Introduction ow a day's Provisioning of security in networks has become challenge to researchers. The mechanisms currently employed are lack of adaptability to the unknown dynamic network conditions. The layered architecture adopted by the current network deployments lacking intelligent communication, lead to reduced network performance and unaware circumstances that arise at each level of the network architecture lead to reduced network performance. The amendments in the layered architecture are carried out post occurrences of problems or malicious activities. The need for secure intelligent and adaptable mechanisms is mandatory. Such mechanisms can be realized based on cognition loop or the OODA loop [1] [2]. Where the network conditions are observed, orientations and adoptions are achieved by intelligence, decisive actions are formulated and these decisions are applied to the network at the acting stage of the OODA loop. Such intelligent and adaptable networks are known as "Cognitive Networks" [3].

The cognitive network approach to secure networks from malicious user nodes or malicious activity is comparatively new and unique. Machine leaning techniques like fuzzy logic, self-organizing maps, neural networks can be used to incorporate intelligence into cognitive systems [4]. In this paper we introduce a discrete time dynamic neural network methodology to incorporate intelligence [5] [6]. Adoption of Cognition is based on the network metrics, parameters and patterns [7]. The cognitive network facilitates output in the form of certain actions that can be implemented for modifying the reconfigurable network policies, network components or network elements.

The Cognitive radio [1] (CR) is defined as "a radio that is aware of its environment or surroundings and adapts it intelligently". The cognition itself is an elusive quality which appears to be cognitive or intelligent prior to implementation is often dismissed as merely "adaptive" afterwards. A number of factors motivate CRs. CR is a transceiver system that is solely designed for using the best available wireless channel or resource in vicinity. Such kind of radio automatically detects the available bandwidth or spectrum resources and then it changes its transmission or reception parameters for permitting more synchronized wireless communication in a provided spectrum band even at the same location.

The need for cognition is driven by the complexity of the radio systems themselves. The existence of software defined radio (SDRs) capable of implementing a near endless number of different waveforms with different modulation schemes, power levels, error control codes, carrier frequencies, etc., means that controlling the radio becomes a problem of combinatorial optimization. Such problems are often computationally hard and lend themselves to solutions based on meta heuristic optimization methods based on simple search guided by higher level strategy. The application of such meta heuristic, which often appear to learn and innovate in turn, characteristic of work in artificial intelligence.

In order to achieve the seamless adaptation of radio link parameters, opportunistic use of underutilized spectrum, to get the higher flexibility in modulation and waveform Selection, the scientific or research society has seen an extraordinary progress in system or network development by implementing cognitive techniques. Cognitive Network is the best solution to attain the above mentioned requirements.

Cognitive Network [3] can be defined as an intelligent network encompassing the cognitive process which can perform a goal of achieving current network circumstances, planning, taking certain decision, acting on those perceived conditions, extracting or learning from the consequences of its previous or current actions, all while following end-to-end goals. The important component of cognitive network is its Cognition Loop that senses the circumstances, plans the actions to be taken and even according to input from sensors and network policies. It decides which solution or decision might be most effective for achieving end-to-end purpose. These characteristics facilitates the network systems to learn from the past about the situations, plans, decisions, actions and then using experiences for improving the decision in future.

In this paper, we have considered the use of cognition engines to identify the malicious users that are present within a heterogeneous network offering services. Malicious activity inducted through network transactions can be identified by monitoring the service request rates of the user's nodes [8] [9] [10]. In order to analyze effectively, instantaneously and to adapt the diverse network service rates, we introduce the discrete time dynamic neural network cognition engine. Access control mechanisms are critical in provisioning of network security. The proposed cognition mechanism considers the Physical Architecture Description Layer (PADL) structure for access control [11].

This paper organization is as follows. Section two explains about literature survey. The background is discussed in the section three. The proposed system model is explained in section four. The Performance Evaluation and conclusions are discussed in the subsequent sections.

