TRANSFER LEARNING APPROACH TO IDS ON CLOUD

IOT DEVICES USING OPTIMIZED CNN

 ABSTRACT

Transfer learning IDS based on the Convolutional Neural Network

(CNN) architecture that has shown excellent results on image classification. We
use five pre-trained CNN models, including VGG16, VGG19, Inception,
MobileNet, and EfficientNets, to train on two selected datasets: CIC-IDS2017
and CSE-CICIDS2018. Before the training, pre-processing, imbalance
treatment, dimensionality reduction, and conversion of the feature vector into
images suitable for the CNN architecture using Quantile Transformer. Three
best-performing models (InceptionV3, MobileNetV3Small, and
EfficientNetV2B0) are selected to develop an ensemble model called efficient-
lightweight ensemble transfer learning (ELETL-IDS) using the model averaging
approach. On evaluation, the findings show that the ELETL-IDS outperformed
existing state-of-the-art proposals in all evaluation metrics, reaching 100% in
accuracy, precision, recall, and F-score. Using Matthew’s Correlation
Coefficient (MCC) to validate this result and compared it to the AUC-ROC,
which maintained an exact value of 0.9996. To this end, our proposed model is
lightweight, efficient, and reliable enough to be deployed in cloud IoT systems
for intrusion detection.
 1. INTRODUCTON

In recent years, the Internet of Things (IoT) has been in the spotlight
of both researchers’ and industrialists’ activities as more sophisticated IoT
systems continue to emerge and are deployed in various environments for
different uses. Because of this, many people consider this technology to be a
gamechanger, capable of opening up previously unimaginable possibilities for
human and animal community alike. These emerging technologies have created
an enabling environment for creating, exchanging, collecting, storing, and
distributing data within and among heterogeneous devices involving no human
interaction and intervention.

1.1 GENERAL

Currently, IoT devices have diverse application domains, including but

not limited to health, imaginative home, smart grids, transportation,
environment, infrastructure, and public services. More areas of application of
this technology are discovered almost daily. Success can be attributed to the
creativity of scientists who have spent years studying this topic, leading to
discoveries that have positively impacted the way activities are carried out
today leading to improved productivity and work-efficiency. Thus, these
advancements in telecommunication systems have generated additional
opportunities that ensure more effective knowledge transmission in IoT systems
and also allowed the expansion into other scenarios for more comprehensive
information exchange.

1.2 BENEFITS OF IOT DEVICES

 The benefits of IoT devices cannot be overemphasized, as seen in home
automation, industrial process automation, military warfare, precision
agriculture, etc. As a result of the increased number of IoT devices, counting in
billions, the number of connected devices has also raised, which has caused a
proportional expansion of the IoT network architecture. The expansion of the
network interface comes with many benefits as well as worries. The benefits
include the need for more devices and a workforce, generating jobs, and
creating an atmosphere for personal development. However, the downside of
this includes the issues of privacy and security concerns regarding data
generation and transmission. Many times, the security of both enterprise and
individual information is compromised as it is transferred from one device to
another over a large expanse of the network.
In recent years, the use of Internet of Things (IoT) devices has
become increasingly widespread in various industries, including healthcare,
transportation, and manufacturing. However, the security of IoT systems has
become a major concern due to the sensitive data they handle and the potential
impact of security breaches. Intrusion Detection Systems (IDS) are a key
component in securing IoT systems by detecting and responding to security
threats. However, IDS on cloud-based IoT devices can be resource-intensive
and require significant processing power.
To address this challenge, a Transfer Learning Approach to IDS on
Cloud IoT Devices Using Optimized CNN has been proposed. This approach
involves leveraging the knowledge learned from pre-trained models in image
recognition and processing, and transferring it to improve the performance of
the IDS on cloud-based IoT devices. This can significantly reduce the
computational resources required and improve the efficiency and accuracy of
the IDS.
Convolutional Neural Networks (CNN) are used as the primary
machine learning algorithm in this approach due to their effectiveness in image
recognition tasks. The CNN is trained on a dataset of images that have been
labeled as either normal or abnormal, with abnormal images representing
potential security threats. Once trained, the CNN is optimized using various
techniques such as pruning, quantization, and compression, to improve its
efficiency and reduce the computational resources required for deployment on
cloud-based IoT devices.
Feasibility is a critical consideration in this approach, and the
proposed method has been tested and evaluated on a real-world dataset to
validate its effectiveness. The security and privacy of the system are also
addressed, with the use of secure communication protocols and encryption
techniques to ensure that data transmitted between the IoT devices and cloud
servers is secure. The Transfer Learning Approach to IDS on Cloud IoT
Devices Using Optimized CNN is a promising approach for improving the
efficiency and accuracy of IDS on cloud-based IoT devices. By leveraging pre-
trained models and optimizing the CNN, significant computational resources
can be saved, while still maintaining high levels of security and accuracy.

1.3 OBJECTIVES OF THE FOLLOWING

 To develop a transfer learning approach for Intrusion Detection Systems

(IDS) that can be applied to cloud-based Internet of Things (IoT) devices.

 To optimize the convolutional neural network (CNN) used in the IDS to

improve the accuracy and efficiency of the model.

 To evaluate the performance of the transfer learning approach and

optimized CNN on cloud IoT devices and compare it to existing IDS
methods.
  To investigate the feasibility and effectiveness of applying transfer
learning to IDS on cloud IoT devices.

 To contribute to the development of more efficient and accurate IDS

solutions for cloud IoT devices, that can improve security and privacy in
IoT systems.

1.4 ABOUT THE PROJECT

The TRANSFER LEARNING APPROACH TO IDS ON CLOUD

IOT DEVICES USING OPTIMIZED CNN involves several key concepts
related to machine learning, security, and cloud computing. The approach
utilizes transfer learning, a technique that involves transferring knowledge
learned from one task to another, with the goal of improving performance on the
second task. In this case, the second task is Intrusion Detection Systems (IDS)
on cloud-based Internet of Things (IoT) devices. IDS is a type of security
software that monitors network traffic for signs of unauthorized access, hacking,
or other security threats.

Cloud computing is the delivery of computing resources over the

internet, including servers, storage, databases, networking, software, and
analytics. IoT refers to a network of physical devices, vehicles, home appliances,
and other items that are embedded with sensors, software, and connectivity,
enabling them to connect and exchange data. Convolutional Neural Networks
(CNN) are commonly used in image recognition and processing, but can also be
applied to other types of data, including security data collected by IDS.

The approach also involves optimization, which is the process of

adjusting parameters in a model or algorithm to improve its performance. The
goal is to improve the accuracy and efficiency of the CNN used in the IDS
model. Accuracy refers to the degree to which a model or algorithm produces
correct results, while efficiency refers to the ability of a system or algorithm to
perform a task using minimal resources, such as time or computation power.

Feasibility is another key concept, which refers to the likelihood that a

proposed approach or solution will work in practice, given the available
resources and constraints. Finally, the approach is aimed at improving security
and privacy, which are critical considerations in IoT systems. This includes
protecting data and systems from unauthorized access, use, disclosure,
disruption, modification, or destruction, as well as protecting individuals'
personal information and rights. Overall, the transfer learning approach to ids on
cloud iot devices using optimized CNN is a promising approach to developing
more efficient and accurate IDS solutions for cloud IoT devices, which can
improve security and privacy in IoT systems.

1.5 ORGANIZATION OF THE PROJECT

The organization of this project can be broken down into several key
concepts related to machine learning, security, and cloud computing. These
concepts include transfer learning, which involves transferring knowledge
learned from one task to another to improve performance, as well as Intrusion
Detection Systems (IDS) on cloud-based Internet of Things (IoT) devices. Cloud
computing, which refers to the delivery of computing resources over the
internet, and IoT, which refers to a network of physical devices, also play a key
role in this approach. The use of Convolutional Neural Networks (CNN) for
image recognition and processing, as well as optimization techniques to improve
the efficiency and accuracy of the CNN, are also important concepts in this
approach. Additionally, feasibility, which refers to the likelihood that a proposed
approach or solution will work in practice, and security and privacy, which are
critical considerations in IoT systems, are key concepts addressed in this
approach. Overall, these concepts provide a comprehensive framework for
understanding the transfer learning approach to ids on cloud iot devices using
optimized CNN.

2. SYSTEM STUDY

Data centralization can potentially increase Internet of Things (IoT)

usage. The trend is to move IoT devices to a centralized server with higher
memory capacity and a more robust management interface. Hence, a larger
volume of data will be transmitted, resulting in more network security issues.
Cloud IoT offers more advantages for deploying and managing IoT systems
through minimizing response delays, optimal latency, and effective network
load distribution.

2.1 EXISTING SYSTEM

 The extensive network space poses a serious security threat to user

information, leading to the development of sophisticated attack strategies
that exploit vulnerabilities in the network.

 Network intrusion detection systems (IDS) are being used to protect the
cloud IoT interfaces, and machine learning and deep learning approaches
are being explored to enhance the accuracy of these systems.

 This paper proposes a novel approach to IDS using transfer learning and
the Convolutional Neural Network (CNN) architecture, which has
demonstrated high levels of accuracy in image classification tasks.
  By leveraging the power of transfer learning, the proposed IDS can use
pre-trained models to improve its ability to detect and respond to new
threats in real-time.

 The use of CNN architecture in the proposed IDS offers several

advantages, including the ability to handle large amounts of data, high
accuracy rates, and the ability to detect both known and unknown threats.

