Figure 1.
An attack scenario on a device in the network.
In this paper, we propose a stochastic SIHR epidemic model of COVID-19. A basic reproduction number Rs0 is defined to determine the extinction or persistence of the disease. If Rs0<1, the disease will be extinct. If Rs0>1, the disease will be strongly stochastically permanent. Based on realistic parameters of COVID-19, we numerically analyze the effect of key parameters such as transmission rate, confirmation rate and noise intensity on the dynamics of disease transmission and obtain sensitivity indices of some parameters on Rs0 by sensitivity analysis. It is found that: 1) The threshold level of deterministic model is overestimated in case of neglecting the effect of environmental noise; 2) The decrease of transmission rate and the increase of confirmed rate are beneficial to control the spread of COVID-19. Moreover, our sensitivity analysis indicates that the parameters β, σ and δ have significantly effects on Rs0.
Citation: Tianfang Hou, Guijie Lan, Sanling Yuan, Tonghua Zhang. Threshold dynamics of a stochastic SIHR epidemic model of COVID-19 with general population-size dependent contact rate[J]. Mathematical Biosciences and Engineering, 2022, 19(4): 4217-4236. doi: 10.3934/mbe.2022195
| [1] | Arjumand Seemab, Mujeeb ur Rehman, Jehad Alzabut, Yassine Adjabi, Mohammed S. Abdo . Langevin equation with nonlocal boundary conditions involving a ψ-Caputo fractional operators of different orders. AIMS Mathematics, 2021, 6(7): 6749-6780. doi: 10.3934/math.2021397 |
| [2] | Dinghong Jiang, Chuanzhi Bai . On coupled Gronwall inequalities involving a ψ-fractional integral operator with its applications. AIMS Mathematics, 2022, 7(5): 7728-7741. doi: 10.3934/math.2022434 |
| [3] | Weerawat Sudsutad, Chatthai Thaiprayoon, Aphirak Aphithana, Jutarat Kongson, Weerapan Sae-dan . Qualitative results and numerical approximations of the (k,ψ)-Caputo proportional fractional differential equations and applications to blood alcohol levels model. AIMS Mathematics, 2024, 9(12): 34013-34041. doi: 10.3934/math.20241622 |
| [4] | Weerawat Sudsutad, Jutarat Kongson, Chatthai Thaiprayoon, Nantapat Jarasthitikulchai, Marisa Kaewsuwan . A generalized Gronwall inequality via ψ-Hilfer proportional fractional operators and its applications to nonlocal Cauchy-type system. AIMS Mathematics, 2024, 9(9): 24443-24479. doi: 10.3934/math.20241191 |
| [5] | Qi Wang, Shumin Zhu . On the generalized Gronwall inequalities involving ψ-fractional integral operator with applications. AIMS Mathematics, 2022, 7(11): 20370-20380. doi: 10.3934/math.20221115 |
| [6] | Qing Yang, Chuanzhi Bai, Dandan Yang . Finite-time stability of nonlinear stochastic ψ-Hilfer fractional systems with time delay. AIMS Mathematics, 2022, 7(10): 18837-18852. doi: 10.3934/math.20221037 |
| [7] | Weerawat Sudsutad, Chatthai Thaiprayoon, Sotiris K. Ntouyas . Existence and stability results for ψ-Hilfer fractional integro-differential equation with mixed nonlocal boundary conditions. AIMS Mathematics, 2021, 6(4): 4119-4141. doi: 10.3934/math.2021244 |
| [8] | A.G. Ibrahim, A.A. Elmandouh . Existence and stability of solutions of ψ-Hilfer fractional functional differential inclusions with non-instantaneous impulses. AIMS Mathematics, 2021, 6(10): 10802-10832. doi: 10.3934/math.2021628 |
| [9] | Thabet Abdeljawad, Sabri T. M. Thabet, Imed Kedim, Miguel Vivas-Cortez . On a new structure of multi-term Hilfer fractional impulsive neutral Levin-Nohel integrodifferential system with variable time delay. AIMS Mathematics, 2024, 9(3): 7372-7395. doi: 10.3934/math.2024357 |
| [10] | Choukri Derbazi, Zidane Baitiche, Mohammed S. Abdo, Thabet Abdeljawad . Qualitative analysis of fractional relaxation equation and coupled system with Ψ-Caputo fractional derivative in Banach spaces. AIMS Mathematics, 2021, 6(3): 2486-2509. doi: 10.3934/math.2021151 |
In this paper, we propose a stochastic SIHR epidemic model of COVID-19. A basic reproduction number Rs0 is defined to determine the extinction or persistence of the disease. If Rs0<1, the disease will be extinct. If Rs0>1, the disease will be strongly stochastically permanent. Based on realistic parameters of COVID-19, we numerically analyze the effect of key parameters such as transmission rate, confirmation rate and noise intensity on the dynamics of disease transmission and obtain sensitivity indices of some parameters on Rs0 by sensitivity analysis. It is found that: 1) The threshold level of deterministic model is overestimated in case of neglecting the effect of environmental noise; 2) The decrease of transmission rate and the increase of confirmed rate are beneficial to control the spread of COVID-19. Moreover, our sensitivity analysis indicates that the parameters β, σ and δ have significantly effects on Rs0.
A network can be seen as a tangible manifestation of interconnected components. When comparing industrial networks to social networks, communication networks, or electrical networks, it becomes apparent that the entities involved in industrial networks are active participants in economic processes. These networks play a vital role in converting raw materials into the end products and services that are ultimately consumed by the public [1,2]. Consequently, the relationships between actors within industrial networks are often conceptualized through financial transactions that occur within the framework of long-term partnerships. These interconnected links are what make industrial networks viable and successful [3,4]. Typically, networks are utilized for data transfer, and certain networks are better suited for handling specific data volumes. Industrial networks enable the connection of various devices over long distances, facilitating communication between them by efficiently transmitting and receiving substantial volumes of data [5]. Therefore, the number of internet-connected devices in industrial settings has experienced a recent increase, primarily driven by emerging technologies in Internet of Things (IoT) networks [6]. While these technologies make administrative tasks easier, they also face the challenge of cyber attacks. One such system commonly used in industrial environments is Supervisory Control and Data Acquisition (SCADA) [7]. Sodinokibi, an affiliate of REvil, launched a Stuxnet [8] attack against Acer, while the Darkside cyber-criminal organization launched an attack against Colonial Pipeline [9].
Recently, hackers have been targeting not just traditional commercial networks but also industrial networks[10]. Twenty-one lines of code were demonstrated by the US government in 2007 as a potential means of damaging a power plant generator [11]. To render an out-of-phase generator, unless the attackers connected and disconnected it from the grid on a regular basis [12]. More than 80, 000 people in Ukraine were left without electricity after cyber-criminals hijacked the networks of two power distribution companies in late 2015 and early 2016 [13]. Hackers got into a German steel firm in 2015 and tampered with a blast furnace, severely damaging the plant [14]. An attack scenario is illustrated in Figure 1. These attack scenarios show that traditional systems cannot be adequately protected using standard security methods. Consequently, cyber security is increasingly becoming an inherent component of today's industrial networks [15].
Numerous security solutions, such as intrusion detection systems (IDS) based on machine learning (ML) and deep learning (DL) models [16], have been proposed by several research studies to protect industrial networks from both known and unknown (zero-day) attacks[17]. An IDS is software that monitors the network for any suspicious activities, like a failed network intrusion attempt or the use of a hacked account [18]. An IDS is considered to be the most effective form of security because it is designed to identify intrusions by spotting unusual anomalies in sensor data or actuator activity [19]. Hence, an IDS plays a crucial role in preserving the security of industrial networks [20].
There are a number of problems with the current batch of IDSs [21], such as poor detection rates, excessive false positives, and sluggish real-time functionality during attempted impersonations [22]. Due to insufficient security solutions, the attacker breaks the firewall to attack the networks, which results in a huge loss of confidential data of the industrial networks. They either sneak into the network and snitch the sensitive information without making any changes, or they obtain unauthorized access and modify the confidential data by encrypting, deleting, or tampering with it, thus, badly damaging the industrial network. The detection of malicious attacks in industrial networks is crucial, as these attacks can result in system failures, network disruptions [23], data damage, or the theft of confidential information [24]. Thus, enhancing the security of industrial networks necessitates the creation of reliable and efficient systems for detecting anomalies, based on continuous monitoring of the actual state of the system.