Literature Survey R.W. Thomas et al [3] provides the definition and introduction of "Cognitive Networks". In this research work, Software Adaptable Networks is considered to achieve cognition in networks. This paper also discusses a case study to demonstrate the concepts of cognitive networks based on the OODA Loop. The case study is targeted to maximize the time taken to connect between a source node and one or more destination nodes. The case study considers both multicast and unicast communication models. A network of learning automata is considered for the realization of the cognition layer. Finite Action Learning Automata is used to achieve cognition and the case study is compared with a non-cognition model Directional Reception Incremental Protocol [12]. The Finite Action Learning Automata achieves a 11% performance improvement in solution finding. The major drawback of the algorithm proposed in this paper is that it is not applicable for link failures which occur in the real world scenario.

R S Komali et al [7] discuss about the effects of local and global information acquisition in cognitive networks. In this paper the cost of acquiring information, processing and network overheads arising from information accumulation is clearly discussed. The authors propose a Local ?? Improvement Algorithm and compare it with the ?? Improvement Algorithm [13] [14] and prove its efficiency. The authors of this paper conclude that utilizing both global and local information to achieve cognition, degrades system performance and an optimum global and local knowledge can be utilize to achieve cognition without effecting network performance. The major drawback is that there is no clear conclusion drawn as to the information global or local ratio to be considered to achieve cognition.

Daojing He et al [8] have proposed a trust based node misbehavior detection scheme for medical sensor networks. The trust is computed based on the rate of transmission and leaving time of the medical sensor nodes. Based on the trust computation malicious nodes are identified. The model is compared with ?????? [15] trust model.Performance improvement in terms of packet delivery and malicious node detection is proved using simulation and experimental test beds. The drawback of the system is that it is applicable to centralized systems supporting only unicast transmissions.

Tao Jun et al [9] developed an intrusion detection algorithm based on user behavior. Utilizing the statistics variance method based on the user nodes behavior in transmission rates the intrusions are detected. The paper also discusses the preventive measures incorporated in the case of Address Resolution Protocol [16] attacks. The algorithm proposed in this paper achieves a detection rate of about 0.9975 when compared to the system described in [17] which achieves a detection rate of about 0.9929. The authors have evaluated the proposed algorithm on the KDDCUP 1999 datasets [18] which has limited network user node features and is inconclusive.

S C Lingareddy et al [11] presented a paper that describes a mechanism for securing of wireless networks by the cognitive neural network approaches where the participating users are uniquely identified by implementing their respective Physical Architecture Description Layer (PADL) attributes. In this work they employ the certain data from Physical Layer and the Radio Layer in order to create the Physical Architecture Year 2014 E Description Layer (PADL), which is used to authenticate the system that tries to access the wireless network.

Here the cognitive security manager (CSM) maintains the integrity of the entire network by analyzing the Physical Architecture Description Layer (PADL) of all the nodes within the network.

Zhang Wenzhu and Yi Bohai [19] have introduced a multi domain cognition system. The authors have proposed two cognition models namely a Local Single-Domain Cognitive approach and a Local Multi-Domain Cognition approach. A multidimensional edge detection theory [20] is adopted to achieve cognition in the Local Single-Domain Cognitive approach and similar concepts have been extended to achieve cognition in the Local Multi-Domain Cognition approach. Multi domain systems considered in this paper is defined in [21]. The concept of Local Multi-Domain Cognition approach is still very naive and can be further improved upon.

G Sunilkumar et al [22] presented a research work that not only Monitors activity of user node but also performs an effective function of taking preventive measures if user node transactions are found to be malicious. In this research work the intelligence in cognitive engine has been realized using self-organizing maps (CSOMs). In order to realize the CSOMs Gaussian and Mexican Hat neighbor learning functions have been evaluated. The research simulation made in this work proves the efficiency of Gaussian Learning function that is found to be better for cognition engine. The cognition engine being considered in this research work is evaluated for malicious node detection in dynamic networks. In this work the implemented concept results in higher Intrusion detection rate as compared to other similar approaches.

The authors in [11] have proposed a secure Cognitive Framework Architecture for 802.11 networks based on the OODA Loop. The core of the architecture i.e. the Cognitive Security Manager incorporates the cognition process using robust access control mechanisms based on the PADL. The authors of this paper adopt a similar access control mechanism to identify the nodes within the network. Intelligence to achieve cognition is realized using a multilayer feed forward neural network trained based on the back propagation algorithm. User behavior monitored and analyzed to achieve the Cognition Process. Access control mechanisms coupled with cognition processes is introduced. The use of Multilayer Feed Forward neural networks cannot effectively handle the network dynamics in heterogeneous environments and exhibits reduced malicious node detection. To achieve better malicious node detection rates the proposed model considers the use of discrete time dynamic neural networks to achieve cognition.