DISADVANTAGE OF EXISTING SYSTEM

 The accuracy of the IDS may vary depending on the quality and quantity of
the data used for training the CNN model.

 The system may require a significant amount of computing power and

resources to train and operate the CNN model for real-time intrusion
detection.

 The IDS may produce false positives or false negatives, leading to

unnecessary alerts or missed detection of actual intrusions.

 The transfer learning approach may not be effective in detecting novel or

previously unseen attacks, which could require a more proactive and
adaptive approach to network security.

2.2 PROPOSED SYSTEM

 A network intrusion detection system (NIDS) is a method for managing

computer network security threats by monitoring every network activity.

 NIDS can generate warnings when abnormal or malicious intent is

detected, using either signature-based or anomaly-based mechanisms.
  Anomaly-based approach is generally more accurate than signature-
based, as it can identify activities that have not been previously defined.

 Convolutional Neural Networks (CNN) is a deep learning architecture

that has been successfully applied in image recognition and segmentation,
and is now being used in networking and medical image processing.

 Other classical machine learning algorithms like Decision Tree (DT),

Random Forest (RF), Extra Tree (ET), and XGBoost can also perform
well in the classification of network traffic that is not represented as
image data.

ADVANTAGES OF PROPOSED SYSTEM

 Transfer learning provides an effective method for managing computer

network security threats by monitoring every network activity, which can
help identify and prevent abnormal or malicious intent.

 CNN can generate warnings when such threats are discovered, using
either signature-based or anomaly-based mechanisms, which can help
alert users to potential security breaches.

 Anomaly-based approach is generally more accurate than signature-

based, as it can identify activities that have not been previously defined,
which can help detect previously unknown threats.

 The use of deep learning architectures like Convolutional Neural

Networks (CNN) and classical machine learning algorithms like Decision
Tree (DT), Random Forest (RF), Extra Tree (ET), and XGBoost can
provide effective tools for the classification of network traffic and the
detection of security threats.
3. PROJECT DESCRIPTION

The main aim is the proposed ELETL-IDS model on evaluation

achieves an accuracy, validation accuracy, precision, and F1-score of 100% and
99.98% on the CIC-IDS2017 and CSE-CICIDS2018 datasets, respectively.
These values show that the model is highly efficient in detecting attacks using
multi-class classification. An IDS model based on a special variant of the
Recurrent Neural Network (RNN) architecture uses the Long Short-Term
Memory (LSTM) network for anomaly detection. The LSTM architecture
overcomes the varnishing and exploding gradient descent which are common
challenges with RNN by learning long term dependencies during training.

3.1MODULES

 Module-1: IData preprocessing

 Module-2: Pre-trained model selection
 Module-3: Fine-tuning
 Module-4: Optimization
 Module-5: Deployment
 Module-6: Continuous learning

3.2 MODULE DESCRIPTION

Module-1: IData preprocessing

The network traffic data collected from IoT devices must be preprocessed to
extract the relevant features for intrusion detection. This may involve
normalization, filtering, and feature extraction techniques to transform the raw
data into a format that can be input to the CNN.
Module-2: Pre-trained model selection
A pre-trained CNN model is selected based on its performance on a related task,
such as image classification. The model is often chosen for its ability to extract
high-level features from the input data.

Module-3: Fine-tuning
The pre-trained CNN is fine-tuned on a labeled dataset of IoT network traffic to
adapt it to the specific task of intrusion detection. This involves updating the
weights of the model using back propagation with a smaller learning rate than
during pre-training, to avoid over fitting.

Module-4: Optimization
The fine-tuned CNN is optimized to improve its efficiency and reduce its size.
Techniques such as pruning, quantization, and compression can be used to
reduce the number of parameters and operations in the model without
sacrificing accuracy.

Module-5: Deployment
The optimized CNN model is deployed on the cloud IoT devices for real-time
intrusion detection. The model can be integrated with other security
mechanisms to provide a comprehensive security solution for IoT networks.

Module-6: Continuous learning

The model can be continuously updated with new data to improve its accuracy
and adapt to evolving threats. This can involve re-training the model on new
labeled datasets or using online learning techniques to update the model
parameters in real-time.
4. SYSTEM SPECIFICATION

4.1 HARDWARE SPECIFICATION

 Processor : Pentium 4 or above

 Speed : 2.1 GHZ
 RAM : 2GB or above
 Hard Disk :100GB or above

4.2 SOFTWARE SPECIFICATION

 Front End : Java
 Back End : Oracle 12c
 IDE : NetBeans 7 and above
 Operating System : Windows XP, Windows 7

5. SOFTWARE DESCRIPTION

Windows 98/2000/XP

Windows XP:

The two major editions are Windows XP Home Edition, designed for
home users, and Windows XP Professional, designed for business and power-
users. XP Professional contains advanced features that the average home user
would not use. However, these features are not necessarily missing from XP
Home. They are simply disabled, but are there and can become functional.
These releases were made available at retail outlets that sell computer software,
and were preinstalled on computers sold by major computer manufacturers. As
of mid-2008, both editions continue to be sold. A third edition, called Windows
XP Media Center Edition was introduced in 2002 and was updated every year
until 2006 to incorporate new digital media, broadcast television and Media
Center Extender capabilities. Unlike the Home and Professional edition, it was
never made available for retail purchase, and was typically either sold through
OEM channels, or was preinstalled on computers that were typically marketed
as "media center PCs".

Two different 64-bit editions were made available, one designed

specifically for Itanium-based workstations, which was introduced in 2001
around the same time as the Home and Professional editions, but was
discontinued a few years later when vendors of Itanium hardware stopped
selling workstation-class machines due to low sales. The other, called Windows
XP Professional x64 Edition, supports the x86-64 extension of the Intel IA-32
architecture. x86-64 is implemented by AMD as "AMD64", found in AMD's
Opteron and Athlon 64 chips, and implemented by Intel as "Intel 64" (formerly
known as IA-32e and EM64T), found in Intel's Pentium 4 and later chips.

Windows XP Tablet PC Edition was produced for a class of specially

designed notebook/laptop computers called tablet PCs. It is compatible with a
pen-sensitive screen, supporting handwritten notes and portrait-oriented screens.
Internet Explorer 6 running in Windows XP Tablet PC Edition. Microsoft also
released Windows XP Embedded, an edition for specific consumer electronics,
set-top boxes, kiosks/ATMs, medical devices, arcade video games, point-of-sale
terminals, and Voice over Internet Protocol (VoIP) components. In July 2006,
Microsoft released Windows Fundamentals for Legacy PCs, a thin client
version of Windows XP Embedded which targets older machines (as early as
the original Pentium). It is only available to Software Assurance customers. It is
intended for corporate customers who would like to upgrade to Windows XP to
take advantage of its security and management capabilities, but can't afford to
purchase new hardware.
Windows 98:

Windows 98 Second Edition (often shortened to SE) is an updated

release of Windows 98, released on 5 May 1999. It includes fixes for many
minor issues, improved USB support, and the replacement of Internet Explorer
4.0 with Internet Explorer 5.0. Also included is Internet Connection Sharing,
which allows multiple computers on a LAN to share a single Internet
connection through Network Address Translation. Other features in the update
include Microsoft NetMeeting 3.0 and integrated support for DVD-ROM
drives. A memory overflow issue was resolved which in the older version of
Windows 98 would crash most systems if left running for 49.7 days (equal to 2 32
milliseconds). Also included on the CD-ROM is the option to install Microsoft
Plus! themes for Windows 98. Windows 98SE could be obtained as retail
upgrade and full version packages, as well as OEM and a Second Edition
Updates Disc for existing Windows 98 users.

Windows 2000:

Windows 2000 is a line of operating systems produced by Microsoft for

use on business desktops, notebook computers, and servers. Released on
February 17, 2000 it was the successor to Windows NT 4.0, and is the final
release of Microsoft Windows to display the "Windows NT" designation. It was
succeeded by Windows XP for desktop systems in October 2001 and Windows
Server 2003 for servers in April 2003.

Four editions of Windows 2000 were released: Professional, Server,

Advanced Server, and Datacenter Server. Additionally, Microsoft sold
Windows 2000 Advanced Server Limited Edition and Windows 2000
Datacenter Server Limited Edition, which were released in 2001 and run on 64-
bit Intel Itanium microprocessors. While each edition of Windows 2000 was
targeted to a different market, they share a core set of features, including many
system utilities such as the Microsoft Management Console and standard system
administration applications. Support for people with disabilities has been
improved over Windows NT 4.0 with a number of new assistive technologies,
and Microsoft increased support for different languages and locale information.
All versions of the operating system support the Windows NT file system,
NTFS 3.0, the Encrypting File System, as well as basic and dynamic disk
storage. The Windows 2000 Server family has additional features, including the
ability to provide Active Directory services (a hierarchical framework of
resources), Distributed File System (a file system that supports sharing of files)
and fault-redundant storage volumes. Windows 2000 can be installed through
either a manual or unattended installation. Unattended installations rely on the
use of answer files to fill in installation information, and can be performed
through a bootable CD using Microsoft Systems Management Server, by the
System Preparation Tool.

Microsoft marketed Windows 2000 as the most secure Windows

version ever, but it became the target of a number of high-profile virus attacks
such as Code Red and Nimda. Over nine years after its release, it continues to
receive patches for security vulnerabilities nearly every month.

JDK 1.6 Features

Web Services: you get first-class support for writing XML web service client
applications (death of Apache Axis?). No more messing with the plumbing
(unless you really want to). You can also expose your APIs as .NET
interoperable web services with a simple annotation.