To automatically detect malicious attacks in real-time, DL algorithms exhibit a superior performance compared to traditional ML algorithms, particularly when handling large amounts of data[25]. DL is highly effective in detecting zero-day attacks and achieving a high detection rate [26], as it has the capability to automatically identify correlations within the data [27]. Therefore, in this study, DL algorithms convolutional neural networks (CNN) and deep belief networks (DBN) are used to develop an IDS which specifically meets the requirements of industrial network security. To improve detection rates while lowering training and generalization errors, we have proposed an integrated intrusion detection model that comprises three layers namely CNN, DENSE, and DBN. The reason for choosing CNN and DBN for IDS is due to their superior performance compared to other ML and DL methods [28]. The results show that the proposed model offers an optimal performance within a shorter time frame when compared to other models.
With the rise of interconnected networks, industrial networks are now relying on the vast amount of information available online. However, increasing integration has left industrial network security exposed to a variety of cyberattacks [29]. As such, it is imperative to integrate measures to detect these potential attacks and establish defense mechanisms [30]. One of the most effective solutions is the use of IDSs.
These systems keep an eye out for any suspicious behavior on a network and can spot intrusions by seeing potentially harmful abnormalities in sensor data or actuator activity [19]. The primary goal of this research study is to develop an improved model for IDSs that provides optimal accuracy rates and enhances the performance of evaluation measures used in experiments [31].
The use of ML and time series-based anomaly detection methods in [32] helps in monitoring industrial operations data present in networks for signs of cyber-attacks. The data analyzed include Modbus-based gas pipeline control traffic and OPC UA-based batch processing traffic. The resulting accuracy of 90.8% is slightly worse than before. The F1-score is doing quite well with a 94.9% recall. The algorithms still work well, despite a large amount of missing data in this dataset. In actual use, this will allow attacks on industrial networks to go undetected, which is a major security risk. To improve safety, more resources are needed.
The knowledge distillation triplet convolution neural network (KD-TCNN) model was developed to enhance the performance of IDS in industrial CPS. The proposed model reduces the computational cost and size by 86% while maintaining a 0.4% drop in accuracy compared to the current model. To process and analyze huge volumes of data and comprehend the relationships between categories in the teacher network, knowledge distillation aims to make the student network's outputs identical to those of the teacher network. To perform an efficient detection of intrusion, the model must undergo two stages of training: first, the preliminary training of the teacher model, and second, the training of the KD-TCNN model. To bridge the gap between similar inputs for knowledge distillation, deep metric learning is applied, which improves the performance of the student model [33].
The data from the Integrated Automation lab's process control plant was utilized to gather metrics pertaining to ICS. CNNs were employed to assess the efficiency of detecting injection attacks. A three-layer CNN architecture with rectified linear activation unit (ReLU) activation and a SoftMax classification layer was constructed to distinguish between benign and malicious data. The proposed CNN model's efficacy was gauged through a range of metrics such as F1-score, accuracy, recall, precision, and Cohen's kappa coefficient. In terms of performance, CNN demonstrated a superiority over other deep learning algorithms. However, the outcome depends on the program and data utilized. By combining various DL and ML techniques, the effectiveness of the security mechanism can be further improved. Alternative DL techniques such as recurrent neural networks (RNN) can also be employed [34].
The intrusion detection system based on CNN has the capability to identify different attack types, which were evaluated using datasets such as Network Security Laboratory-Knowledge Discovery and Data Mining (NSL-KDD) and University of New South Wales-Network Behavior 15 (UNSW-NB 15). Performance indicators such as recall, F1-score, and precision, were calculated and contrasted to those of other DL techniques. A CNN has been tested on the NSL-KDD and UNSW-NB 15 datasets for intrusion detection, resulting in an improved detection accuracy when compared to previous CNN-based methods. However, when it came to classifying attacks with multiple classes, the CNN did not perform better than other DL-based IDSs, such as SAE and DBN. For a more specific and accurate development, creating a dataset within the ICS context should be considered. MATLAB can be used to capture real-time network traffic data and DL algorithms can then be applied to this network for enhanced results [35].
The use of a Stacked Auto-encoder (SAE) combined with a CNN can reduce high-dimensional data to generalizations and essential characteristics that describe the machine tool's operating state. The process begins with the use of an unsupervised SAE for generic feature extraction from industrial process data. The proposed model's effectiveness in the updated production line is then validated by fine-tuning a one-dimensional CNN classifier with supervised data. It is evident from the experimental results that the proposed model is a potent and versatile solution for monitoring machine tool production data, minimizing the complexity features with high-dimensional, and having positive economic impacts on the industry [36].
A proposed model for SCADA [37] network data detection has been suggested as a means of creating a secure architecture for ICS networks. The proposed architecture creates two ensemble-based detection methods by combining a DBN with a conventional classifier, such as a support vector machine (SVM). The results of the experiments support the effectiveness of the proposed DBN ensemble approach in addressing the DBN structure selection problem and providing dependable attack detection for the secure operation of SCADA systems. However, the approach has some limitations, including using a neural network (NN)-based classifier within the DBN framework. Although DBNs are effective in extracting features from raw data, the NN-based classifiers they use can limit their pattern recognition precision. Additionally, the proposed training method for the DBN is not designed for real-time situations [38].
A proposed method for diagnosing intrusions in industrial robots, based on joint DBN information fusion technology, addresses the limitations of the traditional fault diagnosis model. These limitations include low precision, inefficiency, instability, and a slow time-to-diagnosis in cases of multiple faults. To test the method, the researchers chose an industrial robot with a problem in one of its joint bearings. The results showed that the developed fault diagnostic approach is effective, with a test set accuracy of 97.96%. The proposed method has several advantages over the traditional diagnostic model, including a faster diagnosis time and an improved diagnosis efficiency, making it better suited for diagnosing multiple faults [39].
The detection of cyberattacks on SCADA-based industrial control systems (ICS) is addressed in a study that introduces the first-ever population extremal optimization (PEO)-based DBN network detection technique (PEO-DBN). To further improve the detection performance, a new ensemble learning strategy, called EnPEO-DBN, is proposed to combine the PEO-DBN approach. The simulation results depicted that the proposed PEO-DBN and EnPEO-DBN have superior performance compared to other methods and can be considered promising solutions for detecting cyberattacks on SCADA-based ICS. To speed up the fitness evaluation process, future work can take advantage of surrogate-assisted models, such as a Gaussian process regression or a Bayesian optimization [40].
As a means of securing IoT networks, [41] presented a hybrid DBN cyber intrusion detection system. In order to construct better attack detectors for network traffic, researchers have studied and addressed DBN's drawbacks. The results from the analysis are then integrated into a SoftMax Regression model to improve the security and accuracy of detection. The hybrid DBN model was trained and evaluated based on the original and unaltered dataset generated by the system. In terms of detecting and classifying intrusions, the suggested hybrid DBN model had a 99.72 % success rate. According to these findings, the model outperformed the current IDS. Further, the hybrid model offered a roughly 5% greater accuracy improvements compared to pre-hybrid DBN-based systems.
An interesting approach is used as a solution that aims to combine the strengths of two popular machine learning techniques: Long short-term memory (LSTM) and DBNs. By using LSTM to enhance the representation power of traditional shallow machine learning, and DBNs to extract non-linear components from the data, the researchers hope to achieve both high accuracy and high processing speed. The results of their approach appear to be promising, with recall rates as high as 97.3% and area under the curve (AUC) as high as 0.927, suggesting that this combination of techniques could be effective for solving complex problems in machine learning. However, as mentioned, this area of research is still being explored, and more work needs to be done to fully understand the trade-offs between precision, speed, and other factors when using this hybrid approach [42].
