence, SVM can be termed an efficient categorization method over other algorithms. An SVM-based algorithm is a widely utilized algorithm for intrusion detection and this growing technique for malicious detection enhances the performance of the detection model. This algorithm merged both one-class and two-class SVM and this SVM perform very well on imbalanced datasets. The detailed features refined from the original KDD 99 can result in the data standard on the intrusion detection model performance. The balanced iterative reducing and clustering using hierarchies algorithm is utilized to pre-process the original samples, which has high-quality detection performance. Recently, researchers have developed an efficient intrusion detection structure depending upon SVM with feature augmentation that applies the logarithmic boundary density proportion to attain high-standard features and attained prediction accuracy that shows the superiority of the method [29].
The major contribution of this research is to model an effectual mechanism for malicious behavior detection employing a hybrid deep learning technique. Initially, cloud nodes are simulated in the cloud area and input data acquired from the dataset is fed to the feature selection process, which is carried out using a wrapper-based technique in order to choose the appropriate features for learning. Once appropriate features are selected, malicious behavior in the cloud environment is detected effectively using hybrid deep learning classifiers, namely Hierarchical Attention Network (HAN) and Random Multimodel Deep Learning (RMDL), where both the network classifiers are separately trained using Multiverse Fractional Calculus (MFC). The proposed MFC is derived from the integration of multi-verse optimizer and fractional calculus. Finally, both the results obtained from HAN and RMDL are fused together to generate a final output using Hausdorff distance-based method. From the fused result, the presence of malicious and non-malicious behavior in a cloud environment is detected efficiently.
Proposed MFC-based hybrid deep learning, an effective model is developed for malicious behavior detection using hybrid deep learning classifiers, namely HAN and RMDL. The final outcome is predicted based on Hausdorff distance by fusing both the results from HAN and RMDL.
The rest of the paper is arranged as follows: Section 2 illustrates the motivation of conventional techniques associated with malicious behavior detection in cloud computing beside with their benefits and disadvantages that motivate the researchers to set up a competent technique for malicious behavior detection. Section 3 explains cloud system model for malicious behavior detection and Section 4 deliberates the malicious behavior detection using hybrid deep learning and fusion-based approach. Section 5 presents the results and discussion of the developed approach. Finally, Section 6 concludes the paper.
Literature review
This section explains the literature survey of existing techniques to malicious behavior detection in cloud computing environments besides with their benefits and drawbacks that provoke the researchers to design an effectual technique for malicious behavior detection. Rabbani et al. [1] developed a new approach to detect malicious behavior using particle swarm optimization-based probabilistic neural network. In the first phase of the recognition task, the user’s behavior was meaningfully transformed into an easy form and classified and detected the malicious attacks by exploiting a multi-layer neural network. The implementation of the deep learning approach provided effective dealing with high dimensionality problems and also increased the intra-class similarity of samples. The developed system effectively detected the malicious behavior in the network, but it failed to provide an ideal recognition system with the utilization of abundant features and fewer samples. Moreover, the method had a high computational cost. Samriya and Kumar [2] designed a new hybridization technique called fuzzy-based artificial neural network to enhance the overall performance of the cloud environment. An effective clustering of attacks was performed using fuzzy-based artificial neural network, while the fuzzy-based clustering was optimized using spider-monkey optimization. The major intention of the hybridization method was to address the iterative classification and to automatically update the fitness function. The developed spider-monkey optimization algorithm reduced the dimensionality size and considerably decreased the computational time. This method achieved an error value, which affects the intrusion detection process. Praise et al. [3] developed an effective method for blocking the malicious behavior by ensuring the payload signature of receiving data using reinforcement learning and pattern matching, which was derived by integrating the features of reinforcement learning and fast pattern matching. Here, the reinforcement learning method effectively performed the payload signature in a parallel way. The developed reinforcement learning and pattern matching framework effectively detected different malicious behavior and prevented the cloud environment. Though the method achieved high throughput, the implementation cost of this method was high. Aldribi et al. [4] modeled a hypervisor-based cloud IDS that exploited online multivariate statistical change analysis to identify malicious behavior. Here, the detection capability was increased by exploiting the correlated and individual behaviors of instances. The developed method was efficient and feasible. The major obstacle of this method was high computational complexity.