For developers who want to handle XML directly Mustang adds new
parsing and XML to Java object-mapping APIs, previously only available in
Java EE platform implementations or the Java Web Services Pack.
You can now mix in JavaScript technology with your Java technology source
 code, useful for prototyping also useful when you have teams with a variety of
skill sets.

JAVA

Java provides ChaCha20 and ChaCha20-Poly1305 cipher implementations.

These algorithms will be implemented in the SunJCE provider.

GOALS OF JAVA

 Provide an easy to use

 Being object oriented.
 JVM (java virtual machine).
 Garbage Collection.
 The java virtual machine(JVM) provide the hardware platform specification to
which you compile all java technology code
 Garbage Collection is an allocated memory that is no longer needed should be
dislocated.
 It checks for frees memory no longer needed.

JAVA ARCHITECTURE
NETBEANS IDE

The java code has been written in an easy to use “NetBeans IDE”:
which is a reusable framework for simplifying the development of other desktop
applications. When an application based on the NetBeans Platform is run, the
platform's Main class is executed. Available modules are located, placed in an
in-memory registry, and the modules' start up tasks is executed. Generally, a
module's code is loaded into memory only as it is needed. Applications can
install modules dynamically. Any application can include the Update Centre
module to allow users of the application to download digitally signed upgrades
and new features directly into the running application. Reinstalling an upgrade
or a new release does not force users to download the entire application again.

MYSQL

MySQL is the most popular Open Source Relational SQL Database

Management System. MySQL is one of the best RDBMS being used for
developing various web-based software applications. MySQL is developed,
marketed and supported by MySQL AB, which is a Swedish company.
The name of MySQL is the combination of My and SQL, MySQL.
MySQL is a database management system that allows you to manage relational
databases. It is open source software backed by Oracle. It means you can use
MySQL without paying a dime. Also, if you want, you can change its source
code to suit your needs. MySQL can run on various platforms UNIX, Linux,
Windows, etc. You can install it on a server or even in a desktop. Besides,
MySQL is reliable, scalable, and fast.
MySQL is offered fewer than two different editions: the open
source MySQL Community Server and the proprietary Enterprise Server.
 MySQL Enterprise Server is differentiated by a series of proprietary extensions
which install as server plugins, but otherwise shares the version numbering
system and is built from the same code base.

Major features as available in MySQL:

 A broad subset of ANSI SQL 99, as well as extensions.
 Cross-platform support.
 Stored procedures, using a procedural language that closely adheres
to SQL/PSM.
 Triggers.
 Cursors.
 Updatable views.
 Online Data Definition Language (DDL) when using the InnoDB Storage
Engine.
 Information schema.
 Performance Schema that collects and aggregates statistics about server
execution and query performance for monitoring purposes.
 A set of SQL Mode options to control runtime behavior, including a strict mode
to better adhere to SQL standards.
 X/Open XA distributed transaction processing (DTP) support; two phase
commit as part of this, using the default InnoDB storage engine.
 Transactions with save points when using the default InnoDB Storage Engine.
The NDB Cluster Storage Engine also supports transactions.
 ACID compliance when using InnoDB and NDB Cluster Storage Engines[78]
 SSL support.
 Query caching.
 Sub-SELECTs (i.e. nested SELECTs).
 Built-in replication support
o Asynchronous replication: master-slave from one master to many slaves or
many masters to one slave.
o Semi synchronous replication: Master to slave replication where the master
waits on replication.
o Synchronous replication: Multi-master replication is provided in MySQL
Cluster.
o Virtual Synchronous: Self managed groups of MySQL servers with multi
master support can be done using: Galera Cluster or the built in Group
Replication plugin.
 Full-text indexing and searching.
 Embedded database library.
 Unicode support.
 Partitioned tables with pruning of partitions in optimizer.
 Shared-nothing clustering through MySQL Cluster.
 Multiple storage engines, allowing one to choose the one that is most effective
for each table in the application.
 Native storage engines InnoDB, MyISAM, Merge, Memory (heap), Federated,
Archive, CSV, Blackhole, NDB Cluster.
 Commit grouping, gathering multiple transactions from multiple connections
together to increase the number of commits per second.
The developers release minor updates of the MySQL Server
approximately every two months. The sources can be obtained from MySQL's
website or from MySQL's GitHub repository, both under the GPL license.
MySQL can be built and installed manually from source code, but it is
more commonly installed from a binary package unless special customizations
are required. On most Linux distributions, the package management system can
download and install MySQL with minimal effort, though further configuration
is often required to adjust security and optimization settings.
 Though MySQL began as a low-end alternative to more powerful
proprietary databases, it has gradually evolved to support higher-scale needs as
well. It is still most commonly used in small to medium scale single-server
deployments, either as a component in a LAMP-based web application or as a
standalone database server. Much of MySQL's appeal originates in its relative
simplicity and ease of use, which is enabled by an ecosystem of open source
tools such as phpMyAdmin. In the medium range, MySQL can be scaled by
deploying it on more powerful hardware, such as a multi-processor server with
gigabytes of memory.
There are, however, limits to how far performance can scale on a
single server ('scaling up'), so on larger scales, multi-server MySQL ('scaling
out') deployments are required to provide improved performance and reliability.
A typical high-end configuration can include a powerful master database which
handles data write operations and is replicated to multiple slaves that handle all
read operations. The master server continually pushes binlog events to
connected slaves so in the event of failure a slave can be promoted to become
the new master, minimizing downtime. Further improvements in performance
can be achieved by caching the results from database queries in memory
using memcached, or breaking down a database into smaller chunks
called shards which can be spread across a number of distributed server clusters.

VIRTUAL MACHINE IMAGE

In this implementation, cloud users can upload a machine image of

their own with MySQL installed, or use a ready-made machine image with an
optimized installation of MySQL on it, such as the one provided by Amazon
EC2. MySQL as a service some cloud platforms offer MySQL "as a service". In
this configuration, application owners do not have to install and maintain the
MySQL database on their own. Instead, the database service provider takes
responsibility for installing and maintaining the database, and application
owners pay according to their usage. Notable cloud-based MySQL services are
the Amazon Relational Database Service; Oracle MySQL Cloud Service, Azure
Database for MySQL, Rackspace; HP Converged
Cloud; Heroku, Jelastic and ScaleGrid for MySQL.

DATA NORMALIZATION

In this section you will learn the concepts of data normalization. The
most important thing in database designing is to make sure that the data get
properly distributed among the tables. Simply we can say that the designing of
the table in proper manner is called Normalization.
Normalization is a process that is used in relational database design to
organize data for minimizing the duplication. In normalization, we divide the
database in two or more tables and create a relationship between them. After
isolating the data we perform some addition, deletion or modification on the
fields of a table then we propagate and remove the duplicate data from the
related tables.
 The main goals of normalization process are:
- To eliminate the redundancy of data
- To make sure that the data dependencies (relationship) make sense.
By these two goals we reduce the space occupied by the duplicate data in the
database tables and ensure that the data is logically stored there.
Some of the positive points of the data normalization in database is as under :
 Data integrity
 To make optimized queries on the normalized tables and produce fast, efficient
results.
 To make faster index and also make a perfect sorting.
 To increase the performance of the database.
First normal Form (1NF)
The First Normal Form requires the atomic values in each column. Atomic
means the set of values are not available within the column. In other words, in
First Normal Form table must have at least one candidate key and make sure
that the table don’t have any duplicate record. In First Normal Form repeating
groups are not allowed, that is no attributes which occur a different number of
times on different records.
Second normal Form (2NF)
The Second Normal Form can be achieved only when a table is in the 1NF. We
can make the 2NF by eliminating the partial dependencies. As the First Normal
Form deals with only the atomicity of data, but Second Normal Form deals with
the relationships of tables like composite keys and non-key columns. In Second
Normal Form subset of data is removed and is organized in separate tables. This
process is applied to multiple rows of a table till the duplicity get reduced.
Third Normal Form (3NF)
The Third Normal Form can be achieved only when a table is in the Second
Normal Form. We can make the 3NF by eliminating all transitive dependencies
lying among the fields of a record. In Third Normal Form, all columns should
depend on the primary key only i.e. remove the column, which is not dependent
upon the primary key.
Boyce-Codd Normal Form (BCNF)
In the normalization Boyce - Codd Normal Form needs a table to meet the Third
Normal Form. In Boyce - Codd Normal Form every non-trivial functional
dependency must be a dependent on a superkey.
Fourth Normal Form (4NF)
The Fourth Normal Form can be achieved when a table meets the Boyce-Codd
Normal Form. Fourth Normal Form confirms that the independent multi valued
facts are efficiently and correctly represented in database design.
Fifth Normal Form (5NF)
The Fifth Normal Form is achieved only when a table meets the Fourth Normal
Form. In this normalization it is ensured that all non-trivial join dependencies
get eliminated.
The INSERT INTO Statement
The INSERT INTO statement is used to insert or add a record of data into the
table.
To insert records into a table, just write the key word INSERT INTO 'table
name', and write a list of column names separated by commas, followed by a
closing parenthesis then use keyword values, write the list of values enclosed in
parenthesis. One more thing we should remember always that strings should be
enclosed in single quotes, and numbers should not.
The UPDATE Statement
The UPDATE statement is used to modify the data in the database table
through specified criteria. In the given syntax of update statement the keyword
SET is used to assign a new value to selected columns. The statement also uses
WHERE clause. It simply work as a select statement, if the given criteria match
with the table content then the selected row will be effected if not then the
whole table will be effected.
The DELETE Statement
The DELETE statement is used to delete rows from a table. database will
update that is why deletion and insertion of data will be done.
The SELECT statement for SQL
SELECT key word is used to select data from a table.
WHERE Clause in SQL
WHERE clause is used with the SELECT keyword. ‘Where’ is a clause
which is used for searching the data with a particular condition. If the data in the
table matches condition then it returns the specific value of that particular data.
Aggregate Functions
In this section we are going to illustrate aggregate function, with the help
of which we can use much arithmetic operation like average, count, maximum
and many more in SQL. They are briefly described and denoted by the
keyword in the given below section. AVG, COUNT,MAX,MIN,SUM