The KDD-98 dataset, produced by the "Defense Advanced Research Projects Agency's Knowledge Discovery and Data Mining program" in 1998, was the first publicly available intrusion detection dataset, though it contained flaws like duplicate records [43]. NSL-KDD, introduced in 2009, improved on KDD-98, though KDD-99 still had issues like outdated attack methods and inaccurate network parameters [43]. The Cooperative Association for Internet Data Analysis (CAIDA) dataset, introduced in 2007 had limited information on DDoS attacks [44]. The University of Brescia (UNIBS) database (2009) by Gringoli et al. focused on profiling popular web apps but was unsuitable for detecting anomalies [45]. The Information Security Centre of Excellence (ISCX) 2012 dataset by Shiravi et al. had two network configurations (α and β) but lacked Hypertext Transfer Protocol Secure (HTTPS) protocol traffic [46]. DDoS 2016, released in 2016 by Alkassasbeh et al., was not useful for multi-step attack detection. The ADFA Linux (ADFA-LD) and ADFA Windows Datasets (ADFA-WD) were created using system call traces, but attackers can hide their tracks. Canadian Institute for Cybersecurity Intrusion Detection System (CIC-IDS) 2017 had 80 network parameters from a five-day simulated test but had missing values and no information on multi-stage attacks. TUIDS, developed by Tezpur University, used a hybrid of packet and flow formats but couldn't simulate multi-step attacks.
The new Multi-Step Cyber Attack (MSCAD) [47] dataset overcomes the limitations of prior methods by serving as a new benchmark for IDS. The MSCAD stands out with its ability to detect complex, multi-stage attacks, which are carried out through a variety of techniques such as volume-based DDoS, site crawling, and network-based DDoS. This dataset is built on a full network infrastructure and contains no duplicates or missing data, making it ready for use in training IDS systems without any further cleaning [48]. The attributes of the MSCAD have been compared to those in the literature, including the dataset used, evaluation measures, k-fold validation, balancing strategy, and response time, as presented in Table 1.
| Author | Dataset | Evaluation measure | K-Fold validation | Balancing strategy | Response time |
| [32] | Modbus, OPC-UA | Accuracy, Precision, Recall, F-1 score | No | No | High |
| [38] | SCADA network | Accuracy, Precision | Yes | No | Medium |
| [39] | Industrial robot | Accuracy | No | No | Low |
| [40] | SCADA network | Accuracy | No | No | Medium |
| [35] | NSL-KDD, UNSW-NB15 | Accuracy, Precision, Recall, F-1 score | Yes | No | Medium |
| [34] | PCP from IAE | Accuracy, Precision, Recall, F-1 score | No | No | High |
| [41] | SCADA network | Accuracy, F-1 score | No | No | Medium |
| [33] | NSL-KDD, CIC-IDS 2017 | Accuracy, Precision, F-1 score | Yes | Yes | High |
| [42] | NSL-KDD | Accuracy, Precision, Recall, F-1 score | No | No | Medium |
| [36] | Collected data from industry production line | Accuracy | No | No | Medium |
| Proposed Model | Multi-step cyber attack dataset | Accuracy, Precision, Recall, F-1, G-mean score | Yes | Yes | Low |
DownLoad:
CSV
The following section comes up with a comprehensive overview of the proposed methodology. The data has undergone pre-processing and has been trained and tested. The diagram in Figure 2 showcases the general structure and flow of the model. The implementation involves the use of two DL algorithms, with a thorough explanation of how the CNN and DBN components are integrated into the proposed scheme.
There are several public network datasets available for intrusion detection, such as KDD-98, NSL-KDD [43], CAIDA [44], UNIBS [45], ISCX 2012 [46], DDos 2016, ADFA-LD and ADFA-WD, CIC-ID 2017, and TUIDS. This experiment makes use of the MSCAD [20] dataset for industrial networks, as it is the latest dataset available and features a variety of attack scenarios that are well-suited for detecting multi-step attacks, as demonstrated in Table 2.
| Classe | Encoding | Records |
| Brute force | 0 | 88, 502 |
| HTTP DDoS | 1 | 641 |
| ICMP flood | 2 | 45 |
| Normal | 3 | 28, 501 |
| Port scan | 4 | 11, 081 |
| Web crawler | 5 | 28 |
DownLoad:
CSV
Before analyzing a data set, it must undergo data cleaning, which consists of correcting or removing any incorrect, redundant, or otherwise undesired information. Data cleansing aims to remove ambiguity and other issues from your data. We must have clean data (i.e., information that our costly data analysis tools can process [49]).
Each dataset consists of many entries. Before training a model, inspecting a dataset for missing and undefined entries is essential. Training the model will produce errors if any data record includes an unexpectedly blank or undefined value. We should ensure that the dataset does not have any confusing data before training a model by cleaning it first. Several approaches [50,51] are available for removing redundant or unclear entries from data sets. The dataset was cleansed using Python libraries (Pandas and NumPy) [52] and functions that provide true or false Boolean values to test for missing and enduring values. If this is true, then some of the values in the dataset are missing or infinite; however, if it is false, then the cleaning of the dataset is completed. The datasets were cleaned by converting all undefined records into blank spaces. Once the undefined values were transformed, the dataset was further refined by removing all empty entries and replacing any remaining undefined values with empty ones.
To achieve numericalization, one must first construct a string-to-integer encoding system and then individually apply it to each string. Typically, the attributes or labels of the datasets we work with, are available throughout multiple columns. These labels can be composed of either words or numbers. Typically, training data is labeled with either a phrase that makes it understandable or in a human-readable format. The process of label encoding [53] involves transforming human-readable labels into a format that can be processed by computers. This allows machine learning [54] algorithms to make more informed decisions based on these labels and is an essential step in the preparation of structured datasets for supervised learning. The label encoder searches for labels ranging from zero to n-1 and gives numerical values to these labels. This experiment quantifies categorical attributes using the label encoder method.
During machine learning model training, data normalization reduces the impact of feature scales. Thus, our model can converge to accurate weights, therefore enhancing its accuracy. Normalization increases the model's capacity to predict outputs by bringing the features into a condition of homogeneity. The process of rescaling a numeric attribute with a real value to the interval 0 to 1 is what normalization means. This decreases the effect of the feature size on the training procedure [55]. Consequently, this leads to improved coefficients following the training. Normalization is a technique applied to datasets with varying value ranges, such as when one feature has values ranging from 0 to 1 and another has values ranging from 100 to 1000. This helps to equalize the data and makes it easier for the machine-learning model to be trained effectively.
The selected dataset in this experiment has features with varied range values; for example, some features have extremely high range values while others have extremely low range values. If we train the model using these variables, it will fail. This problem can be addressed by employing the normalization approach, which can be done by this equation to transform all non-zero values into one.
| Xnorm=X−XminXmax−Xmin | (3.1) |
The experiment's model is based on a dataset with a substantial number of records. Prior to training and testing the model, it's critical to guarantee that each class has the same amount of examples. This can be achieved through the use of balancing techniques such as oversampling and undersampling. Oversampling raises the minority class's percentage to the majority class, whereas undersampling decreases the majority class's share to match the minority class. However, oversampling can lead to overfitting because it involves repetitive data. The dataset used for this experiment was imbalanced, so we applied two balancing techniques, the Synthetic Minority Oversampling Technique (SMOTE) [56] and SMOTETomek, to ensure that the dataset was representative of the entire population.
SMOTE generates synthetic information using a k-nearest neighbor algorithm. The first phase of SMOTE involves randomly selecting data from the minority class and then determining those data's k-nearest neighbors. Then, the random data and the k-nearest neighbor are utilized to generate synthetic data. There is a version of the SMOTE called the Borderline-SMOTE. The name implies a connection to borders, which is indeed the case. In Borderline-SMOTE, synthetic data are generated only along the decision boundary between the two classes, whereas in SMOTE, they are generated randomly between the two classes [57]. The SMOTEENN and SMOTETomek sampling methods include oversampling (SMOTE) and undersampling (ENN, Tomek). SMOTE generates synthetic class samples to establish a statistical parity, whilst the latter is used to clean redundant information at the boundary of two classes to increase separation.