Wei et al. [5] designed an IDS model that relied on an ensemble support vector machine with bag mapping. More importantly, the sample structures were partitioned into bags and sample flows in each bag were corresponding to each other. Every individual bag was comprised of various related data flows that reflected the malicious attacks, particularly continuous intrusion. The experimental results proved that the method achieved high precision and recall rate for continuous attacks. Moreover, the method had better generalization ability. However, the method failed to provide better accuracy with a large dataset. Nathiya and Suseendran [6] developed an efficient security model using hybrid IDS. Here, the framework of the virtual network layer was divided into four layers, such as node layer, cloud cluster layer, virtual machine layer, and cloud layer. In addition, the cloud layer utilized a “correlation module to identify the distributed attacks, and a Dempster-Shafer Theory” was adopted to provide the final decision in IDS to enhance its performance. This method improved the detection accuracy but the processing time for the detection process was high. Jaber and Rehman [7] developed an IDS that merged a Fuzzy C-means Clustering (FCM) algorithm with SVM to enhance the accuracy of the detection model. The developed model consisted of three phases, such that the first stage introduced the FCM clustering set that was utilized to divide large datasets into small clusters. In the second phase, various SVM was trained with respect to allocated cluster values, whereas the third phase combined the results of the hypervisor inspector. The developed mechanism was highly suitable for identifying different intrusions with high accuracy and also the method had low computational cost. The developed method produced false alarm rates that produce misuse problems. Ravindranath et al. [8] modeled an IDS model named Whale Pearson hybrid feature selection wrapper for minimizing the irrelevancy. The developed method can be combined with other optimization algorithms to improve the accuracy level.
Adopted hybrid deep learning method for malicious behavior detection in cloud computing
Cloud model
This section describes the cloud model [10] and security is the most crucial thing for wide applications of cloud systems and detection of such cyber-attacks on the cloud environment is very significant for preserving the cloud infrastructures. Nevertheless, it is very hard to detect malicious behavior on cloud platforms because of dynamic and complex behavior of cloud platforms. Moreover, the access from different mobile smart devices to cloud platforms maximizes the complexity of attack detection. In this cloud model, there are various components utilized for detecting the presence of malicious behavior cloud users, firewall, router, and processing servers. A cloud offers both storage services as well as computational and storage services to its users and such users may consist of home users, enterprise users, and mobile users. Cloud users exploit cloud resources and services through certain access points that are effectively handled by the cloud. The purpose of a firewall is to effectively redirect the user traffic to guarantee privacy by proper estimation and filtering process before reaching the destination point. In addition, the router in the model detects any malicious packet depending on the IP address. The main computational tasks like conversion of raw data into high-level context, context collaboration, and generation of context-aware service are filtered and assigned to various cloud processing servers. The heavy data traffic can be encrypted using processing servers and it outputs the data from malicious behavior. Figure 1 portrays the system model of the cloud for malicious behavior detection in a cloud environment.
Cloud system model for malicious behavior detection.
The major objective of this method is to establish a competent technique to identify the malicious behavior in cloud computing area. Initially, the nodes are simulated in the cloud network and input data obtained from the dataset specified in [15, 16] is fed into the feature selection process, where the appropriate features are chosen by adopting the wrapper selection technique. Thereafter, the malicious behavior is effectively detected using deep learning techniques, such as HAN and RMDL. Here, the network classifiers are separately trained using MFC and the proposed MFC is derived by the combination of multi-verse optimizer [13] and fractional calculus [14]. Finally, the results from both the classifiers are fused together using Hausdorff distance, which effectively detects the malicious behavior present in the cloud network. Figure 2 shows the schematic diagram of the adopted MFC-based hybrid deep learning model.
Structural diagram of adopted multiverse fractional calculus (MFC) based hybrid deep learning model.
Consider training dataset as
where
The input data
a) Wrapper method
Figure 3 demonstrates the diagrammatic model of the wrapper method. The effective feature subset selection [17] is done using wrapper approach in order to search a good subset. The process of searching is begun in the space of possible functions. Here, the search space needs a state space, an initial state, a termination criterion, and a search engine. Each state illustrates a feature subset in the search space organization. For
Schematic model of wrapper method.
