Aegean Wi-Fi Intrusion Dataset Research Articles

Optimized Ensemble Learning Models Based on Clustering and Hybrid Deep Learning for Wireless Intrusion Detection

Machine learning (ML) and deep learning (DL) are used in numerous fields, particularly to develop effective intrusion detection systems (IDS). Existing wireless network IDS, which rely on a single ML algorithm and have limitations. These include a high rate of false positives, difficulties in recognizing distinct attack patterns, and a high acquisition cost for annotated training datasets. However, hostile threats are always evolving, networks need a smart security solution. In comparison to other ML approaches, DL algorithms are more successful in intrusion detection. This paper presents a DL based ensemble model that combines Multi-verse through Chaotic Atom Search Optimization (MCA) for preprocessing, which eliminates unsolicited/recurrent information in the dataset. The process of optimized feature selection uses Principal Component Analysis (PCA), Chaotic Manta-ray Foraging Optimizations (CMFO), and a grounded grouping method to partition the optimized feature dataset into k-diverse clusters. The recommended model then stacks Support Vector Machine (SVM) as the ensemble model’s meta-learner classifier, pre-training the hybrid DL prototypes using the optimized feature dataset cluster. The CNN-LSTM and CNN-GRU models, which integrate Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), and Gated Recurrent Unit (GRU), are the hybrid DL prototype’s key components. The suggested model’s performance has been enhanced and compared to six ML techniques: NB, SVM, J48, RF, MLP, and kNN models, utilizing measures such as accuracy, precision, recall, and F-measure. The public can access the Aegean Wi-Fi Intrusion Dataset (AWID) which is used for evaluating the recommended model and is outperformed the contemporary models in the literature.

Classification Tendency Difference Index Model for Feature Selection and Extraction in Wireless Intrusion Detection

In detecting large-scale attacks, deep neural networks (DNNs) are an effective approach based on high-quality training data samples. Feature selection and feature extraction are the primary approaches for data quality enhancement for high-accuracy intrusion detection. However, their enhancement root causes usually present weak relationships to the differences between normal and attack behaviors in the data samples. Thus, we propose a Classification Tendency Difference Index (CTDI) model for feature selection and extraction in intrusion detection. The CTDI model consists of three indexes: Classification Tendency Frequency Difference (CTFD), Classification Tendency Membership Difference (CTMD), and Classification Tendency Distance Difference (CTDD). In the dataset, each feature has many feature values (FVs). In each FV, the normal and attack samples indicate the FV classification tendency, and CTDI shows the classification tendency differences between the normal and attack samples. CTFD is the frequency difference between the normal and attack samples. By employing fuzzy C means (FCM) to establish the normal and attack clusters, CTMD is the membership difference between the clusters, and CTDD is the distance difference between the cluster centers. CTDI calculates the index score in each FV and summarizes the scores of all FVs in the feature as the feature score for each of the three indexes. CTDI adopts an Auto Encoder for feature extraction to generate new features from the dataset and calculate the three index scores for the new features. CTDI sorts the original and new features for each of the three indexes to select the best features. The selected CTDI features indicate the best classification tendency differences between normal and attack samples. The experiment results demonstrate that the CTDI features achieve better detection accuracy as classified by DNN for the Aegean WiFi Intrusion Dataset than their related works, and the detection enhancements are based on the improved classification tendency differences in the CTDI features.

EBDM: Ensemble binary detection models for multi-class wireless intrusion detection based on deep neural network

EBDM: Ensemble binary detection models for multi-class wireless intrusion detection based on deep neural network

Hybrid intelligent intrusion detection system for multiple Wi‐Fi attacks in wireless networks using stacked restricted Boltzmann machine and deep belief networks