We have proposed an integrated intrusion detection model that is a combination of CNN and DBN. The proposed model contains three layers: CNN, DENSE, and DBN, which are depicted in Figure 2. All of the models utilized in the proposed model's layers are extensively explained for understanding. The model enhanced the performance for the detection of attacks [58] and reduced the response and training time in industrial networks.
Convolutional neural networks (CNNs) are a powerful tool for discovering features, as they reduce the need for human input[59]. The primary objective of CNN is to learn the most significant features of the input data [60]. A CNN is comprised of pooling layers, convolutional layers, and fully connected (FC) layers [61], which can be stacked to form a CNN architecture as illustrated in Figure 3. These layers also incorporate an activation function, which is a crucial aspect of their function [62]. The convolutional layer performs a mathematical operation, known as the convolution, between the input and a filter of size M×M to extract features from the input data. As the filter is moved over the input, the dot product of its M×M dimensions and the input is calculated, and the output is forwarded to the succeeding layer [63].
The pooling layer commonly comes after the convolutional layer, reduces the size of the feature matrix, expedites training, and minimizes the number of parameters to avoid the overfitting problem. The pooling layer typically follows the convolutional layer and serves to reduce the size of the feature matrix, speed up training, and reduce the number of parameters to prevent overfitting issues [64].
The neurons, weights, and biases in a fully connected (FC) layer play a significant role in establishing connections between the neurons of consecutive layers. These layers are usually the final ones to be added in a CNN architecture and precede the output layer. A significant aspect of CNN models is the activation function, which determines which pieces of information from the model should be forwarded to the output nodes and which should be disregarded, thereby making the network less linear. The activation functions in a CNN model are responsible for determining whether a neuron is activated or not [65].
The proposed model incorporates a DENSE layer for enhanced and expedited responses. This layer effectively combines CNN and DBN. The layer has 66 parameters on both the input and output sides. The ReLU (rectified linear activation unit) was utilized in this experiment. To better represent complicated relationships between the inputs and outputs of a neural network, the ReLU function transforms the linear function's output into a nonlinear one. The output of each neuron in a particular layer of a neural network is transmitted into the ReLU function. The output of the ReLU function is then utilized as the input for the subsequent neural network layer. The ReLU function efficiently solves the vanishing gradient problem and is significantly quicker than earlier activation functions. The vanishing gradient problem hinders the network's ability to learn when the gradient of the loss function with respect to the network's weights becomes negligible. Given that the binary derivative of the ReLU function, proves the effectiveness for non-negative values between 0 and 1, it has the potential to address the problem of vanishing gradients in deep neural networks. This property ensures that the gradient does not decrease excessively as the network becomes deeper. It is mathematically represented as:
| RELU(x)={0 if x<0x if x>=0 | (3.2) |
The machine learning technology known as a DBN differs significantly from a DNN in several significant ways. They use a feed-forward neural network to process networks and feature a feed-forward architecture with numerous hidden layers. DBNs were designed to replace conventional neural networks during deeply layered network training because of their sluggish learning, the tendency to become caught in local minima due to poor parameter selection, and a necessity for many training datasets [66].
The deep belief network's unsupervised learning algorithm is made up of belief networks and restricted boltzmann machines (RBMs). DBN is a multi-layered belief network, similar to a perceptron and backpropagation neural network, where each layer must be trained before training the DBN as a whole. This is achieved by using the greedy algorithm, which trains the RBMs one by one until they are all trained. DBN has a layered architecture, with the upper two levels being associative memory and the bottom layer consisting of visible units. The relationships between the lower layers are indicated by arrows pointing toward the layer closest to the data.
The lowest layers of the DBN use directed acyclic connections to convert the associative memory into quantifiable data, with the lowest layer of visible units accepting either binary or real data as the input. Like RBM, DBN has no intra-layer connections, with hidden units representing the characteristics that embody the relationships in the data as represented in Figure 4. The two levels are linked by a matrix of proportional weights, W, with the units of each layer being connected to the layer above them [66]. Common activation functions used in DBN include ReLU, SoftMax, tanH, and sigmoid, each with a specific use. Sigmoid and SoftMax functions are typically used for binary classification models, while SoftMax functions are used for multiclass classification using Eq (3.3).
| σ(→z)i=ezi∑Kj=1ezj | (3.3) |
The proposed model is implemented using Python, version 3.9, because it is a language that is frequently used for these kinds of studies. We used the Keras package of the TensorFlow library because Keras is easy to implement and it is a structural package. For coding purposes, the Jupyter Notebook was utilized since it displays the results after every code cell. In this experiment, Windows 10 Pro was used with an I5-6th Gen Laptop. The laptop contained a 2.4 GHz processor and 8 GB of RAM.
The model's performance was assessed through an evaluation process. An improvement in the model's results leads to an increase in its performance, while subpar results reveal differences in performance. Researchers often validate the model using accuracy, precision, recall, F1-score, and G-mean score based on the false negative (FN), true negative (TN), false positive (FP), and true positive (TP). The model's performance is evaluated in terms of attack detection using various metrics. During the model development, 80% of the dataset was utilized and pre-processed. The data were then subjected to evaluation and the performance was analyzed based on these metrics [67].
Accuracy in a machine learning classification model refers to the fraction of accurate classifications to the total number of negative and positive observations. Precision measures the accuracy of positive predictions and is equivalent to reliability and positive predictive value. Recall measures the model's capability to identify TP results and is synonymous with the TP rate. The F1-score combines precision and recall to provide a single metric that reflects the model's overall performance. The geometric mean, which is calculated by taking the nth root of the product of all numbers in a set, where n represents the number of observations, provides a single equivalence threshold that combines the true negative rate with the true positive rate.
| GM=n√x1×x2×...xn | (4.1) |
In our study, we carried out experiments for the proposed model using two approaches. The first experiment involved comparing our proposed model with traditional models without utilizing any balancing strategy. In the second experiment, we compared the proposed model with other models using two balancing techniques: SMOTE and SMOTETomek. The proposed model was evaluated using the Multi-Step Cyber-attack dataset.
The performance of the proposed approach was evaluated against the results from [48] in terms of the G-mean score, as depicted in Figure 5. Our proposed approach outperformed the G-mean scores of the Decision Tree (DT) and Random Forest (RF) in [48]. During the training process, five epochs were used. The G-mean score for the proposed approach was 0.813, which is more optimum than [48] scores of 0.710 and 0.650. The model has been enhanced by incorporating the Adam optimizer, with the loss function set as sparse categorical entropy. The activation function of SoftMax was used in the output layer.
The proposed model outperformed all the other traditional models and also outperforms the accuracy score of [47], as shown in Table 3. The comparison between the CNN and the proposed approach is illustrated in Figure 6. The proposed model achieved the highest results for all selected metrics among all the models, as indicated in Table 3. Furthermore, the response time of the proposed model was less compared to other models. The proposed model was tested using 3220 instances with a batch size of 32 and verbose set to 1.
| References | Mode | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.71 |
| RF | x | x | x | x | 0.65 | |
| Other techniques | NB | 0.787 | 0.462 | 0.627 | 0.313 | x |
| DNN | 0.687 | 0.114 | 0.166 | 0.135 | x | |
| LSTM | 0.99 | 0.708 | 0.668 | 0.682 | x | |
| GRU | 0.97 | 0.554 | 0.522 | 0.532 | x | |
| CNN | 0.993 | 0.813 | 0.77 | 0.788 | x | |
| RNN | 0.99 | 0.777 | 0.753 | 0.763 | x | |
| Proposed method | CNN-DBN | 0.996 | 0.82 | 0.779 | 0.801 | 0.81 |
DownLoad:
CSV
The proposed approach was compared with [47] and with [48] using the SMOTE balancing strategy, as shown in Figure 7. The results show that the proposed approach outperforms [47] with higher accuracy, precision, recall, and F1-score and [48] higher G-mean scores. The training process was conducted over five epochs and the G-mean score for the proposed approach was 0.975, while the G-mean scores for [48] using DT and RF were 0.780 and 0.790, respectively. This indicates the superiority of the proposed model. The sparse categorical entropy loss function was utilized in the training process, and the model was tested on the Adam optimizer. The output layer was activated using the SoftMax activation function for multi-class classification.