The selected feature
Fusion process using Hausdorff distance
The fusion process is process in malicious behavior detection, where the output from two network classifiers like HAN and RMDL are combined together to generate a final outcome that identifies the existence of malicious behavior in a cloud environment. The fusion process is mainly selected to achieve higher reliability with a high detection rate. For this purpose, Hausdorff distance is used, which is a non-linear operator that determines the mismatch of the two sets and it is expressed as,
where
The Hausdorff distance determined between HAN output
The result obtained from feature selection process
i) Structure of HAN
HAN [11] is a specific type of neural network that captures the malicious behavior present in the network easily by presenting two significant characteristics, such as hierarchical structure and two-level attention mechanisms. The overall structure of HAN consists of layers, like the input layer, bidirectional (GRU) layer, dense layer, attention layer, dropout layer, and output layer. The HAN is trained for two datasets, like BOT-IoT and the KDD cup 99 datasets. By considering the BOT-IoT, the input layer is fed with a data of dimension
On the other hand, the steps followed by HAN while considering the KDD cup 99 are explained as follows: The input data with dimension size of
The GRU utilizes a gating procedure to update the state of sequences without exploiting separate memory cells. There are two kinds of gates, such as reset gate and update gate. Both reset and update gate tracks the updating mechanism of information to the state. At the time
This is a linear interpolation among the preceding state
where
where
Structural model of Hierarchical Attention Network (HAN).
ii) Training HAN by exploiting adopted MFC
Multi-verse optimizer is a stochastic population-based algorithm, which inspires the concept of multi-verse in physics. The word multi-verse refers to the opposite of the universe, which specifies the presence of a different universe. In a multi-verse concept, a number of universes meet each other and three major concepts are adopted in this multi-verse theory, black holes, white holes, and wormholes. Typically, objects are permitted to move from side to other with the help of white or black hole passages. If a white or black hole is developed among two planets, the planet with maximum and minimum inflation value is assumed to have a white hole and a black hole, respectively. The objects are moved from the white hole of the origin universe to the black hole of another universe. The important rules applied in multi-verse optimizer are illustrated as follows: If inflation value is high, then probability of having a white hole is high. Similarly, if inflation value is low, the probability of having a black hole is low. In other terms, planets with maximum inflation value are capable to transfer items by means of white holes, whereas universes with minimum inflation rate are to obtain more objects by means of black holes. Sometimes there may be a chance of facing random movement by all the objects in the universe through wormholes. Here, MFC is derived from the combination of the fractional calculus concept with multi-verse optimizer.
Fitness function
The fitness value is used to establish the best solution for malicious behavior detection and it is expressed as,
where
The algorithmic procedure of the proposed multiverse fractional calculus (MFC)
The algorithmic steps followed in the adopted MFC for malicious behavior detection using HAN are explained as follows:
Step 1: Initialization
Consider population of the universes with a number of parameters and it is represented as,
where
where
Step 2: Calculate fitness function
The fitness parameter is determined in order to obtain optimal solution by exploiting already specified Eq. (7).
Step 3: Roulette wheel selection model
The choosing process and estimation of white holes are performed using a roulette wheel that is completely dependent upon normalized inflation measures. When the inflation value is less, the probability of transmitting items through white or black hole tunnels is high. The exploration phase can be ensured by exploiting this roulette wheel selection process since the universes are needed to maintain the trade-off between the objects and meet sudden changes in order to investigate search space. By employing the roulette wheel selection process, the universes are able to trade off objects without any disruptions. To handle the heterogeneity of universes effectively and to execute the exploitation mechanism, it is necessary to assume that each planet possesses wormholes to exchange its objects through space uniformly. It may be noted that the wormholes unevenly change the universe’s items without considering their inflation values. The probability of having a high inflation rate is achieved by establishing a tunnel between the universe and the best universe created. The computation of roulette wheel mechanism is represented as below,
Subtracting
Fractional calculus is a branch of mathematics and it plays an essential part in enhancing the performance of a number of methods like curve fitting, modeling, pattern matching, filtering, and edge identification. However, fractional calculus handles the integral and derivative problems effectively. From fractional calculus, it is observed that it provides smoother changes and a higher memory effect. By incorporating the concept of fractional calculus into multi-verse optimizer, the equation obtained is expressed as,
Therefore, the updated equation of this roulette mechanism is expressed as follows,
where
Step 4: Determine the coefficients
Here, 2 main coefficients are considered namely wormhole existence probability
where
Step 5: Termination
The process is repeated until best solution is attained and also it fulfills the condition. Algorithm 1 describes the pseudocode of adopted MFC for malicious behavior detection. Figure 5 demonstrates flowchart of adopted MFC.