DATA STORAGE
The main unit of data storage is a database, which is a collection of tables
with typed columns. SQL Server supports different data types, including
primary types such as Integer, Float, Decimal, Char (including character
strings), Varchar (variable length character strings), binary (for unstructured
blobs of data), Text (for textual data) among others. It also allows user-defined
composite types (UDTs) to be defined and used. SQL Server also makes server
statistics available as virtual tables and views (called Dynamic Management
Views or DMVs). A database can also contain other objects including views,
stored procedures, indexes and constraints, in addition to tables, along with a
transaction log. A SQL Server database can contain a maximum of 2 31 objects,
and can span multiple OS-level files with a maximum file size of 2 20 TB.[17] The
data in the database are stored in primary data files with an extension .mdf.
Secondary data files, identified with an .ndf extension, are used to store optional
metadata. Log files are identified with the .ldf extension.
Storage space allocated to a database is divided into sequentially
numbered pages, each 8 KB in size. A page is the basic unit of I/O for SQL
Server operations. A page is marked with a 96-byte header which stores
metadata about the page including the page number, page type, free space on
the page and the ID of the object that owns it. Page type defines the data
contained in the page - data stored in the database, index, allocation map which
holds information about how pages are allocated to tables and indexes, change
map which holds information about the changes made to other pages since last
backup or logging, or contain large data types such as image or text. While page
is the basic unit of an I/O operation, space is actually managed in terms of an
extent which consists of 8 pages.
A database object can either span all 8 pages in an extent ("uniform
extent") or share an extent with up to 7 more objects ("mixed extent"). A row in
a database table cannot span more than one page, so is limited to 8 KB in size.
However, if the data exceeds 8 KB and the row contains Varchar or Varbinary
data, the data in those columns are moved to a new page (or possibly a sequence
of pages, called an Allocation unit) and replaced with a pointer to the data. [For
physical storage of a table, its rows are divided into a series of partitions
(numbered 1 to n). The partition size is user defined; by default all rows are in a
single partition. A table is split into multiple partitions in order to spread a
database over a cluster.
Rows in each partition are stored in either B-tree or heap
structure. If the table has an associated index to allow fast retrieval of rows, the
rows are stored in-order according to their index values, with a B-tree providing
the index. The data is in the leaf node of the leaves, and other nodes storing the
index values for the leaf data reachable from the respective nodes. If the index
is non-clustered, the rows are not sorted according to the index keys. An
indexed view has the same storage structure as an indexed table. A table without
an index is stored in an unordered heap structure. Both heaps and B-trees can
span multiple allocation units.

NETWORK SECURITY

Network security consists of the provisions made in an underlying

computer network infrastructure, policies adopted by the network administrator
to protect the network and the network-accessible resources from unauthorized
access, and consistent and continuous monitoring and measurement of its
effectiveness (or lack) combined together.
Comparison with information security
The terms network security and information security are often used
interchangeably, however network security is generally taken as providing
protection at the boundaries of an organization, keeping the intruders (e.g. black
hat hackers, script kiddies, etc.) out. Network security systems today are mostly
effective, so the focus has shifted to protecting resources from attack or simple
mistakes by people inside the organization, e.g. with Data Loss Prevention
(DLP). One response to this insider threat in network security is to
compartmentalize large networks, so that an employee would have to cross an
internal boundary and be authenticated when they try to access privileged
information. Information security is explicitly concerned with all aspects of
protecting information resources, including network security and DLP.
Network security concepts
Network security starts from authenticating any user, commonly (one factor
authentication) with a username and a password (something you know). With
two factor authentication something you have is also used (e.g. a security token
or 'dongle', an ATM card, or your mobile phone), or with three factor
authentication something you are is also used (e.g. a fingerprint or retinal scan).
Once authenticated, a stateful firewall enforces access policies such as what
services are allowed to be accessed by the network users. Though effective to
prevent unauthorized access, this component fails to check potentially harmful
content such as computer worms being transmitted over the network. An
intrusion prevention system (IPS) helps detect and inhibit the action of such
malware. An anomaly-based intrusion detection system also monitors network
traffic for Suspicious content, unexpected traffic and other anomalies to protect
the network e.g. from denial of service attacks or an employee accessing files at
strange times. Communication between two hosts using the network could be
encrypted to maintain privacy. Individual events occurring on the network could
be tracked for audit purposes and for a later high level analysis.
Honeypots, essentially decoy network-accessible resources, could be deployed
in a network as surveillance and early-warning tools. Techniques used by the
attackers that attempt to compromise these decoy resources are studied during
and after an attack to keep an eye on new exploitation techniques. Such analysis
could be used to further tighten security of the actual network being protected
by the honeypot.
A useful summary of standard concepts and methods in network security is
given in the form of an extensible ontology of network security attacks.
Security management
Security Management for networks is different for all kinds of situations. A
small home or an office would only require basic security while large
businesses will require high maintenance and advanced software and hardware
to prevent malicious attacks from hacking and spamming.

Network security Overview

You will find here network security overview, networking solutions, anti virus,
anti spamming tips, trojan horses, malware, adware. Security is an essential
element in maintaining any network. The main focus of the IT managers and
computer network administrators is to secure the computer networks.

Users are happy to get the data on time and without any problem. The use of the
authentication and biometrics can improve the security to some extend.
Computer Security in the data communication cannot be compromised.
Hackers’ can exploit the sensitive and financial and corporate data. There can
be many threats to a computer network and it’s the responsibility of a computer
network administrator to keep the computer network secure from these threats.