The proposed model was compared to other traditional models, as shown in Table 4, and the results indicate that it surpassed their performance. The comparison between the CNN and the suggested model using SMOTE is presented in Figure 8. The proposed model exhibits the highest accuracy, recall, precision, and F1-score score when compared to the other models, as displayed in Table 4. Additionally, it has a faster response time than the other models. The performance of our model was evaluated on the MSCAD dataset, using 13, 276 instances with a batch size of 32 and verbose set to 1. The results confirm that the proposed approach outperforms the other models, with 20% of the data being used for testing.
| References | Model | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.78 |
| RF | x | x | x | x | 0.79 | |
| Other techniques | NB | 0.641 | 0.644 | 0.641 | 0.573 | x |
| DNN | 0.166 | 0.027 | 0.166 | 0.047 | x | |
| LSTM | 0.97 | 0.97 | 0.971 | 0.97 | x | |
| GRU | 0.943 | 0.932 | 0.945 | 0.943 | x | |
| CNN | 0.972 | 0.971 | 0.972 | 0.971 | x | |
| RNN | 0.954 | 0.954 | 0.956 | 0.955 | x | |
| Proposed method | CNN-DBN | 0.976 | 0.976 | 0.975 | 0.975 | 0.97 |
DownLoad:
CSV
Our proposed approach surpassed the [47] accuracy, precision, recall, and F1-score and achieved a SMOTETomek G-mean score of 0.978, as demonstrated in Figure 9. This score succeeds the G-mean scores of both the DT and RF methods described in [48]. The G-mean scores for [48] DT and RF were 0.830 and 0.820, respectively, showcasing the superior performance of our model. The model was trained using the Adam optimizer, and the activation function named SoftMax was utilized in the final layer. The process of training took place over five epochs and utilized the sparse categorical entropy loss function.
In Figure 10, we compared the performance of the proposed technique with that of a CNN using SMOTETomek. The results are presented in Table 5, which includes the results of both the proposed model and other traditional models. The proposed model outperforms other models in terms of F1-score score, precision, recall, and accuracy, as demonstrated in Table 5. Additionally, our model has a faster response time compared to other models. The model was tested on 13, 233 instances using a batch size of 32 and a verbose level of 1 on the MSCAD dataset. The results clearly show that the suggested model produces more optimal scores than other models, even though the scores of the CNN model are slightly lower. However, the CNN model has a longer response time compared to the proposed approach.
| References | Model | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.83 |
| RF | x | x | x | x | 0.82 | |
| Other techniques | NB | 0.643 | 0.648 | 0.643 | 0.574 | x |
| DNN | 0.167 | 0.278 | 0.166 | 0.047 | x | |
| LSTM | 0.968 | 0.97 | 0.969 | 0.968 | x | |
| GRU | 0.937 | 0.934 | 0.939 | 0.943 | x | |
| CNN | 0.971 | 0.972 | 0.972 | 0.971 | x | |
| RNN | 0.953 | 0.955 | 0.954 | 0.954 | x | |
| Proposed method | CNN-DBN | 0.981 | 0.979 | 0.978 | 0.979 | 0.98 |
DownLoad:
CSV
In comparison to previous models, the experimental results demonstrate that the proposed approach provides optimal performance and quicker response time. As shown in Table 3, all scores were evaluated without using any balancing strategy. The CNN accuracy is near to the proposed approach accuracy but it takes more time to execute than our approach. With our proposed methodology, we can also identify binary-class and multi-class attacks. The proposed model has the best accuracy of 99.6%. It also provides a precision of 82%, recall of 77.9%, F1-score of 80.1%, and a G-mean score of 0.813 which provides an improved solution.
The performance of the proposed approach utilizing SMOTE is presented in Table 4. It is evident from the results that the proposed approach outperforms all other models and has a faster execution time. The performance of CNN and LSTM models came closest to the suggested model, but they took much longer to execute. Our model achieved equal precision and accuracy of 97.6%, whereas a recall has a value of 97.5% and a G-mean score of 0.975.
The results of combining SMOTE (oversampling) and Tomek (undersampling), referred to as SMOTETomek, are presented in Table 5. The Table depicts that the proposed model performs more optimally than others in terms of F1-score, G-mean score, recall, accuracy, and precision. Although the CNN model can be compared to the proposed approach, it takes a longer time to execute. The proposed method is suitable for detecting binary as well as multi-class intrusion with a faster response time. In contrast, the proposed model has the best accuracy of 98.1%, provides the best precision of 97.9%, recall of 97.8%, F1-score of 97.9% compared to [47], and the G-mean score of 0.973 compared to [48].
The response time was also calculated for the DL models which were used with the same dataset. Our proposed model responded faster when compared with all the models without using any balancing strategy. The response time for the proposed model is 20 seconds, while for RNN, CNN, GRU, and LSTM, the response time is 41 seconds, 22 seconds, 122 seconds, and 113 seconds, respectively. In contrast to other models, the CNN exhibits a shorter response time. Therefore, we compare the response time of the proposed model with that of the CNN to evaluate its efficiency. By employing SMOTE, the response time for the proposed model is recorded as 14 seconds, while for the CNN, it is 17 seconds. Additionally, when utilizing SMOTETomek, the response time for the proposed model is 13 seconds, whereas, for the CNN, it is 15 seconds. These results clearly demonstrate the effectiveness of the proposed model in terms of response time.
The exponential growth of industrial networks and inadequate security assessments pave the way for cyber attackers to cause significant losses and damage to confidential data and sensitive information. A DL-based architecture for intrusion detection in industrial networks is presented in this research. The model employs the use of CNN and DBN algorithms to enhance its performance and reduce both training and response times. The proposed framework's performance was evaluated through experiments on the MSCAD. The experimental findings demonstrated that, in comparison to other conventional models, the suggested approach achieves optimal results with a 99.6% accuracy without using any balancing strategy, 97.6% accuracy using SMOTE, and 98.1% accuracy rate using SMOTETomek for the tested dataset. This extensive research work achieves a high accuracy rate for any anomaly in a short time. It warns the administrator of the industrial network that the system has detected an attack. The administrator then investigates the matter to stop the attacker from getting off the system. The network industry will benefit from this study to design attack-detection devices. In the future, when the IDS detects any intrusion, the same IDS, also prevents the network from intrusion and blocks it. This auto-prevention technique will save the industrial network from losing sensitive information. When the system detects an attack, it should block the next data packet from getting access into the network, thus making the network safe for communication and other industrial purposes. Moreover, other balancing techniques such as SamplePairing, ADASYN, etc will be used to improve the performance of the proposed model in the future as well.
The authors declare they have not used Artificial Intelligence (AI) tools in the creation of this article.
The authors are thankful to the Deanship of Scientific Research at Najran University for funding this work under the Research Groups Funding program grant code (NU/RG/SERC/12/3).