Flowchart of proposed multiverse fractional calculus (MFC).
iii) Proposed MFC based RMDL for malicious behavior detection
The extracted feature
a) Structure of RMDL
RMDL [12] architecture is comprised of three basic deep learning structures in parallel, such as Deep Neural Networks (DNN), Recurrent Neural Networks (RNN), and a Convolutional Neural Network (CNN) model. Figure 5 portrays the structural model of RMDL.
DNN
DNN architecture is developed to understand the multi-connection layers such that an individual layer only gains joints from the preceding state and offers connection to the next layer in a hidden unit. The input is a set of features with an initial hidden layer for all random schemes, while the output layer is comprised of numerous classes for multi-class categorization and only one result is utilized for binary categorization. Moreover, DNN is a discriminatively trained system that exploits a back-propagation algorithm utilizing sigmoid and ReLU as an activation parameter, which is expressed as follows,
The output obtained from DNN is called as
RNN
RNN allocates more weights to earlier data of sequence. In RNN, it assumes the data of preceding nodes in a sophisticated way that permits semantic evaluation of dataset structure in a better way.
where
Long Short Term Memory (LSTM)
LSTM is a kind of RNN that is exploited to protect long-term relevancy efficiently when compared to classical RNN. This network is highly utilized to address the vanishing gradient issue. LSTM is somewhat similar to that of RNN, which is a chain-like structure that exploits different gates to handle massive data. The LSTM cell procedure is stated as below:
where
Gated Recurrent Unit (GRU)
It is a gating process for RNN that is comprised of 2 gates. GRU does not contain internal memory, and formulation for GRU cells is stated as below:
where
where
CNN
The last deep learning model that serves RMDL is CNN, which is mostly exploited for classification purposes. Generally, an image sensor is transformed with a group of kernels size
Architectural model of RMDL.
b) Training of RMDL using adopted MFC
The RMDL classifier is trained to utilize same developed MFC algorithm that is utilized for training purposes of the HAN. A detailed explanation of steps followed in the algorithm of MFC is given under Section 4.2.1.
Fitness function
The fitness parameter is used to calculate optimal solution for malicious behavior detection, which is the difference amid the target value and the result produced from the RMDL classifier and it is represented as,
where
This section describes the result and analysis of adopted MFC-based hybrid deep learning regarding the evaluation metrics by changing training data.
Experimental setup
The experimentation of the developed MFC-based hybrid deep learning model is performed in the “PYTHON tool with Intel core i-3 processor, windows 10 OS with 4 GB RAM”.
Dataset description
The dataset used in the adopted MFC-based hybrid deep learning approach is “KDD cup 99 (dataset 1), and BOT-IoT (dataset 2)”.
KDD cup 99
KDD cup 99 [15] is the most commonly utilized dataset for the assessment of anomaly detection techniques and this dataset contains approximately 4,900,000 single connection vectors each of which consists of 41 features and is considered as either normal behavior or malicious behavior.
BOT-IoT
The BoT-IoT dataset [16] is developed by designing a realistic network platform in the cyber range lab of UNSW Canberra and this dataset consists of DDoS, DoS, OS, keylogging, and data exfiltration attacks.
Evaluation measures
The performance improvement of the developed MFC-based hybrid deep learning approach is estimated by evaluation measures, such as sensitivity, testing accuracy, and specificity.
Testing accuracy
Testing accuracy is described as the degree of closes value to true measure and it is represented as,
where
Sensitivity is termed as the test’s ability to detect malicious behavior in cloud environment and it is stated as,
Specificity is the test’s ability to detect the presence of normal behavior in a cloud computing environment and it is expressed as,
This section explains comparative evaluation of the proposed MFC-based hybrid deep learning approach by considering with attack and without attack scenarios for two datasets, such as KDD cup 99 and BOT-IoT. The performance enhancement of the developed MFC-based hybrid deep learning model is evaluated and compared with the traditional methods like Reinforcement learning and Pattern matching [3], Ensemble SVM [5], and FCM-SVM [7].
Analysis by dataset 1 for without attack scenario.