SummaryThe recent cutting edge mobile and internet advancements have increased Internet of Things based gadgets more pervasive and cohesive into our day to day lives. There emerges a need to beat the security challenges, prevalently came about because of the uncovered idea of a remote medium, for example a Wi‐Fi network setup. The linked gadgets are ubiquitous, creating high‐dimensional information on an expansive scale. It tends to be seen those illegitimate actions like illegal information access, information stealing, information alteration different other interruption exercises are quickly developing during a decade ago. Wireless network data transfers will be anticipated to surge strongly in the coming years. Feature learning, still, can evade the probable complications, possibly formed by means of large wireless network dimensions. Therefore, the proposed system focuses on developing a Hybrid Intelligent Intrusion Detection System (IDS) for detecting multiple assaults such as Impersonation, Injection, flooding along with other unknown malicious Wi‐Fi attacks using Deep Learning and Machine Learning algorithms. The proposed system is investigated on well referenced Aegean Wi‐Fi Intrusion Dataset (AWID) and the experimental results prove that the utility of deep learning algorithms in feature representation and classification has achieved higher detection accuracy along with lower false alarm rate. To get an optimum feature set and perform dimensionality reduction on Wi‐Fi network data, the proposed framework uses Deep Belief Network (DBN) with stacked layers of Restricted Boltzmann Machine (RBM). In order to identify and categories various Wi‐Fi threats, Deep Neural Networks, and algorithms like SVM, MLKNN, and RAkEL are employed. The anticipated DBN model was given an optimization strategy to enhance classification performance. The optimization strategy involved selecting the best possible feature subset using a feature selection technique, optimizing the DBN model using the best possible hyperparameter values, less reconstruction error values, and utilizing the regularization method to account for weight decay. The experimental findings demonstrate that the use of deep learning algorithms in feature representation and classification has produced improved detection accuracy coupled with a decreased false alarm rate when applied to the proposed hybrid scheme based Intelligent IDS using the well‐referenced AWID dataset.

An intellectual intrusion detection system using Hybrid Hunger Games Search and Remora Optimization Algorithm for IoT wireless networks

Smart devices are connected to the internet, called the Internet of Things (IoT); it is a wireless network that plays a vital role in modernizing people’s interaction by improving agility, mobility, efficiency and effectiveness. Although IoT offers various advantages, it also raises privacy and security problems in IoT networks. The security of such integrated networks still remains an active area of research. Information transported across a wireless network must be monitored and implemented efficiently to ensure its integrity, validity and confidentiality. In order to minimize the rate of security problems in IoT networks, an intrusion detection model is suggested. For that reason, various intrusion detection based techniques are introduced in existing works to improve the security of IoT networks. But existing methods do not provide an efficient result in securing IoT data. The main contribution of using intrusion detection techniques in the proposed work is to improve the security of IoT networks. In this work, a hybrid Hunger Games Search and Remora Optimization Algorithm (HHGS-ROA) is proposed to address the security problems. The proposed approach uses a real-world Aegean Wi-Fi Intrusion Dataset (AWID) for an IoT intruder detection system. Initially, the AWID raw captured traffic is fed into the pre-processing stage to increase the speed of feature selection. In the proposed approach, a hybrid HGS-ROA model is used to extract the features from the AWID dataset. Finally, the SVM classifier is proposed to classify network traffic as normal or malicious attacks. Therefore proposed approach achieves a low false-positive rate (FPR) with an enhanced detection rate. The proposed work is implemented in the PYTHON platform. Compared with existing methods in terms of accuracy, F1 score, detection rate, FAR, computation times, false alarm rate, MCC, and precision has proven to be more effective. The proposed approach performs better than existing algorithms in terms of evaluating metrics such as accuracy (99.16%), precision (99.76%), recall (99.40%), F1 score (99.58%), false alarm rate (0.00005%), MCC (99.97%) and false-positive rate (0.20%).

Multi-Class Intrusion Detection Using Two-Channel Color Mapping in IEEE 802.11 Wireless Network

The rise of interconnected devices through wireless networks provides two sides consequences. On one side, it helps many human tasks; on the other hand, the prone wireless medium opens the vulnerable system to be exploited by adversaries. An Intrusion Detection System (IDS) is one method to inspect the network traffic by leveraging state-of-the-art anomaly detection techniques. Deep learning models have been utilized to distinguish the benign and malicious traffic. However, projecting the tabular data into images before the image classification has been the main challenge of leveraging deep learning for IDS purposes. We propose the novel projection of tabular data into 2-coded color mapping for IDS purposes. The proposed method employs a feature selection method to ensure optimal dimensionality. We examined the different number of attribute subsets to obtain the relationship between the attributes. Furthermore, it takes advantage of the Convolutional Neural Network (CNN) model to classify the Wi-Fi attacks. We evaluate the proposed model using the most common Wi-Fi attacks dataset, Aegean Wi-Fi Intrusion Dataset (AWID2). The proposed method achieved an F1 score of 99.73% and a false positive rate of 0.24%. This study highlights the importance of addressing the mapping procedures from tabular data into grid-based data before deep learning training and validates the effectiveness of CNN to detect multiple types of wireless network attacks.