The authors declare there is no conflict of interest.
| [1] | World Health Organization. Available from: https://covid19.who.int. |
| [2] |
A. Din, Y. Li, T. Khan, G. Zaman, Mathematical analysis of spread and control of the novel corona virus (COVID-19) in China, Chaos Solitons Fractals, 141 (2020), 110286. https://doi.org/10.1016/j.chaos.2020.110286 doi: 10.1016/j.chaos.2020.110286
|
| [3] |
S. Allegretti, I. Bulai, R. Marino, M. Menandro, K. Parisi, Vaccination effect conjoint to fraction of avoided contacts for a Sars-Cov-2 mathematical model, Math. Model. Num. Sim. Appl., 2 (2021), 56–66. https://doi.org/10.53391/mmnsa.2021.01.006 doi: 10.53391/mmnsa.2021.01.006
|
| [4] |
P. Naik, M. Yavuz, S. Qureshi, J. Zu, S. Townley, Modeling and analysis of COVID-19 epidemics with treatment in fractional derivatives using real data from Pakistan, Eur. Phys. J. Plus., 135 (2020), 795. https://doi.org/10.1140/epjp/s13360-020-00819-5 doi: 10.1140/epjp/s13360-020-00819-5
|
| [5] |
D. Okuonghae, A. Omame, Analysis of a mathematical model for COVID-19 population dynamics in Lagos, Nigeria, Chaos Solitons Fractals, 139 (2020), 110032. https://doi.org/10.1016/j.chaos.2020.110032 doi: 10.1016/j.chaos.2020.110032
|
| [6] |
F. ¨Ozk¨ose, M. Yavuz, Investigation of interactions between COVID-19 and diabetes with hereditary traits using real data: A case study in Turkey, Comput. Bio. Med., 141 (2021), 105044. https://doi.org/10.1016/j.compbiomed.2021.105044 doi: 10.1016/j.compbiomed.2021.105044
|
| [7] |
J. Deng, S. Tang, H. Shu, Joint impacts of media, vaccination and treatment on an epidemic Filippov model with application to COVID-19, J. Theor. Biol., 523 (2021), 110698. https://doi.org/10.1016/j.jtbi.2021.110698 doi: 10.1016/j.jtbi.2021.110698
|
| [8] |
L. Humphrey, E. Thommes, R. Fields, L. Coudeville, N. Hakim, A. Chit, et al., Large-scale frequent testing and tracing to supplement control of COVID-19 and vaccination rollout constrained by supply, Infect. Dis. Modell., 6 (2021) 955–974. https://doi.org/10.1016/j.idm.2021.06.008 doi: 10.1016/j.idm.2021.06.008
|
| [9] |
J. Asamoah, Z. Jin, G. Sun, B. Seidu, E. Yankson, A. Abidemi, et al., Sensitivity assessment and optimal economic evaluation of a new COVID-19 compartmental epidemic model with control interventions, Chaos Solitons Fractals, 146 (2021), 110885. https://doi.org/10.1016/j.chaos.2021.110885 doi: 10.1016/j.chaos.2021.110885
|
| [10] |
X. Duan, X. Li, M. Martcheva, S. Yuan, Using an age-structured COVID-19 epidemic model and data to model virulence evolution in Wuhan, China, J. Biol. Dynam., 16 (2022), 14–28. https://doi.org/10.1080/17513758.2021.2020916 doi: 10.1080/17513758.2021.2020916
|
| [11] |
S. Jiao, M. Huang, An SIHR epidemic model of the COVID-19 with general population-size dependent contact rate, AIMS Math., 5 (2020), 6714–6725. https://doi.org/10.3934/math.2020431 doi: 10.3934/math.2020431
|
| [12] |
J. Zhang, Z. Ma, Global dynamics of an SEIR epidemic model with saturating contact rate, Math. Biosci., 185 (2003), 15–32. https://doi.org/10.1016/S0025-5564(03)00087-7 doi: 10.1016/S0025-5564(03)00087-7
|
| [13] |
Q. Liu, D. Jiang, N. Shi, T. Hayat, B. Ahmad, Stationary distribution and extinction of a stochastic SEIR epidemic model with standard incidence, Physica A, 476 (2017), 58–69. https://doi.org/10.1016/j.physa.2017.02.028 doi: 10.1016/j.physa.2017.02.028
|
| [14] |
S. Jamshidi, M. Baniasad, D. Niyogi, Global to USA county scale analysis of weather, urban density, mobility, homestay, and mask use on COVID-19, Int. J. Environ. Res. Public Health, 17 (2020), 7847. https://doi.org/10.3390/ijerph17217847 doi: 10.3390/ijerph17217847
|
| [15] |
M. S. Hossain, S. Ahmed, M. J. Uddin, Impact of weather on COVID-19 transmission in south Asian countries: An application of the ARIMAX model, Sci. Total Environ., 761 (2021), 143315. https://doi.org/10.1016/j.scitotenv.2020.143315 doi: 10.1016/j.scitotenv.2020.143315
|
| [16] |
M. Habeebullah, H. A. Abd El-Rahim, A. Morsy, Impact of outdoor and indoor meteorological conditions on the COVID-19 transmission in the western region of Saudi Arabia, J. Environ. Manage., 288 (2021), 112392. https://doi.org/10.1016/j.jenvman.2021.112392 doi: 10.1016/j.jenvman.2021.112392
|
| [17] |
M. Baniasad, G. Mofrad, B. Bahmanabadi, S. Jamshidi, COVID-19 in Asia: Transmission factors, re-opening policies, and vaccination simulation, Environ. Res., 202 (2021), 111657. https://doi.org/10.1016/j.envres.2021.111657 doi: 10.1016/j.envres.2021.111657
|
| [18] | O. Damette, S. Goutte, Weather, pollution and COVID-19 spread: A time series and wavelet reassessment, HAL, 2020. Available from: https://halshs.archives-ouvertes.fr/halshs-02629139. |
| [19] | M. Keeling, P. Rohani, Modeling infectious diseases in human and animals, Princeton University Press, New Jersey, 2008. https://doi.org/10.2307/j.ctvcm4gk0 |
| [20] |
A. Gray, D. Greenhalgh, L. Hu, X. Mao, J. Pan, A stochastic differential equation SIS epidemic model, SIAM J. Appl. Math., 71 (2014), 876–902. https://doi.org/10.2307/23073365 doi: 10.2307/23073365
|
| [21] |
D. Li, J. Cui, M. Liu, S. Liu, The evolutionary dynamics of stochastic epidemic model with nonlinear incidence rate, Bull. Math. Biol., 77 (2015), 1705–1743. https://doi.org/10.1007/s11538-015-0101-9 doi: 10.1007/s11538-015-0101-9
|
| [22] |
Y. Cai, J. Li, Y. Kang, K. Wang, W. Wang, The fluctuation impact of human mobility on the influenza transmission, J. Franklin Inst., 357 (2020), 8899–8924. https://doi.org/10.1016/j.jfranklin.2020.07.002 doi: 10.1016/j.jfranklin.2020.07.002
|
| [23] |
J. Asamoah, M. Owusu, Z. Jin, F. Oduro, A. Abidemi, E. Gyasi, Global stability and cost-effectiveness analysis of COVID-19 considering the impact of the environment: using data from Ghana, Chaos Solitions Fractals, 140 (2020), 110103. https://doi.org/10.1016/j.chaos.2020.110103 doi: 10.1016/j.chaos.2020.110103
|
| [24] |
C. Manski, F. Molinari, Estimating the COVID-19 infection rate: anatomy of an inference problem, J. Econom., 220 (2020), 181–192. https://doi.org/10.1016/j.jeconom.2020.04.041 doi: 10.1016/j.jeconom.2020.04.041
|
| [25] |
Z. Cao, W. Feng, X. Wen, L. Zu, M. Cheng, Dynamics of a stochastic SIQR epidemic model with standard incidence, Physica A, 527 (2019), 121180. https://doi.org/10.1016/j.physa.2019.121180 doi: 10.1016/j.physa.2019.121180
|
| [26] |