IT Administrator should know about all the possible security attacks and also
know their solutions. IT Administrator should look for the viruses from the
Internet, Malware, Adware, Trojan horses, E-mail attachments, Floppy disk, CD
or any infected computer that is attached to the network. Spyware and network
intrusions are specifically designed to get the secret information from their
target companies, which can do harm for the company. Everyday security
threats are refined as hackers designed new security threats.
The main cause of a security threat in the small companies is the misuse of the
internet without proper anti virus, anti spyware installed on the every PC of the
company’s network. For example if a company’s employees browse an
inappropriate website, sends or receives the infected data, leaks company’s
secret information, then there are greater chances for a possible virus/malware
attack.
In my opinion, the end user’s education on the security threats, preventions and
precautionary measures are must. They should be trained about the possible and
easy virus attacks from the internet if they browse the inappropriate sites.
Another important thing is the insider’s attack e.g if the company’s employee
leave the company for any reason, then its very important that all the computer
and other company’s sensitive assets access should be revoked by him
immediately. I have personally seen a situation, when a company’s network
administrator was dismissed and he access the company’s server by VPN and
send harmful viruses to the server and the entire computer network, and it was
impossible for the IT manager to control all the security attacks in one time.
It’s the responsibility to keep a closer eye on the new employee’s activities,
their access to the sensitive data, and computers servers. IT managers should
bring it in the knowledge of the employees that any change in their computer
will be logged. So that nobody can even try to do anything that is not permitted.
There are six basic security steps for the Windows platforms. If a network
administrator can follow these steps then he/she can save the computerss from
all the possible security threats and virus or malware attacks.
First the IT managers should divide the computer network into the segments.
They should filter the access to the internet with the help of a firewall by
blocking TCP port 1433 and TCP port 1434. Internet access from the outside
should be allowed to the SQL systems. All the unwanted ports should be
blocked and only the required ports should be open for access.
Second, moderate the affect of the spoofed ports. The port 80 is the most
commonly used port.
Third, as network administrator you should install the current patches to you’re
your server computer and client’s up to date. Patches can prevent the systems
from the known vulnerabilities. Latest patches can be downloaded from the
Windows website. You can also configure to automatically update. Also third
party patches products are also available that can be tested and installed.
Additionally, by strengthening the user authentication process can be very
helpful for security purposes.. You can use password security and other
technological methods for the authenticate purpose.
Fourth, you can limit the number of the network administrators it can also be
helpful for security a computer network. Admin rights should not be given to
the local PC, until and unless it is the requirements for the applications that are
installed on the local PCs.
Fifth, protect computers against the known attacks. Don’t disable any Windows
known service such as clipbook, Telnet etc. Set the powerful permission the
shared network resources. Last, you can configure the security policies.
Implement the security policies on your network. Security measures and
methods have expenses with their purchases. Deployment, maintenance and the
implementations of these methods can increase the security cost. Some other
things which a IT administrator or a IT manager should keep in mind are the
education of the employees about the computer networking, security, use of the
encryption and digital right management software, block the unwanted emails
and audit security on the regular basis. Network security methods should be
used and implemented in order to prevent your computer network from the
unauthorized access.
Network security Objectives
The objectives in network security are to preserve the main three tenets of
security (the so-called CIA Triad). Keep the data confidential, verify integrity,
and keep it available.
Security policy
Each Internet service that you use or provide poses risks to your iSeries system
and the network to which it is connected. A security policy is a set of rules that
apply to activities for the computer and communications resources that belong
to an organization. These rules cover areas such as physical security, personnel
security, administrative security, and network security.
Your security policy defines what you want to protect and what you expect of
your system users. It provides a basis for security planning when you design
new applications or expand your current network. It describes user
responsibilities, such as protecting confidential information and creating
nontrivial passwords. Your security policy should also describe how you will
monitor the effectiveness of your security measures. Such monitoring helps you
to determine whether someone may be attempting to circumvent your
safeguards.
To develop your security policy, you must clearly define your security
objectives. Once you create a security policy, you must take steps to put into
effect the rules it contains. These steps include training employees and adding
necessary software and hardware to enforce the rules. Also, when you make
changes in your computing environment, you should update your security
policy. This is to ensure that you address any new risks that your changes
impose. You can find an example of a security policy for the JKL Toy
Company in the iSeries Information Center in the "Basic system security and
planning" topic.
Security objectives
When you create and carry out a security policy, you must have clear
objectives. Security objectives fall into one or more of these categories:
Resource protection
Your resource protection scheme ensures that only authorized users can access
objects on the system. The ability to secure all types of system resources is an
iSeries strength. You should carefully define the different categories of users
that can access your system. Also, you should define what access authorization
you want to give these groups of users as part of creating your security policy.
Authentication
The assurance or verification that the resource (human or machine) at the other
end of the session really is what it claims to be. Solid authentication defends a
system against the security risk of impersonation, in which a sender or receiver
uses a false identity to access a system. Traditionally, systems have used
passwords and user names for authentication; digital certificates can provide a
more secure method of authentication while offering other security benefits as
well. When you link your system to a public network like the Internet, user
 authentication takes on new dimensions. An important difference between the
Internet and your intranet is your ability to trust the identity of a user who signs
on. Consequently, you should consider seriously the idea of using stronger
authentication methods than traditional user name and password logon
procedures provide. Authenticated users may have different types of
permissions based on their authorization levels.
Authorization
The assurance person or computer at the other end of the session has permission
to carry out the request. Authorization is the process of determining who or
what can access system resources or perform certain activities on a system.
Usually, authorization is performed in context of authentication.
Integrity
The assurance of information is the same as what was sent out. Understanding
integrity requires you to understand the concepts of data integrity and system
integrity.
 Data integrity: Data is protected from unauthorized changes or tampering. Data
integrity defends against the security risk of manipulation, in which someone
intercepts and changes information to which he or she is not authorized. In
addition to protecting data that is stored within your network, you may need
additional security to ensure data integrity when data enters your system from
untrusted sources. When data that enters your system comes from a public
network, you may need security methods so that you can do the following:
o Protect the data from being "sniffed" and interpreted, usually by encrypting it.
o Ensure that the transmission has not been altered (data integrity).
o Prove that the transmission occurred (non-repudiation). In the future, you might
need the electronic equivalent of registered or certified mail.
 System integrity: Your system provides consistent, expected results with
expected performance. For the iSeries, system integrity is the most commonly
overlooked component of security because it is a fundamental part of iSeries
architecture. iSeries architecture, for example, makes it extremely difficult for a
mischief-maker to imitate or change an operating system program when you use
security level 40 or 50.
Non-repudiation
Non-repudiation is proof that a transaction occurred, or that you sent or received
a message. The use of digital certificates and public key cryptography to "sign"
transactions, messages, and documents supports non-repudiation. Both the
sender and the receiver agree that the exchange took place. The digital signature
on the data provides the necessary proof.
Confidentiality
The assurance of sensitive information remains private and is not visible to an
eavesdropper. Confidentiality is critical to total data security. Encrypting data
by using digital certificates and the Secure Socket Layer (SSL) helps ensure
confidentiality when transmitting data across untrusted networks. Your security
policy should address how you will provide confidentiality for information
within your network as well as when information leaves your network.
Auditing security activities
Monitoring security-relevant events provide a log of both successful and
unsuccessful (denied) access. Successful access records tell you who is doing
what on your systems. Unsuccessful (denied) access records tell you either that
someone is attempting to break your security or that someone is having
difficulty accessing your system.
Understanding your security objectives helps you create a security policy that
covers all your networking and Internet security needs. You may find it helpful
to review the JKL Toy Company e-business scenario as you define your
objectives and create your security policy. The scenario company's Internet
usage and security plan is representative of many real world implementations.
Network Security Applications
Network Security / Vulnerability Analysis Applications:
This project team is developing security suites for the enterprise network and a
typical intranet. The application monitors the network with sniffers and
generates customised log reports for the network traffic under analysis. The
objectives are to capture the network status during a given period of time with
the service point of view, monitoring for vulnerabilities and identifying
intruders. The application includes an administrative perspective and to generate
performance of the network as a whole.
AU-KBC Sniffer Suite:
A customised sniffer suite will administer ethernet packets in the network.
Customisation shall be addressed based on the need of the enterprise and the
business rules, to identify and extract information on relevant data. A
customisable log analyser interfaces with the sniffer application and generates a
variety of reports. This analyser can be configured to generate alert
messages, periodic reporting on a priority basis, and a variety of notifications.
Current improvements include sniffers reach to wider networks and enhance the
activity log mechanism. This suite is very useful for administrators monitoring
for vulnerabilities in the network, for law enforcement agencies enforcing the
law, protecting the enterprise resources using service alert calls on unknown
member entry / intruder attacks and others. This is piloted at several
government agencies in India.
Network Status Analyser:
This application generates the status of a network in a given instant of time.
This will monitor and service ecommerce and network appliances in tasks like
status of a web server, database server, mail server etc. This can monitor with
the performance details of a router, switch, gateway etc as well. This
application will generate the status of a service or of a network entity for a
specified period of time as well.
FEASIBILITY STUDY

For any project to be successful there is a need for an effective feasibility

study. The purpose of feasibility study is not to solve the problem but to
determine whether the problem is worth solving. During the feasibility analysis,
operational feasibility study is a must because according to Software
Engineering principles, a system should have a high usability. The proposed
system is the detection of outliers from the large data sets. This system
operationally satisfies the need what the user expects. The system designed is
easily understandable. Based on the above study, the system is proved to be
operationally feasible.
The proposed system has been implemented in JAVA and provides a look and
feel interface to the users, and in addition uses apache tomcat database for the
storage of instance values found during the extraction process. Users are already
familiar in using the software. Moreover this tool is designed in such a way that
it can be further extended to its own requirement. The hardware and the
software required for the proposed system is already available. So, the system
development is technically feasible.
For Backend we are using database ORACLE 10g which is more efficient than
any other databases. Since oracle had acquired Sun Microsystems in 2010 both
JAVA and ORACLE are integrated and optimized. As both were compatible we
can have better frontend and backend usages for processes. Early examples
include the Oracle Exadata Database Machine X2-8, and the first Oracle
Exalogic Elastic Cloud, both introduced in late 2010. During 2011, Oracle
introduced the SPARC SuperCluster T4-4, a general-purpose, engineered
system with Oracle Solaris that delivered record-breaking performance on a
series of enterprise benchmarks. Oracle's SPARC-based systems are some of the
most scalable, reliable, and secure products available today. Sun's prized
software portfolio has continued to develop as well, with new releases of Oracle
Solaris, and the recent introduction of Java 7. Oracle invests in innovation by
designing hardware and software systems that are engineered to work together.
The most important aspect of the feasibility study includes the economic
feasibility. JAVA and apache tomcat are popular open source software which is
freely downloadable; the memory requirement of this software together is also
not expensive. Also the installation of these application is very easy and user
friendly. Hence this software does not incur any additional coast. Hence the
application is economically feasible.

6. SYSTEM DESIGN
6.1DATAFLOW DIAGRAM

6.2 TABLE DESIGN

7. SYSTEM TESTING

The purpose of testing is to discover errors. Testing is the process

of trying to discover every conceivable fault or weakness in the work product. It
provides a way to check the functionality of components, sub-assemblies, and a
finished product. It is the process of exercising software with the intent of
ensuring that the software system meets its requirements and user expectations
and does not fail in an unacceptable manner. There are various types of test.
Each type addresses a specific testing requirement.

DEVELOPING METHODOLOGIES

The test process is initiated by developing a comprehensive plan to test

the general functionality and special features on a variety of platform
combinations. Strict quality control procedures are used. The process verifies
that the application meets the requirements specified in the system requirements
document and is bug free. The following are the considerations used to develop
the framework from developing the testing methodologies.

TESTING METHODS
BLACK-BOX TESTING
 The technique of testing without having any knowledge of the interior
workings of the application is called black-box testing. The tester is oblivious to
the system architecture and does not have access to the source code. Typically,
while performing a black-box test, a tester will interact with the system's user
interface by providing inputs and examining outputs without knowing how and
where the inputs are worked upon.

ADVANTAGES

 Well suited and efficient for large code segments.

 Code access is not required.
 Clearly separates user's perspective from the developer's perspective through
visibly defined roles.
 Large numbers of moderately skilled testers can test the application with no
knowledge of implementation, programming language, or operating systems.

WHITE-BOX TESTING

White-box testing is the detailed investigation of internal logic and

structure of the code. White-box testing is also called glass testing or open-box
testing. In order to perform white-box testing on an application, a tester needs to
know the internal workings of the code. The tester needs to have a look inside
the source code and find out which unit/chunk of the code is behaving
inappropriately.