Figure 7 represents the evaluation of the without attack scenario for dataset 1 regarding the performance measures by varying the training data percentage. Figure 7a demonstrates evaluation of testing accuracy regarding training data. By changing the training data to 90%, the testing accuracy obtained by the developed MFC-based hybrid deep learning model is 0.939, while conventional models attained testing accuracy of 0.779 for reinforcement learning and pattern matching, 0.846 for Ensemble SVM, and 0.902 for FCM-SVM. The developed scheme has the performance enhancement of 17.077%, 9.942%, and 3.977% than of existing models, like reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM.
The assessment of sensitivity is exhibited in Fig. 7b. If training percentage is 60%, the developed MFC-based hybrid deep learning model attained a sensitivity of 0.904, whereas the sensitivity obtained by the proposed approach is 0.949 for the training data percentage is 90% that resulting in the performance improvement of the adopted MFC-based hybrid deep learning model when compared it with classical methods, such as reinforcement learning and pattern matching is 8.556%, Ensemble SVM is 3.200%, and FCM-SVM is 2.468% for training data percentage is 90%.
Figure 7c portrays evaluation of specificity regarding training percentage. If training data is 60%, the specificity yielded by the adopted MFC-based hybrid deep learning approach is 0.836, where conventional models obtained specificity of 0.713 for reinforcement learning and pattern matching, 0.743 for Ensemble SVM, and 0.818 for FCM-SVM. The performance improvement of the adopted MFC-based hybrid deep learning approach by comparing it with that of traditional techniques like reinforcement learning and pattern matching is 17.131%, Ensemble SVM is 11.430%, and FCM-SVM is 5.305% for training data percentage is 90%.
Analysis utilizing dataset 1 with attack
Figure 8 exhibits evaluation of with attack scenario for dataset 1 with respect to evaluation metrics by changing training data. Figure 8a exhibits evaluation of testing accuracy. While training data is 90%, testing accuracy attained by the adopted MFC-based hybrid deep learning approach is 0.939, while existing techniques obtained testing accuracy for reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 0.814, 0.844, and 0.882, respectively. The proposed MFC-based hybrid deep learning approach shows performance development by evaluating it with the traditional techniques such as reinforcement learning and pattern matching is 13.226%, Ensemble SVM is 10.026%, and FCM-SVM is 5.993%.
Figure 8b represents assessment of sensitivity by varying training data percentages from 60% to 90%. By varying training data percentage to 90%, sensitivity obtained by the developed MFC-based hybrid deep learning approach is 0.949 that outcomes of performance improvement of the developed model with that of existing schemes, like reinforcement learning and pattern matching are 14.669%, Ensemble SVM is 9.937%, and FCM-SVM is 4.506%.
The analysis of specificity regarding training data is illustrated in Fig. 8c. If the training data is 90%, the adopted MFC-based hybrid deep learning approach obtained specificity of 0.911, whereas conventional methods obtained a specificity of 0.772 for reinforcement learning and pattern matching, 0.811 for Ensemble SVM, and 0.875 for FCM-SVM. The proposed MFC-based hybrid deep learning model shows the performance enhancement of 15.307%, 11.042%, and 3.963% than the conventional techniques, such as reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM.
Analysis using dataset 1 for with attack scenario.
Figure 9 specifies assessment of the without attack scenario for dataset 2 with respect to evaluation metrics by changing the training data percentage. Figure 9a illustrates the evaluation of testing accuracy for dataset 2. If training data is 90%, testing accuracy produced by the adopted approach is 0.932 over traditional approaches, like reinforcement learning is 8.990%, Ensemble SVM is 5.664%, and FCM-SVM is 2.262%. Nevertheless, the testing accuracy attained by existing techniques like reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 0.848, 0.879, and 0.911.
Figure 9b represents the evaluation of sensitivity by increasing training data from 60% to 90%. By considering the training data as 60%, the sensitivity attained by the adopted MFC-based hybrid deep learning model is 0.895 and for training data percentage of 90% is 0.944 shows performance development of the adopted scheme with that of conventional techniques such as reinforcement learning and pattern matching is 8.688%, Ensemble SVM is 4.224%, and FCM-SVM is 2.684%. The sensitivity attained by existing techniques, such as reinforcement learning and pattern matching is 0.862, Ensemble SVM is 0.904, and FCM-SVM is 0.918.