Let's consider a network on which cognition is to be realized represented as ?? ?? ?? . The cognitive network can be represented as a graph defined as

Where ?? ?? ?? represents the set of network connections or links that exists between the network elements represented by ?? ?? ?? . The cognitive network element set consists of a set of cognitive servers represented as ?? ?? ?? , router elements set represented as ?? ?? ?? and client nodes set represented as ?? ?? ?? . The network clients set constitute of wireless and wired type to realize a heterogeneous network. The network elements set can thus be defined as

All the links that constitute towards the link set ?? ?? ?? are assumed to be bi-directional in nature and can of wired or wireless nature. A sample network graph is as shown in Figure 1.

The router set ?? ?? ?? are assumed to be secure and are trusted network elements. The client nodes or the leafs of the network graph shown above and are assumed to constitute of trusted or normal users set represented as ?? ?? ?? and malicious or untrusted users set represented as ?? ?? ?? . Hence the client node set can be defined as The objective of the cognitive network discussed here is to identify the number of malicious users ?? ?? ?? in the cognitive network ?? ?? ?? . The cognitive server is assumed to host a set of services ?? for the users to access.In the cognitive network model the routers set only forward the data received from the client nodes to the cognitive servers. Cognition is achieved by incorporation the Cognition Loop also known as the OODA Loop. The cognition process is carried out on the cognitive servers which intercommunicate to facilitate higher malicious user detection rates. A packet level communication model is considered in this system wherein the user nodes request for services using a packet based transmission system. The PADL based user identification approach is adopted for accurate identification of user nodes. User node behavior is observed based on the transmitted data and the transmission rate. Transmission rate is defined as . Malicious users in the ideal scenario try to compromise or attain control of a greater number of service hosts in order to perform untrusted activities. Such untrustworthy behavior is modeled by inducing additional service request packets and which can be observed by the incremental transmission rate. Identification of malicious users where in there is no increased injection of service packets is also considered.

User node activity in the cognitive network ?? ?? ?? is observed by monitoring the service packet request rate measured in terms of the transmission rates of the service packets. Let the service transmission rate of a client node ?? be represented as ?? ???? ?? ?? i.e. the observed service request rate of the cognitive server ?? ?? ?? is also ? ?? ???? ?? ?? assuming lower network losses. The cognitive process adopted relies on dynamic neural network based intelligence for analysis of the service request packets. A discrete time dynamic neural network is adopted for orientation of the cognitive process incorporated. The decision phase of the cognition cycle relies on the service request packet analysis results obtained from the output of the dynamic neural networks. The action or the control strategies phase of the cognition cycle is achieved based on the decisions and is implemented on the cognitive servers ?? ?? ?? . The algorithm adopted to implement the action is discussed in the latter section of this paper. The cognition cycle is represented in Figure 2. Where the sampling period is represented by ?? and ?? Represents the instance of sampling and ??(??) is the input service requests to be observed by the cognitive server ?? ?? ?? at the ?? ??? time instance. The client node behavior to be observed can also be defined as

When ?? = 1 The discrete time dynamic neural network unit can be graphically represented as shown in Figure 3 given below.

The output of the dynamic neural networks is the learning or the cognitive observations represented as ?? ?? ?? (??) is defined as

Considering a set of service packets transmitted from the user nodes in the topology represented as?? ?? (??). Where ?? = 1,2,3,4, ? ? ??. The learning algorithm of the dynamic neural network can be defined as

Where,

The learning error of the neural network model is defined as

Considering ??(??) = ?? ?? (??) ? ??(??) and

The learning error can be defined as

Based on the parameters ?? the partial derivatives of the error index is defined as

Where ??(?? + 1)is the Lagrange multiplier.

Based on the weight parameter ð?"?ð?"? the partial derivatives of the error index is defined as

Where ??(?? + 1)is the Lagrange multiplier.