ADVANTAGES:
 As the tester has knowledge of the source code, it becomes very easy to
find out which type of data can help in testing the application effectively. It
helps in optimizing the code.
Extra lines of code can be removed which can bring in hidden defects. Due to
the tester's knowledge about the code, maximum coverage is attained during test
scenario writing.

GREY-BOX TESTING

Grey-box testing is a technique to test the application with having a

limited knowledge of the internal workings of an application. In software
testing, the phrase the more you know, the better carries a lot of weight while
testing an application. Mastering the domain of a system always gives the tester
an edge over someone with limited domain knowledge. Unlike black-box
testing, where the tester only tests the application's user interface; in grey-box
testing, the tester has access to design documents and the database. Having this
knowledge, a tester can prepare better test data and test scenarios while making
a test plan.

Functional Testing types include:

 Unit Testing
 Integration Testing
 System Testing
 Sanity Testing
 Smoke Testing
 Interface Testing
 Regression Testing
 Beta/Acceptance Testing
 Non-functional Testing types include:

 Performance Testing
 Load Testing
 Stress Testing
 Volume Testing
 Security Testing
 Compatibility Testing
 Install Testing
 Recovery Testing
 Reliability Testing
 Usability Testing
 Compliance Testing
 Localization Testing

ALPHA TESTING

It is the most common type of testing used in the Software industry.

The objective of this testing is to identify all possible issues or defects before
releasing it into the market or to the user. Alpha Testing is carried out at the end
of the software development phase but before the Beta Testing. Still, minor
design changes may be made as a result of such testing. Alpha Testing is
conducted at the developer’s site. In-house virtual user environment can be
created for this type of testing.

ACCEPTANCE TESTING
 An Acceptance Test is performed by the client and verifies whether
the end to end the flow of the system is as per the business requirements or not
and if it is as per the needs of the end-user. Client accepts the software only
when all the features and functionalities work as expected. It is the last phase of
the testing, after which the software goes into production. This is also called
User Acceptance Testing (UAT).

ACCESSIBILITY TESTING

The aim of Accessibility Testing is to determine whether the software

or application is accessible for disabled people or not. Here, disability means
deaf, color blind, mentally disabled, blind, old age and other disabled groups.
Various checks are performed such as font size for visually disabled, color and
contrast for color blindness, etc.

BETA TESTING

Beta Testing is a formal type of Software Testing which is carried out

by the customer. It is performed in the Real Environment before releasing the
product to the market for the actual end-users.
Beta Testing is carried out to ensure that there are no major failures in
the software or product and it satisfies the business requirements from an end-
user perspective. Beta Testing is successful when the customer accepts the
software.
Usually, this testing is typically done by end-users or others. It is the
final testing done before releasing an application for commercial purpose.
Usually, the Beta version of the software or product released is limited to a
certain number of users in a specific area. So end-user actually uses the software
and shares the feedback to the company. Company then takes necessary action
before releasing the software to the worldwide.

BACK-END TESTING

Whenever an input or data is entered on front-end application, it stores

in the database and the testing of such database is known as Database Testing or
Backend Testing.
There are different databases like SQL Server, MySQL, and Oracle, etc.
Database Testing involves testing of table structure, schema, stored procedure,
data structure and so on.
In Back-end Testing GUI is not involved, testers are directly
connected to the database with proper access and testers can easily verify data
by running a few queries on the database. There can be issues identified like
data loss, deadlock, data corruption etc during this back-end testing and these
issues are critical to fixing before the system goes live into the production
environment.

BROWSER COMPATIBILITY TESTING

It is a subtype of Compatibility Testing (which is explained below)

and is performed by the testing team.
Browser Compatibility Testing is performed for web applications and it ensures
that the software can run with the combination of different browser and
operating system. This type of testing also validates whether web application
runs on all versions of all browsers or not.

BACKWARD COMPATIBILITY TESTING

 It is a type of testing which validates whether the newly developed
software or updated software works well with the older version of the
environment or not. Backward Compatibility Testing checks whether the new
version of the software works properly with file format created by an older
version of the software; it also works well with data tables, data files, data
structure created by the older version of that software. If any of the software is
updated then it should work well on top of the previous version of that software.

COMPARISON TESTING

Comparison of a product's strength and weaknesses with its previous

versions or other similar products is termed as Comparison Testing.

COMPATIBILITY TESTING

It is a testing type in which it validates how software behaves and runs

in a different environment, web servers, hardware, and network environment.
Compatibility testing ensures that software can run on a different configuration,
different database, different browsers, and their versions. Compatibility testing
is performed by the testing team.

COMPONENT TESTING

It is mostly performed by developers after the completion of unit

testing. Component Testing involves testing of multiple functionalities as a
single code and its objective is to identify if any defect exists after connecting
those multiple functionalities with each other.
END-TO-END TESTING

Similar to system testing, End-to-End Testing involves testing of a

complete application environment in a situation that mimics real-world use,
such as interacting with a database, using network communications, or
interacting with other hardware, applications, or systems if appropriate.

EQUIVALENCE PARTITIONING

It is a testing technique and a type of Black Box Testing. During

this Equivalence Partitioning, a set of the group is selected and a few values or
numbers are picked up for testing. It is understood that all values from that
group generate the same output.
The aim of this testing is to remove redundant test cases within a specific group
which generates the same output but not any defect.
Suppose, the application accepts values between -10 to +10 so using
equivalence partitioning the values picked up for testing are zero, one positive
value, one negative value. So the Equivalence Partitioning for this testing is -10
to -1, 0, and 1 to 10.

EXAMPLE TESTING

It means real-time testing. Example Testing includes the real-time

scenario, it also involves the scenarios based on the experience of the testers.

EXPLORATORY TESTING

Exploratory Testing is informal testing performed by the testing team.

The objective of this testing is to explore the application and looking for defects
that exist in the application Sometimes it may happen that during this testing
major defect discovered can even cause a system failure. During Exploratory
Testing, it is advisable to keep a track of what flow you have tested and what
activity you did before the start of the specific flow.
An Exploratory Testing technique is performed without documentation and test
cases.

FUNCTIONAL TESTING

This type of testing ignores the internal parts and focuses only on the
output to check if it is as per the requirement or not. It is a Black-box type
testing geared to the functional requirements of an application.

GRAPHICAL USER INTERFACE (GUI) TESTING

The objective of this GUI Testing is to validate the GUI as per the
business requirement. The expected GUI of the application is mentioned in the
Detailed Design Document and GUI mockup screens. The GUI Testing includes
the size of the buttons and input field present on the screen, alignment of all
text, tables, and content in the tables. It also validates the menu of the
application, after selecting different menu and menu items, it validates that the
page does not fluctuate and the alignment remains same after hovering the
mouse on the menu or sub-menu.

GORILLA TESTING

Gorilla Testing is a testing type performed by a tester and sometimes by

the developer the as well. In Gorilla Testing, one module or the functionality in
the module is tested thoroughly and heavily. The objective of this testing is to
check the robustness of the application.

HAPPY PATH TESTING

The objective of Happy Path Testing is to test an application

successfully on a positive flow. It does not look for negative or error conditions.
The focus is only on the valid and positive inputs through which application
generates the expected output.

INCREMENTAL INTEGRATION TESTING

Incremental Integration Testing is a Bottom-up approach for testing

i.e continuous testing of an application when new functionality is added.
Application functionality and modules should be independent enough to test
separately. This is done by programmers or by testers.

INSTALL/UNINSTALL TESTING

Installation and Uninstallation Testing is done on full, partial, or

upgrade install/uninstall processes on different operating systems under
different hardware or software environment.

INTEGRATION TESTING

Testing of all integrated modules to verify the combined functionality

after integration is termed as Integration Testing. Modules are typically code
modules, individual applications, client and server applications on a network,
etc. This type of testing is especially relevant to client/server and distributed
systems.

LOAD TESTING

It is a type of Non-Functional Testing and the objective of Load

Testing is to check how much load or maximum workload a system can handle
without any performance degradation. Load Testing helps to find the maximum
capacity of the system under specific load and any issues that cause software
performance degradation. Load testing is performed using tools like JMeter,
LoadRunner, WebLoad, Silk performer, etc.

MONKEY TESTING

Monkey Testing is carried out by a tester assuming that if the monkey

uses the application then how random input, values will be entered by the
Monkey without any knowledge or understanding of the application. The
objective of Monkey Testing is to check if an application or system gets crashed
by providing random input values/data. Monkey Testing is performed randomly
and no test cases are scripted.
Non-Functional Testing involves testing of non-functional requirements
such as Load Testing, Stress Testing, Security, Volume, Recovery Testing, etc.
The objective of NFT testing is to ensure whether the response time of software
or application is quick enough as per the business requirement. It should not
take much time to load any page or system and should sustain during peak load.

PERFORMANCE TESTING
 This term is often used interchangeably with ‘stress' and ‘load'
testing. Performance Testing is done to check whether the system meets the
performance requirements. Different performance and load tools are used to do
this testing.

RECOVERY TESTING

It is a type of testing which validates how well the application or

system recovers from crashes or disasters. Recovery Testing determines if the
system is able to continue the operation after a disaster. Assume that application
is receiving data through the network cable and suddenly that network cable has
been unplugged. Sometime later, plug the network cable; then the system
should start receiving data from where it lost the connection due to network
cable unplugged.

REGRESSION TESTING

Testing an application as a whole for the modification in any module

or functionality is termed as Regression Testing. It is difficult to cover all the
system in Regression Testing, so typically Automation Testing Tools are used
for these types of testing.