D. Adak, A. Majumder, N. Bairagi, Mathematical perspective of COVID-19 pandemic: Disease extinction criteria in deterministic and stochastic models, Chaos Solitions Fractals, 27 (2021), 104472. https://doi.org/10.1016/j.chaos.2020.110381 doi: 10.1016/j.chaos.2020.110381
|
| [27] |
M. Fatini, M. Khalifi, R. Gerlach, A. Laaribi, R. Taki, Stationary distribution and threshold dynamics of a stochastic SIRS model with a general incidence, Physica A, 534 (2019), 120696. https://doi.org/10.1016/j.physa.2019.03.061 doi: 10.1016/j.physa.2019.03.061
|
| [28] |
C. Ji, D. Jiang, Threshold behaviour of a stochastic SIR model, Appl. Math. Model., 38 (2014), 5067–5079. https://doi.org/10.1016/j.apm.2014.03.037 doi: 10.1016/j.apm.2014.03.037
|
| [29] |
Y. Zhou, W. Zhang, S. Yuan, Survival and stationary distribution of a SIR epidemic model with stochastic perturbations, Appl. Math. Comput., 244 (2014), 118–131. https://doi.org/10.1016/j.amc.2014.06.100 doi: 10.1016/j.amc.2014.06.100
|
| [30] |
Q. Liu, D. Jiang, Dynamics of a stochastic multigroup SIQR epidemic model with standard incidence rates, J. Franklin Inst., 356 (2019), 2960–2993. https://doi.org/10.1016/j.jfranklin.2019.01.038 doi: 10.1016/j.jfranklin.2019.01.038
|
| [31] |
Q. Liu, Stability of SIRS system with random perturbations, Physica A, 388 (2009), 3677–3686. https://doi.org/10.1016/j.physa.2009.05.036 doi: 10.1016/j.physa.2009.05.036
|
| [32] |
G. Lan, S. Yuan, B. Song, The impact of hospital resources and environmental perturbations to the dynamics of SIRS model, J. Franklin Inst., 358 (2021), 2405–2433. https://doi.org/https://doi.org/10.1016/j.jfranklin.2021.01.015 doi: 10.1016/j.jfranklin.2021.01.015
|
| [33] |
T. Tuong, H. Dang, N. Dieu, K. Tran, Extinction and permanence in a stochastic SIRS model in regime-switching with general incidence rate, Nonlinear Anal. Hybri., 34 (2019), 121–130. https://doi.org/10.1016/j.nahs.2019.05.008 doi: 10.1016/j.nahs.2019.05.008
|
| [34] |
M. Benaïm, C. Lobry, Lotka-volterra with randomly fluctuating environments or how switching between beneficial environments can make survival harder, Ann. Appl. Probab., 26 (2016), 3754–3785. https://doi.org/10.1214/16-AAP1192 doi: 10.1214/16-AAP1192
|
| [35] | M. Benaïm, Stochastic persistence, arXiv: 1806.08450. |
| [36] |
A. Hening, H. D. Nguyen, Coexistence and extinction for stochastic kolmogorov systems, Ann. Appl. Probab., 28 (2018), 1893–1942. https://doi.org/10.1214/17-AAP1347 doi: 10.1214/17-AAP1347
|
| [37] | X. Mao, Stochastic Differential Equations and Applications, Horwood Publishing, Chichester, 2007. |
| [38] |
N. Dang, G. Yin, Stability of regime-switching diffusion systems with discrete states belonging to a countable set, SIAM J. Control Optim., 56 (2018), 3893–3917. https://doi.org/10.1137/17M1118476 doi: 10.1137/17M1118476
|
| [39] | F. Klebaner, Introduction to Stochastic Calculus with Applications, Imperial College Press, 2005. |
| [40] |
R. Ikram, A. Khan, M. Zahri, A. Saeed, M. Yavuz, P. Kumam, Extinction and stationary distribution of a stochastic COVID-19 epidemic model with time-delay, Comput. Biol. Medi., 141 (2022), 105115. https://doi.org/10.1016/j.compbiomed.2021.105115 doi: 10.1016/j.compbiomed.2021.105115
|
| [41] |
D. Higham, An algorithmic introduction to numerical simulation of stochastic differential equations, SIAM Rev., 43 (2001), 525–546. https://doi.org/10.1137/S0036144500378302 doi: 10.1137/S0036144500378302
|
| [42] |
A. Din, Y. Li, Stationary distribution extinction and optimal control for the stochastic hepatitis B epidemic model with partial immunity, Phys. Scripta, 7 (2021), 074005. https://doi.org/10.1088/1402-4896/abfacc doi: 10.1088/1402-4896/abfacc
|
| [43] |
A. Din, Y. Li, Stochastic optimal control for norovirus transmission dynamics by contaminated food and water, Chinese Phys. B, 2021. https://doi.org/10.1088/1674-1056/ac2f32 doi: 10.1088/1674-1056/ac2f32
|
| [44] |
A. Din, The stochastic bifurcation analysis and stochastic delayed optimal control for epidemic model with general incidence function, Chaos, 31 (2021), 104649. https://doi.org/10.1063/5.0063050 doi: 10.1063/5.0063050
|
| [45] |
A. Yang, B. Song, S. Yuan, Noise-induced transitions in a non-smooth SIS epidemic model with media alert, Math. Biosci. Eng., 18 (2021), 745–763. https://doi.org/10.3934/mbe.2021040 doi: 10.3934/mbe.2021040
|
| [46] |
J. Jaramillo, J. Ma, P. Driessche, S. Yuan, Host contact structure is important for the recurrence of Influenza A, J. Math. Biol., 77 (2018), 1563–1588. https://doi.org/10.1007/s00285-018-1263-5 doi: 10.1007/s00285-018-1263-5
|
| [47] |
Y. Zhao, L. Zhang, S. Yuan, The effect of media coverage on threshold dynamics for a stochastic SIS epidemic model, Physica A, 512 (2018), 248–260. https://doi.org/10.1016/j.physa.2018.08.113 doi: 10.1016/j.physa.2018.08.113
|
| 1. | Arjumand Seemab, Mujeeb ur Rehman, Jehad Alzabut, Yassine Adjabi, Mohammed S. Abdo, Langevin equation with nonlocal boundary conditions involving a ψ-Caputo fractional operators of different orders, 2021, 6, 2473-6988, 6749, 10.3934/math.2021397 | |
| 2. | Kanoktip Kotsamran, Weerawat Sudsutad, Chatthai Thaiprayoon, Jutarat Kongson, Jehad Alzabut, Analysis of a Nonlinear ψ-Hilfer Fractional Integro-Differential Equation Describing Cantilever Beam Model with Nonlinear Boundary Conditions, 2021, 5, 2504-3110, 177, 10.3390/fractalfract5040177 | |
| 3. | Dinghong Jiang, Chuanzhi Bai, On coupled Gronwall inequalities involving a ψ-fractional integral operator with its applications, 2022, 7, 2473-6988, 7728, 10.3934/math.2022434 | |
| 4. | Badreddine Meftah, Djamal Foukrach, Some new Gronwall–Bellman–Bihari type integral inequality associated with ψ-Hilfer fractional derivative, 2023, 0, 0174-4747, 10.1515/anly-2022-1073 | |
| 5. | Marisa Kaewsuwan, Rachanee Phuwapathanapun, Weerawat Sudsutad, Jehad Alzabut, Chatthai Thaiprayoon, Jutarat Kongson, Nonlocal Impulsive Fractional Integral Boundary Value Problem for (ρk,ϕk)-Hilfer Fractional Integro-Differential Equations, 2022, 10, 2227-7390, 3874, 10.3390/math10203874 | |
| 6. | Songkran Pleumpreedaporn, Weerawat Sudsutad, Chatthai Thaiprayoon, Juan E. Nápoles, Jutarat Kongson, A Study of ψ-Hilfer Fractional Boundary Value Problem via Nonlinear Integral Conditions Describing Navier Model, 2021, 9, 2227-7390, 3292, 10.3390/math9243292 | |
| 7. | Weerawat Sudsutad, Chatthai Thaiprayoon, Bounmy Khaminsou, Jehad Alzabut, Jutarat Kongson, A Gronwall inequality and its applications to the Cauchy-type problem under ψ-Hilfer proportional fractional operators, 2023, 2023, 1029-242X, 10.1186/s13660-023-02929-x | |