The analysis of specificity is depicted in Fig. 9c. The specificity achieved by the developed MFC-based hybrid deep learning approach is 0.929 while comparing with the traditional techniques like reinforcement learning and pattern matching is 12.735%, Ensemble SVM is 6.030%, and FCM-SVM is 2.787%. Nevertheless, specificity acquired by traditional schemes, like reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 0.811, 0.873, and 0.903.
Analysis using dataset 2 for without attack scenario.
Analysis by exploiting dataset 2 for with attack scenario.
Figure 10 represents assessment of with attack scenario for dataset 2 with respect to evaluation metrics by changing training data. Figure 10a exhibits evaluation of testing accuracy. If the training data percentage is increased to 90%, testing accuracy obtained by the developed MFC-based hybrid deep learning approach is 0.923, while the conventional approaches attained testing accuracy of 0.768 for reinforcement learning and pattern matching, 0.827 for Ensemble SVM, and 0.898 for FCM-SVM.
Figure 10b exhibits the evaluation of sensitivity by changing the training data percentage from 60% to 90%. If training data as 60%, sensitivity attained by the developed MFC-based hybrid deep learning model is 0.888 results the performance development of the developed scheme with that of traditional techniques such as reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 18.619%, 11.733%, 3.183%, respectively.
The assessment of specificity is depicted in Fig. 10c. By considering training data percentage as 90%, the specificity obtained by the adopted MFC-based hybrid deep learning approach is 0.905, when compared it with the conventional techniques, such as reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM, is 19.723%, 12.153%, and 3.562%. Nevertheless, specificity attained by conventional models, such as reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM are 0.727, 0.795, and 0.873.
Receiver operating characteristics curve (ROC)/area under curve (AUC) analysis
Figure 11 demonstrates the Receiver operating characteristics curve (ROC)/area under curve (AUC) analysis of proposed and conventional models for with and without attack for dataset 1 and 2. It is analyzed by true positive rate and false positive rate. The AUC is area covered by ROC curve. In Fig. 11a, the AUC value of the existing methods, like reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 0.884, 0.846, 0.833 and the proposed method value is 0.923. For Fig. 11b, the AUC value of the existing methods, like reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 0.798, 0.852, 0.832 and the proposed method value is 0.933. In Fig. 11c, the AUC value of the existing methods, like reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 0.891, 0.86, 0.834 and the proposed method value is 0.92. For Fig. 11b, the AUC value of the existing methods, like reinforcement learning and pattern matching, Ensemble SVM, and FCM-SVM is 0.826, 0.85, 0.8 and the proposed method value is 0.9.
Comparative discussion
Table 1 summarizes the comparative analysis of the developed MFC-based hybrid deep learning approach. From the discussion, it is vivid that proposed MFC-based hybrid deep learning approach provides superior outcomes while comparing with the classical approaches. The proposed MFC-based hybrid deep learning approach has attained an utmost testing accuracy of 0.939, utmost sensitivity of 0.949, and utmost specificity of 0.947.
Comparative analysis
Comparative analysis
AUC-ROC curve analysis of proposed and conventional models.
In recent years, utilization of cloud computing has been growing very fast and due to its sophisticated services, the malicious attack in the environment is also growing exponentially due to third-party attacks. To alleviate such security breaches, an efficient method is proposed using hybrid deep learning and fusion approach. The proposed approach consists of three phases, such as cloud simulation, feature selection, and malicious behavior detection. At first, the cloud environment is simulated and then the input data is subjected to a feature selection process, where the relevant features are chosen through a feature selection process by exploiting a wrapper-based model. The malicious behavior detection is carried out by exploiting hybrid deep learning classifiers, like Hierarchical Attention Network (HAN), Random Multimodel Deep Learning (RMDL) and each of them is separately trained by proposed Multiverse Fractional Calculus (MFC). Nevertheless, adopted MFC is derived by incorporating the fractional calculus concept into multi-verse optimizer. The proposed MFC-based hybrid deep learning model has attained an utmost testing sensitivity of 0.949, accuracy of 0.939, and specificity of 0.947 for without attack scenarios while considering dataset 1. The future work would be the inclusion of some other optimization approaches with other deep learning networks that further enhances the detection accuracy.
Footnotes
Author’s Bios
India (CSI), Life Member of Indian Society for Technical Education (ISTE), Life Member of IETE. He has attended various Refresher Courses FDP, QIP organized by IIT Delhi, Jamia Millia Islamia, Jamia Hamdard, AICTE and other institutes.