RISK-BASED TESTING (RBT)

In Risk-Based Testing, the functionalities or requirements are tested

based on their priority. Risk-Based Testing includes testing of highly critical
functionality, which has the highest impact on business and in which the
probability of failure is very high. The priority decision is based on the business
need, so once priority is set for all functionalities then high priority functionality
or test cases are executed first followed by medium and then low priority
functionalities. The low priority functionality may be tested or not tested based
on the available time. The Risk-Based Testing is carried out if there is
insufficient time available to test entire software and software needs to be
implemented on time without any delay. This approach is followed only by the
discussion and approval of the client and senior management of the
organization.

SANITY TESTING

Sanity Testing is done to determine if a new software version is

performing well enough to accept it for a major testing effort or not. If an
application is crashing for the initial use then the system is not stable enough for
further testing. Hence a build or an application is assigned to fix it.

SECURITY TESTING

It is a type of testing performed by a special team of testers. A system

can be penetrated by any hacking way. Security Testing is done to check how
the software or application or website is secure from internal and external
threats. This testing includes how much software is secure from the malicious
program, viruses and how secure and strong the authorization and
authentication processes are. It also checks how software behaves for any
hackers attack and malicious programs and how software is maintained for data
security after such a hacker attack.

SMOKE TESTING
 Whenever a new build is provided by the development team then the
Software Testing team validates the build and ensures that no major issue exists.

SYSTEM TESTING

Under System Testing technique, the entire system is tested as per the
requirements. It is a Black-box type Testing that is based on overall requirement
specifications and covers all the combined parts of a system.

UNIT TESTING

Testing of an individual software component or module is termed as Unit

Testing. It is typically done by the programmer and not by testers, as it requires
detailed knowledge of the internal program design and code. It may also require
developing test driver modules or test harnesses.

USABILITY TESTING

Under Usability Testing, User-friendliness check is done. The

application flow is tested to know if a new user can understand the application
easily or not, Proper help documented if a user gets stuck at any point.
Basically, system navigation is checked in this testing.

VULNERABILITY TESTING

The testing which involves identifying weakness in the software, hardware

and the network is known as Vulnerability Testing. Malicious programs, the
hacker can take control of the system, if it is vulnerable to such kind of attacks,
viruses, and worms. So it is necessary to check if those systems undergo
Vulnerability Testing before production. It may identify critical defects, flaws in
the security.

VOLUME TESTING

Volume Testing is a type of Non-Functional Testing performed by the

Performance Testing team. The software or application undergoes a huge
amount of data and Volume Testing checks the system behaviour and response
time of the application when the system came across such a high volume of
data. This high volume of data may impact the system’s performance and speed
of the processing time.

8. SOURCE CODE

/*

* To change this license header, choose License Headers in Project Properties.

* To change this template file, choose Tools | Templates

* and open the template in the editor.

*/

/**

* @author

*/

public class USER1 extends [Link] {

/**

* Creates new form client

*/
 public USER1() {

initComponents();

/**

* This method is called from within the constructor to initialize the form.

* WARNING: Do NOT modify this code. The content of this method is always

* regenerated by the Form Editor.

*/

@SuppressWarnings("unchecked")

// <editor-fold defaultstate="collapsed" desc="Generated Code">

private void initComponents() {

jLabel1 = new [Link]();

jScrollPane1 = new [Link]();

jTextArea1 = new [Link]();

jButton2 = new [Link]();

jTextField1 = new [Link]();

jLabel2 = new [Link]();

setDefaultCloseOperation([Link].EXIT_ON_CLOSE);

getContentPane().setLayout(null);

[Link](new [Link]("Tahoma", 1, 18)); // NOI18N

[Link](new [Link](255, 255, 255));

[Link]("USER 1");

getContentPane().add(jLabel1);
 [Link](420, 20, 130, 26);

[Link](20);

[Link](5);

[Link](jTextArea1);

getContentPane().add(jScrollPane1);

[Link](120, 80, 735, 140);

[Link](new [Link]("Tahoma", 1, 18)); // NOI18N

[Link](new [Link](51, 0, 51));

[Link]("SEND");

getContentPane().add(jButton2);

[Link](360, 320, 230, 60);

getContentPane().add(jTextField1);

[Link](220, 240, 530, 40);

[Link](new [Link](getClass().getResource("/[Link]"))); // NOI18N

getContentPane().add(jLabel2);

[Link](0, 0, 1100, 440);

pack();

}// </editor-fold>

/**

* @param args the command line arguments

*/
 public static void main(String args[]) {

/* Set the Nimbus look and feel */

//<editor-fold defaultstate="collapsed" desc=" Look and feel setting code (optional) ">

/* If Nimbus (introduced in Java SE 6) is not available, stay with the default look and feel.

* For details see [Link]

*/

try {

for ([Link] info :

[Link]()) {

if ("Nimbus".equals([Link]())) {

[Link]([Link]());

break;

} catch (ClassNotFoundException ex) {

[Link]([Link]()).log([Link],
null, ex);

} catch (InstantiationException ex) {

[Link]([Link]()).log([Link],
null, ex);

} catch (IllegalAccessException ex) {

[Link]([Link]()).log([Link],
null, ex);

} catch ([Link] ex) {

[Link]([Link]()).log([Link],
null, ex);

//</editor-fold>
 /* Create and display the form */

[Link](new Runnable() {

public void run() {

new USER1().setVisible(true);

});

// Variables declaration - do not modify

private [Link] jButton2;

private [Link] jLabel1;

private [Link] jLabel2;

private [Link] jScrollPane1;

private [Link] jTextArea1;

private [Link] jTextField1;

// End of variables declaration

}/*

* To change this license header, choose License Headers in Project Properties.

* To change this template file, choose Tools | Templates

* and open the template in the editor.

*/

/**

* @author sivagnanam

*/

public class TOWER1 extends [Link] {

 /**

* Creates new form subserver1

*/

public TOWER1() {

initComponents();

/**

* This method is called from within the constructor to initialize the form.

* WARNING: Do NOT modify this code. The content of this method is always

* regenerated by the Form Editor.

*/

@SuppressWarnings("unchecked")

// <editor-fold defaultstate="collapsed" desc="Generated Code">

private void initComponents() {

jLabel1 = new [Link]();

jScrollPane1 = new [Link]();

jTextArea1 = new [Link]();

jScrollPane2 = new [Link]();

jTextArea2 = new [Link]();

jLabel2 = new [Link]();

setDefaultCloseOperation([Link].EXIT_ON_CLOSE);

getContentPane().setLayout(null);
 [Link](new [Link]("Tahoma", 1, 18)); // NOI18N

[Link](new [Link](255, 255, 255));

[Link]("SUBSERVER");

getContentPane().add(jLabel1);

[Link](360, 30, 230, 30);

[Link](20);

[Link](5);

[Link](jTextArea1);

getContentPane().add(jScrollPane1);

[Link](60, 70, 470, 270);

[Link](20);

[Link](5);

[Link](jTextArea2);

getContentPane().add(jScrollPane2);

[Link](560, 70, 270, 270);

[Link](new [Link](getClass().getResource("/[Link]"))); // NOI18N

getContentPane().add(jLabel2);

[Link](0, 0, 860, 410);

pack();

}// </editor-fold>
 /**

* @param args the command line arguments

*/

public static void main(String args[]) {

/* Set the Nimbus look and feel */

//<editor-fold defaultstate="collapsed" desc=" Look and feel setting code (optional) ">

/* If Nimbus (introduced in Java SE 6) is not available, stay with the default look and feel.

* For details see [Link]

*/

try {

for ([Link] info :

[Link]()) {

if ("Nimbus".equals([Link]())) {

[Link]([Link]());

break;

} catch (ClassNotFoundException ex) {

[Link]([Link]()).log([Link], null,
ex);

} catch (InstantiationException ex) {

[Link]([Link]()).log([Link], null,
ex);

} catch (IllegalAccessException ex) {

[Link]([Link]()).log([Link], null,
ex);

} catch ([Link] ex) {

[Link]([Link]()).log([Link], null,
ex);

//</editor-fold>

/* Create and display the form */

[Link](new Runnable() {

public void run() {

new TOWER1().setVisible(true);

});

// Variables declaration - do not modify

private [Link] jLabel1;

private [Link] jLabel2;

private [Link] jScrollPane1;

private [Link] jScrollPane2;

private [Link] jTextArea1;

private [Link] jTextArea2;

// End of variables declaration

}/*

* To change this license header, choose License Headers in Project Properties.

* To change this template file, choose Tools | Templates

* and open the template in the editor.

*/
/**

* @author sivagnanam

*/

public class SERVER extends [Link] {

/**

* Creates new form mainserver

*/

public SERVER() {

initComponents();

/**

* This method is called from within the constructor to initialize the form.

* WARNING: Do NOT modify this code. The content of this method is always

* regenerated by the Form Editor.