Network intrusion detection using sparse autoencoder with swish-PReLU activation Model

In computer networks, the massive amount of data increases the challenges for intrusion detection systems, because of its high dimensionality. To overcome this problem, a four-phase system is developed for intrusion detection based on encoding techniques and deep learning. In the first phase, input data are collected from NSL-KDD, Canadian Institute for Cybersecurity-Intrusion Detection System 2017 (CIC-IDS2017), and Aegean Wi-Fi Intrusion Dataset (AWID). The collected data are converted into the machine-readable form by using label and one hot encoding technique that reduces the human intervention process and increases the accuracy of data classification. Next, the top percentile and recursive features are selected utilizing second percentile methodology and recursive feature elimination. The undertaken feature selection techniques; second percentile method and recursive feature elimination selects the relevant or active features from the pre-processed data that effectively diminishes the computational time and complexity of the proposed model. In the final phase, sparse autoencoder with swish-PReLU activation model is proposed to classify the normal and traffic types in the NSL-KDD, CIC-IDS2017, and AWID datasets. In the experimental phase, the proposed sparse autoencoder with swish-PReLU activation model achieved effective performance in intrusion detection in light of false alarm rate, detection rate and classification accuracy. From the experimental result, the proposed model showed the maximum of 4.77% improvement in classification accuracy compared to the existing models; correlation-based feature selection with bat algorithm, artificial neural network, chi-square and information gain-random tree, and sequential Search-Bayesian network.

Effective combining of feature selection techniques for machine learning-enabled IoT intrusion detection

The rapid advancement of technologies has enabled businesses to carryout their activities seamlessly and revolutionised communications across the globe. There is a significant growth in the amount and complexity of Internet of Things devices that are deployed in a wider range of environments. These devices mostly communicate through Wi-Fi networks and particularly in smart environments. Besides the benefits, these devices also introduce security challenges. In this paper, we investigate and leverage effective feature selection techniques to improve intrusion detection using machine learning methods. The proposed approach is based on a centralised intrusion detection system, which uses the deep feature abstraction, feature selection and classification to train the model for detecting the malicious and anomalous actions in the traffic. The deep feature abstraction uses deep learning techniques of artificial neural network in the form of unsupervised autoencoder to construct more features for the traffic. Based on the availability of cumulative features, the system then employs a variety of wrapper-based feature selection techniques ranging from SVM and decision tree to Naive Bayes for selecting high-ranked features, which are then combined and fed into an artificial neural network classifier for distinguishing attack and normal behaviors. The experimental results reveal the effectiveness of the proposed method on Aegean Wi-Fi Intrusion Dataset, which achieves high detection accuracy of up to 99.95%, relatively competitive to the existing machine learning works for the same dataset.

A Machine Learning Based Two-Stage Wi-Fi Network Intrusion Detection System

The growth of wireless networks has been remarkable in the last few years. One of the main reasons for this growth is the massive use of portable and stand-alone devices with wireless network connectivity. These devices have become essential on the daily basis in consumer electronics. As the dependency on wireless networks has increased, the attacks against them over time have increased as well. To detect these attacks, a network intrusion detection system (NIDS) with high accuracy and low detection time is needed. In this work, we propose a machine learning (ML) based wireless network intrusion detection system (WNIDS) for Wi-Fi networks to efficiently detect attacks against them. The proposed WNIDS consists of two stages that work together in a sequence. An ML model is developed for each stage to classify the network records into normal or one of the specific attack classes. We train and validate the ML model for WNIDS using the publicly available Aegean Wi-Fi Intrusion Dataset (AWID). Several feature selection techniques have been considered to identify the best features set for the WNIDS. Our two-stage WNIDS achieves an accuracy of 99.42% for multi-class classification with a reduced set of features. A module for eXplainable Artificial Intelligence (XAI) is implemented as well to understand the influence of features on each type of network traffic records.