The dynamic neural networks increments the parameters ?? and the weight ð?"?ð?"? to minimize the learning error. The rate at which ?? is incremented represented as ???(??) is defined as

The weight update rate is represented as ?ð?"?ð?"?(??) is defined as

?ð?"?ð?"?(??) = ??? ð?"?ð?"? ? ??(?? + 1)?? ð?"?ð?"? (??(??), ð?"?ð?"? )

The dynamic neural networks update the parameters?? and ð?"?ð?"? of the forward layers based on the following definitions

ð?"?ð?"?(?? + 1) = ð?"?ð?"?(??) + ?? ð?"?ð?"? ? ??(?? + 1)ð??"ð??" ð?"?ð?"? (??(??), ð?"?ð?"?)

The back propagation learning for the discrete time dynamic neural network model enables to observe the service packet transmission rates of the cognitive server ?? ?? ?? by adopting a multi iterative process. The observations of the neural network are utilized for decision making and action planning at the cognitive servers ?? ?? ?? .

In this section we propose an action control adopted to limit the service request rates to the cognitive server ?? ?? ?? . Let ?? ?????? represent a fraction of the service request packet set from the users to the server through the routers i.e. 0 ? ?? ?????? ? 1 . By dropping or limiting the service requests received from the ?? ?? ?? cognition could be achieved. Let the packet dropping factor which is multiplicative in nature be represented as ?? . The packet dropping factor is adapted based on the presence of malicious users identified in the network topology. Let us define a constant ?? that is additive in nature and is introduced to increase the acceptance of service request packets when the number of normal users are greater i.e. ?? ?? ?? > ?? ?? ?? . The action control strategy is realized by the cognitive server set ?? ?? ?? and is executed when the service requests rates observed exceed the limit of the maximum transmission limit ?? ?? ?????????? ?? or when the current service request limit drops beyond the minimum supported transmission bandwidth ?? ?? ?????????? ?? . The service requests received by the server are monitored every ?? second. Here ?? is the monitoring time interval is considered to smaller than the round trip time between the server ?? ?? ?? and the user nodes ?? ?? ?? . The action control mechanism is not just as it tends to drop or limit the user service request immaterial of the kind of user ?? ?? ??

Where ?? ?? ? (??)is the traffic rate through each deployment router ?? ?? ?? (?) Based on the total traffic observed and the discrete time dynamic neural network analysis the ?? ?? ?? orients itself and the orientation results is defined as

The ?? ?? ?? is utilized for decision making and the action strategies signal ?? ?????? ?? (??) is derived for all the routers in ?? ?? ?? (?) in the heterogeneous network environment. Based on the position and the link type the action signal is received at varied time instances due to inherit network delays. Let ?? ?? ? 0 represent the network delay from the ?? ?? ?? to the routers ?? ?? ?? . The action signal ?? ?????? ?? (??), the controlled traffic rate ?? ???? ?? ?? (??) and the traffic rates ?? ?? ? (??) change with respect to the time ?? and be considered as a coupled system. Coupled Differential equations can be used to represent such models.

The cognitive server needs to maintain the traffic rate within the limits established by At a time instance ?? 0 , the cognitive server ?? ?? ?? observes the received traffic is greater than ?? ?? ?????????? ?? it is said to be over-loaded. The request rate observed is defined as

Where ?? ? ?? 0

?? ?? (?? 0 )Is the request rate at time instance ?? 0 Then the rate at which the over-loaded cognitive server receives request rates id defined as it is said to be under-loaded. The request rate observed is defined as

Where ?? ? ?? 0

Then the rate at which the under-loaded cognitive server receives request rates id defined as

The cognition is achieved based on the OODA loop. The service requests received from the malicious users ?? ?? ?? are limited and dropped to achieve cognition and maintain the heterogeneous network integrity. The cognition process discussed derives its learning intelligence by using the discrete time dynamic neural networks trained using the back propagation algorithm. The experimental study conducted to prove the discussed cognition process is explained in the next section.

V.