*/

@SuppressWarnings("unchecked")

// <editor-fold defaultstate="collapsed" desc="Generated Code">

private void initComponents() {

jLabel1 = new [Link]();

jButton1 = new [Link]();

jScrollPane2 = new [Link]();

jTextArea2 = new [Link]();

jButton2 = new [Link]();

 jScrollPane1 = new [Link]();

jTextArea1 = new [Link]();

jLabel2 = new [Link]();

setDefaultCloseOperation([Link].EXIT_ON_CLOSE);

getContentPane().setLayout(null);

[Link](new [Link]("Tahoma", 1, 18)); // NOI18N

[Link](new [Link](255, 255, 255));

[Link](" SERVER");

getContentPane().add(jLabel1);

[Link](450, 10, 370, 40);

[Link](new [Link]("Tahoma", 1, 18)); // NOI18N

[Link](new [Link](51, 0, 51));

[Link]("ALLOCATE");

[Link](new [Link]() {

public void actionPerformed([Link]) {

jButton1ActionPerformed(evt);

});

getContentPane().add(jButton1);

[Link](130, 440, 270, 60);

[Link](20);

[Link](5);

[Link](jTextArea2);
getContentPane().add(jScrollPane2);

[Link](60, 60, 430, 300);

[Link](new [Link]("Tahoma", 1, 18)); // NOI18N

[Link](new [Link](51, 0, 51));

[Link]("PROCESS DETAILS");

getContentPane().add(jButton2);

[Link](620, 430, 270, 60);

[Link](20);

[Link](5);

[Link](jTextArea1);

getContentPane().add(jScrollPane1);

[Link](540, 60, 430, 300);

[Link](new [Link](getClass().getResource("/[Link]"))); // NOI18N

getContentPane().add(jLabel2);

[Link](0, 0, 1000, 570);

pack();

}// </editor-fold>

private void jButton1ActionPerformed([Link]) {

// TODO add your handling code here:

}
 /**

* @param args the command line arguments

*/

public static void main(String args[]) {

/* Set the Nimbus look and feel */

//<editor-fold defaultstate="collapsed" desc=" Look and feel setting code (optional) ">

/* If Nimbus (introduced in Java SE 6) is not available, stay with the default look and feel.

* For details see [Link]

*/

try {

for ([Link] info :

[Link]()) {

if ("Nimbus".equals([Link]())) {

[Link]([Link]());

break;

} catch (ClassNotFoundException ex) {

[Link]([Link]()).log([Link],
null, ex);

} catch (InstantiationException ex) {

[Link]([Link]()).log([Link],
null, ex);

} catch (IllegalAccessException ex) {

[Link]([Link]()).log([Link],
null, ex);

} catch ([Link] ex) {

 [Link]([Link]()).log([Link],
null, ex);

//</editor-fold>

/* Create and display the form */

[Link](new Runnable() {

public void run() {

new SERVER().setVisible(true);

});

// Variables declaration - do not modify

private [Link] jButton1;

private [Link] jButton2;

private [Link] jLabel1;

private [Link] jLabel2;

private [Link] jScrollPane1;

private [Link] jScrollPane2;

private [Link] jTextArea1;

private [Link] jTextArea2;

// End of variables declaration

}
9. SCREENSHOT

[Link]

Cloud Internet of Things (CoT) promises to expand the possibilities of

application of IoT systems in different domains by leveraging on lower latency
requirements and distributed coverage areas. This expansion is not without
challenges, as various network attacks tend to exploit the vast network interface
and cause harm to the system. To curb the possible damage that successful
attacks can cause to the information system and devices, we propose an
Intrusion Detection System (IDS) implemented using transfer learning based on
the CNN algorithm to detect and prevent network intrusion on CoT devices.
First, two primary IDS datasets, CIC-IDS2017 and CSE-CICIDS2018, were
selected for the research. Since CNN works better on images, the numerical
dataset was transformed after cleaning into a set of images measuring 256 X
256 X 3, obtaining 19055 and 16984 images for the CIC-IDS2017 and CSE-
CIC-IDS2018 datasets, respectively. Secondly, five different pre-trained models
of the CNN architecture, including VGG16, VGG19, InceptinV3,
MobileNetV3Small, and EfficientNetV2B0, and one custom CNN algorithm
were tested on the image datasets.

REFERENCES

[1] U. O. Matthew, J. S. Kazaure, A. Onyebuchi, O. O. Daniel, I. H.

Muhammed, and N. U. Okafor, ‘‘Artificial intelligence autonomous unmanned
aerial vehicle (UAV) system for remote sensing in security surveillance,’’ in
Proc. IEEE 2nd Int. Conf. Cyberspace (CYBER NIGERIA), Feb. 2021, pp. 1–
10.
[2] J. Meyer and S. Boll, ‘‘Smart health systems for personal health action
plans,’’ in Proc. IEEE 16th Int. Conf. e-Health Netw., Appl. Services
(Healthcom), Oct. 2014, pp. 404–410.
[3] M. Kasmi, F. Bahloul, and H. Tkitek, ‘‘Smart home based on Internet of
Things and cloud computing,’’ in Proc. 7th Int. Conf. Sci. Electron., Technol.
Inf. Telecommun. (SETIT), Dec. 2016, pp. 82–86.
[4] L. Yushi, J. Fei, and Y. Hui, ‘‘Study on application modes of military
Internet of Things (MIOT),’’ in Proc. IEEE Int. Conf. Comput. Sci. Automat.
Eng. (CSAE), vol. 3, May 2012, pp. 630–634.
[5] Y. Zixuan, W. Zhifang, and L. Chang, ‘‘Research on marine environmental
monitoring system based on the Internet of Things technology,’’ in Proc. IEEE
Int. Conf. Electron. Inf. Commun. Technol. (ICEICT), Aug. 2016, pp. 121–125.
[6] M. Masoumi, H. R. D. Oskouei, M. M. Shirkolaei, and A. R. Mirtaheri,
‘‘Substrate integrated waveguide leaky wave antenna with circular polarization
and improvement of the scan angle,’’ Microw. Opt. Technol. Lett., vol. 64, no.
1, pp. 137–141, Jan. 2022.
[7] M. M. Shirkolaei and J. Ghalibafan, ‘‘Magnetically scannable slotted
waveguide antenna based on the ferrite with gain enhancement,’’ Waves
Random Complex Media, pp. 1–11, 2021.
[8] M. M. Shirkolaei, H. R. D. Oskouei, and M. Abbasi, ‘‘Design of 1∗4
microstrip antenna array on the human thigh with gain enhancement,’’ IETE J.
Res., pp. 1–7, 2021, doi: 10.1080/03772063.2021.2004459. 1036 VOLUME 11,
2023 O. D. Okey et al.: Transfer Learning Approach to IDS on Cloud IoT
Devices Using Optimized CNN
[9] C. Cambra, S. Sendra, J. Lloret, and L. Garcia, ‘‘An IoT service-oriented
system for agriculture monitoring,’’ in Proc. IEEE Int. Conf. Commun. (ICC),
May 2017, pp. 1–6.
[10] GSMA. Gsma|the Mobile Economy—The Mobile Economy. Accessed:
Jul. 24, 2022. [Online]. Available: [Link] [Link]/mobileeconomy/
[11] S. Hakak, S. A. Latif, and G. Amin, ‘‘A review on mobile cloud computing
and issues in it,’’ Int. J. Comput. Appl., vol. 75, no. 11, pp. 1–4, 2013.
[12] M. Aazam and E.-N. Huh, ‘‘Fog computing and smart gateway based
communication for cloud of things,’’ in Proc. Int. Conf. Future Internet Things
Cloud, Aug. 2014, pp. 464–470.
[13] M. P. K. Shelke, M. S. Sontakke, and A. D. Gawande, ‘‘Intrusion detection
system for cloud computing,’’ Int. J. Sci. Technol. Res., vol. 1, no. 4, pp. 67–71,
2012.
[14] A. Patel, M. Taghavi, K. Bakhtiyari, and J. C. JúNior, ‘‘An intrusion
detection and prevention system in cloud computing: A systematic review,’’ J.
Netw. Comput. Appl., vol. 36, no. 1, pp. 25–41, 2013.
[15] V. Chang, L. Golightly, P. Modesti, Q. A. Xu, L. M. T. Doan, K. Hall, S.
Boddu, and A. Kobusińska, ‘‘A survey on intrusion detection systems for fog
and cloud computing,’’ Future Internet, vol. 14, no. 3, p. 89, Mar. 2022.
[16] P. F. De Araujo-Filho, G. Kaddoum, D. R. Campelo, A. G. Santos, D.
Macedo, and C. Zanchettin, ‘‘Intrusion detection for cyber–physical systems
using generative adversarial networks in fog environment,’’ IEEE Internet
Things J., vol. 8, no. 8, pp. 6247–6256, Apr. 2021.
[17] F. Lin, Y. Zhou, X. An, I. You, and K. Choo, ‘‘Fair resource allocation in
an intrusion-detection system for edge computing: Ensuring the security of
Internet of Things devices,’’ IEEE Consum. Electron. Mag., vol. 7, no. 6, pp.
45–50, Nov. 2018.
[18] L. Nie, Y. Wu, X. Wang, L. Guo, G. Wang, X. Gao, and S. Li, ‘‘Intrusion
detection for secure social Internet of Things based on collaborative edge
computing: A generative adversarial network-based approach,’’ IEEE Trans.
Computat. Social Syst., vol. 9, no. 1, pp. 134–145, Feb. 2022.
[19] M. Eskandari, Z. H. Janjua, M. Vecchio, and F. Antonelli, ‘‘Passban IDS:
An intelligent anomaly-based intrusion detection system for IoT edge devices,’’
IEEE Internet Things J., vol. 7, no. 8, pp. 6882–6897, Aug. 2020.
[20] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, ‘‘Toward generating a
new intrusion detection dataset and intrusion traffic characterization,’’ in Proc.
4th Int. Conf. Inf. Syst. Secur. Privacy, vol. 1, Jan. 2018, pp. 108–116.