Hybridizing genetic algorithm and grey wolf optimizer to advance an intelligent and lightweight intrusion detection system for IoT wireless networks

Open wireless sensor networks (WSNs) in Internet of things (IoT) has led to many zero-day security attacks. Since intrusion detection is a key security solution, this paper presents a lightweight machine learning-based intrusion detection technique with high performance for resource limited IoT wireless networks namely, IoT intrusion detection system (IoTIDS). IoTIDS is based on hybridization of genetic algorithm (GA) and grey wolf optimizer (GWO), termed as GA–GWO. The main aim of the hybrid algorithm for the IoTIDS is to reduce the dimensionality of the huge wireless network traffic through intelligent selecting the most informative traffic features. By hybridizing, we try to eliminate their weaknesses through GA and GWO strengths. The effectiveness of the GA–GWO on IoTIDS is evaluated using AWID (aegean wi-fi intrusion dataset) as a new real-world wireless intrusion dataset, after preprocessing it under different scenarios. The experimental results proved that the proposed GA–GWO individually not only improved the performance of the IoTIDS in terms of computational costs, but it also enabled the IoTIDS to detect ? with high accuracy and low false alarm rate. Furthermore, GA–GWO in comparison to the original GA and GWO and other recent existing methods like FS, weight, and parameter optimization of SVM based on the GA (FWP-SVM-GA) and binary GWO (BGWO) has proven to be more effective.

IMPACT: Impersonation Attack Detection via Edge Computing Using Deep Autoencoder and Feature Abstraction

An ever-increasing number of computing devices interconnected through wireless networks encapsulated in the cyber-physical-social systems and a significant amount of sensitive network data transmitted among them have raised security and privacy concerns. Intrusion detection system (IDS) is known as an effective defence mechanism and most recently machine learning (ML) methods are used for its development. However, Internet of Things (IoT) devices often have limited computational resources such as limited energy source, computational power and memory, thus, traditional ML-based IDS that require extensive computational resources are not suitable for running on such devices. This study thus is to design and develop a lightweight ML-based IDS tailored for the resource-constrained devices. Specifically, the study proposes a lightweight ML-based IDS model namely IMPACT (IMPersonation Attack deteCTion using deep auto-encoder and feature abstraction). This is based on deep feature learning with gradient-based linear Support Vector Machine (SVM) to deploy and run on resource-constrained devices by reducing the number of features through feature extraction and selection using a stacked autoencoder (SAE), mutual information (MI) and C4.8 wrapper. The IMPACT is trained on Aegean Wi-Fi Intrusion Dataset (AWID) to detect impersonation attack. Numerical results show that the proposed IMPACT achieved 98.22% accuracy with 97.64% detection rate and 1.20% false alarm rate and outperformed existing state-of-the-art benchmark models. Another key contribution of this study is the investigation of the features in AWID dataset for its usability for further development of IDS.

Deep Abstraction and Weighted Feature Selection for Wi-Fi Impersonation Detection

The recent advances in mobile technologies have resulted in Internet of Things (IoT)-enabled devices becoming more pervasive and integrated into our daily lives. The security challenges that need to be overcome mainly stem from the open nature of a wireless medium, such as a Wi-Fi network. An impersonation attack is an attack in which an adversary is disguised as a legitimate party in a system or communications protocol. The connected devices are pervasive, generating high-dimensional data on a large scale, which complicates simultaneous detections. Feature learning, however, can circumvent the potential problems that could be caused by the large-volume nature of network data. This paper thus proposes a novel deep-feature extraction and selection (D-FES), which combines stacked feature extraction and weighted feature selection. The stacked autoencoding is capable of providing representations that are more meaningful by reconstructing the relevant information from its raw inputs. We then combine this with modified weighted feature selection inspired by an existing shallow-structured machine learner. We finally demonstrate the ability of the condensed set of features to reduce the bias of a machine learner model as well as the computational complexity. Our experimental results on a well-referenced Wi-Fi network benchmark data set, namely, the Aegean Wi-Fi Intrusion data set, prove the usefulness and the utility of the proposed D-FES by achieving a detection accuracy of 99.918% and a false alarm rate of 0.012%, which is the most accurate detection of impersonation attacks reported in the literature.