| 8. | Ayoub Louakar, Ahmed Kajounı, Khalid Hilal, Hamid Lmou, A Class of Implicit Fractional ψ-Hilfer Langevin Equation with Time Delay and Impulse in the Weighted Space, 2024, 7, 2651-4001, 88, 10.33434/cams.1425019 | |
| 9. | Hacen Serrai, Brahim Tellab, Sina Etemad, İbrahim Avcı, Shahram Rezapour, Ψ-Bielecki-type norm inequalities for a generalized Sturm–Liouville–Langevin differential equation involving Ψ-Caputo fractional derivative, 2024, 2024, 1687-2770, 10.1186/s13661-024-01863-1 | |
| 10. | Weerawat Sudsutad, Jutarat Kongson, Chatthai Thaiprayoon, Nantapat Jarasthitikulchai, Marisa Kaewsuwan, A generalized Gronwall inequality via ψ-Hilfer proportional fractional operators and its applications to nonlocal Cauchy-type system, 2024, 9, 2473-6988, 24443, 10.3934/math.20241191 |
Figures(4) / Tables(2)
Tianfang Hou, Guijie Lan, Sanling Yuan, Tonghua Zhang. Threshold dynamics of a stochastic SIHR epidemic model of COVID-19 with general population-size dependent contact rate[J]. Mathematical Biosciences and Engineering, 2022, 19(4): 4217-4236. doi: 10.3934/mbe.2022195
| Author | Dataset | Evaluation measure | K-Fold validation | Balancing strategy | Response time |
| [32] | Modbus, OPC-UA | Accuracy, Precision, Recall, F-1 score | No | No | High |
| [38] | SCADA network | Accuracy, Precision | Yes | No | Medium |
| [39] | Industrial robot | Accuracy | No | No | Low |
| [40] | SCADA network | Accuracy | No | No | Medium |
| [35] | NSL-KDD, UNSW-NB15 | Accuracy, Precision, Recall, F-1 score | Yes | No | Medium |
| [34] | PCP from IAE | Accuracy, Precision, Recall, F-1 score | No | No | High |
| [41] | SCADA network | Accuracy, F-1 score | No | No | Medium |
| [33] | NSL-KDD, CIC-IDS 2017 | Accuracy, Precision, F-1 score | Yes | Yes | High |
| [42] | NSL-KDD | Accuracy, Precision, Recall, F-1 score | No | No | Medium |
| [36] | Collected data from industry production line | Accuracy | No | No | Medium |
| Proposed Model | Multi-step cyber attack dataset | Accuracy, Precision, Recall, F-1, G-mean score | Yes | Yes | Low |
DownLoad:
CSV
| Classe | Encoding | Records |
| Brute force | 0 | 88, 502 |
| HTTP DDoS | 1 | 641 |
| ICMP flood | 2 | 45 |
| Normal | 3 | 28, 501 |
| Port scan | 4 | 11, 081 |
| Web crawler | 5 | 28 |
DownLoad:
CSV
| References | Mode | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.71 |
| RF | x | x | x | x | 0.65 | |
| Other techniques | NB | 0.787 | 0.462 | 0.627 | 0.313 | x |
| DNN | 0.687 | 0.114 | 0.166 | 0.135 | x | |
| LSTM | 0.99 | 0.708 | 0.668 | 0.682 | x | |
| GRU | 0.97 | 0.554 | 0.522 | 0.532 | x | |
| CNN | 0.993 | 0.813 | 0.77 | 0.788 | x | |
| RNN | 0.99 | 0.777 | 0.753 | 0.763 | x | |
| Proposed method | CNN-DBN | 0.996 | 0.82 | 0.779 | 0.801 | 0.81 |
DownLoad:
CSV
| References | Model | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.78 |
| RF | x | x | x | x | 0.79 | |
| Other techniques | NB | 0.641 | 0.644 | 0.641 | 0.573 | x |
| DNN | 0.166 | 0.027 | 0.166 | 0.047 | x | |
| LSTM | 0.97 | 0.97 | 0.971 | 0.97 | x | |
| GRU | 0.943 | 0.932 | 0.945 | 0.943 | x | |
| CNN | 0.972 | 0.971 | 0.972 | 0.971 | x | |
| RNN | 0.954 | 0.954 | 0.956 | 0.955 | x | |
| Proposed method | CNN-DBN | 0.976 | 0.976 | 0.975 | 0.975 | 0.97 |
DownLoad:
CSV
| References | Model | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.83 |
| RF | x | x | x | x | 0.82 | |
| Other techniques | NB | 0.643 | 0.648 | 0.643 | 0.574 | x |
| DNN | 0.167 | 0.278 | 0.166 | 0.047 | x | |
| LSTM | 0.968 | 0.97 | 0.969 | 0.968 | x | |
| GRU | 0.937 | 0.934 | 0.939 | 0.943 | x | |
| CNN | 0.971 | 0.972 | 0.972 | 0.971 | x | |
| RNN | 0.953 | 0.955 | 0.954 | 0.954 | x | |
| Proposed method | CNN-DBN | 0.981 | 0.979 | 0.978 | 0.979 | 0.98 |
DownLoad:
CSV
| Author | Dataset | Evaluation measure | K-Fold validation | Balancing strategy | Response time |
| [32] | Modbus, OPC-UA | Accuracy, Precision, Recall, F-1 score | No | No | High |
| [38] | SCADA network | Accuracy, Precision | Yes | No | Medium |
| [39] | Industrial robot | Accuracy | No | No | Low |
| [40] | SCADA network | Accuracy | No | No | Medium |
| [35] | NSL-KDD, UNSW-NB15 | Accuracy, Precision, Recall, F-1 score | Yes | No | Medium |
| [34] | PCP from IAE | Accuracy, Precision, Recall, F-1 score | No | No | High |
| [41] | SCADA network | Accuracy, F-1 score | No | No | Medium |
| [33] | NSL-KDD, CIC-IDS 2017 | Accuracy, Precision, F-1 score | Yes | Yes | High |
| [42] | NSL-KDD | Accuracy, Precision, Recall, F-1 score | No | No | Medium |
| [36] | Collected data from industry production line | Accuracy | No | No | Medium |
| Proposed Model | Multi-step cyber attack dataset | Accuracy, Precision, Recall, F-1, G-mean score | Yes | Yes | Low |
| Classe | Encoding | Records |
| Brute force | 0 | 88, 502 |
| HTTP DDoS | 1 | 641 |
| ICMP flood | 2 | 45 |
| Normal | 3 | 28, 501 |
| Port scan | 4 | 11, 081 |
| Web crawler | 5 | 28 |
| References | Mode | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.71 |
| RF | x | x | x | x | 0.65 | |
| Other techniques | NB | 0.787 | 0.462 | 0.627 | 0.313 | x |
| DNN | 0.687 | 0.114 | 0.166 | 0.135 | x | |
| LSTM | 0.99 | 0.708 | 0.668 | 0.682 | x | |
| GRU | 0.97 | 0.554 | 0.522 | 0.532 | x | |
| CNN | 0.993 | 0.813 | 0.77 | 0.788 | x | |
| RNN | 0.99 | 0.777 | 0.753 | 0.763 | x | |
| Proposed method | CNN-DBN | 0.996 | 0.82 | 0.779 | 0.801 | 0.81 |
| References | Model | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.78 |
| RF | x | x | x | x | 0.79 | |
| Other techniques | NB | 0.641 | 0.644 | 0.641 | 0.573 | x |
| DNN | 0.166 | 0.027 | 0.166 | 0.047 | x | |
| LSTM | 0.97 | 0.97 | 0.971 | 0.97 | x | |
| GRU | 0.943 | 0.932 | 0.945 | 0.943 | x | |
| CNN | 0.972 | 0.971 | 0.972 | 0.971 | x | |
| RNN | 0.954 | 0.954 | 0.956 | 0.955 | x | |
| Proposed method | CNN-DBN | 0.976 | 0.976 | 0.975 | 0.975 | 0.97 |
| References | Model | Accuracy | Precision | Recall | F1-score | G-Mean |
| [47] | 0.825 | 0.942 | 0.911 | 0.926 | x | |
| [48] | DT | x | x | x | x | 0.83 |
| RF | x | x | x | x | 0.82 | |
| Other techniques | NB | 0.643 | 0.648 | 0.643 | 0.574 | x |
| DNN | 0.167 | 0.278 | 0.166 | 0.047 | x | |
| LSTM | 0.968 | 0.97 | 0.969 | 0.968 | x | |
| GRU | 0.937 | 0.934 | 0.939 | 0.943 | x | |
| CNN | 0.971 | 0.972 | 0.972 | 0.971 | x | |
| RNN | 0.953 | 0.955 | 0.954 | 0.954 | x | |
| Proposed method | CNN-DBN | 0.981 | 0.979 | 0.978 | 0.979 | 0.98 |