This section of the paper discusses the experimental study conducted to evaluate the cognition process based on the OODA Loop. The experimental environment for the heterogeneous environment ?? ?? test bed was developed using C# on the Visual Studio Platform. The heterogeneous environment constitutes of cognitive servers ?? ?? routers ?? ?? and client nodes ?? ?? . Cognitive decision making is incorporated within the cognitive servers. We have evaluated the proposed discrete time dynamic neural network cognitive engine (DNN-DT) against the MFNN cognitive engine. The ?? ?? considered of wired and wireless type. We have considered two mobility models namely, Random Directional Mobility and Random Waypoint Mobility for the user nodes ?? ?? . The user nodes ?? ?? ?? introduce regular service rates over the simulation test bed within the limits set by ?? ?? ?????????? ?? and ?? ?? ?????????? ?? and request the cognitive servers for a set of services through the routers deployed. A packet level structure is adopted to model such transactions. A random number of nodes i.e. malicious nodes ?? ?? ?? are introduced intro the network whose transactional service rates are irregular by nature i.e. ?? ???? ?? ?? > ?? ???? ?? ?? . The aim of the experimental study can be defined as identifying malicious transactions due to which irregular service rates are observed and negate the malicious client nodes ?? ?? ?? introducing such service rates by denying them service provisioning.

The ability of the simulation environment is to handle variations in the number of ?? ?? , ?? ?? , ?? ?? along with the mobility options and channel noise considerations led to an extensive experimental scenarios summarized in Table 1. A total of twenty four scenarios are presented in this paper. The error in identifying the malicious nodes identified by the vibrational service rates is represented in It is that the DNN-DT cognitive engine reduces the malicious node detection error by about 25% when compared to the MFNN cognitive engine. The discrete time dynamic networks adapt quickly to the dynamic environments presented here. This ability of the discrete time dynamic neural network results in reduced network overheads in action planning and decision making phase of the OODA Loop. The network overheads observed are shown in Figure 6 and Figure 7 given below. The network overheads are measured in terms of the additional query transactions induced by the cognitive servers for accurate decision making. It was observed that about 12064, 19686 and 28865 transactional packets were reduced when considering the discrete time dynamic neural network to achieve cognition for the 3, 5 and 7 server scenarios. From Figure 7 it can be observed that the average reduction of about 2% was achieved considering an average of all the network transactions considered for the varied scenarios discussed in this section. Though the reduction in the average network overhead appears marginal, its significance increases for larger network scenarios. detection accuracy for ?? ?? 7 is shown in Figure 10. From the figure it is clear that the channel noise inclusion reduces the malicious node detection accuracy. The DNN-DT cognitive engine achieves an average detection accuracy of about 96.02% when compared to 84.45% detection accuracy achieved by the MFNN Cognitive engine. The accuracy of malicious node detection for random directional mobility is observed to be less than that of the random waypoint mobility model by about 0.297% and 0.375% for MFNN cognitive engine and DNN-DT cognitive engine. Mobility inclusion in network simulations induces an additional overhead in the network maintenance transactions. The effects of mobility on the network transactions are shown in Figure 11. The random waypoint mobility model was found to induce additional transactional overheads owing to the random node mobility it exhibits. The random directional mobility model considers the mobility of all the nodes as per a particular mobility rate and are less complicated when compared to random waypoint mobility models where in the mobility of random nodes is induced. The receiver operating characteristics curve for ?? ?? 7 discussed here is shown in Figure 12. The area covered by the DNN-DT curve was found to be 0.9408 when compared to 0.7728 covered by the MFNN curve. The error of the curve for DNN-DT was about 2.5% against the error of about 4.7% exhibited by the MFNN curve. Based on the experimental study and the analysis, it can be concluded that the proposed discrete time dynamic neural network cognition model achieves a higher accuracy of about 25% when compared to the MFNN based cognition engine.

The issues in security provisioning to networks can be addressed by cognitive networks. This paper proposes an OODA Loop based cognitive network. The use of discrete time dynamic neural networks to incorporate intelligence in the cognition loop is considered. The purpose of the cognitive network is to identify malicious user nodes in heterogeneous network environments. The malicious node identification is achieved by monitoring the service rates of the client nodes. Service provisioning of the services hosted by the cognitive servers to the malicious nodes is disabled hence improving performance and maintaining network integrity. The proposed system exhibits 25% higher malicious node detection efficiency and 12% higher malicious transaction classification accuracy when compared to the MFNN based cognition engine. The discrete time dynamic neural network based cognitive network proposed in this paper is an effective mechanism to identity malicious nodes and negates their presence in the considered heterogeneous network.