Anomaly-based Intrusion Detection System Research Articles

Anomaly-based Intrusion Detection System in Industrial IoT-Healthcare Environment Network

The Internet of Things (IoT) technology facilitates automation, monitoring, and control of tangible objects and surroundings by enabling connected devices to interact and exchange data over the Internet. Developments in edge computing, blockchain, and artificial intelligence (AI) are incorporated into IoT technologies for more reliable operations. Inadequate authorization, authentication, and encryption protocols could render IoT networks insecure and open the door to illegal access and data breaches which can have terrible consequences, most notably in the healthcare industry. In this regard, to identify malicious and incursion traffic, machine learning (ML) is crucial to Internet of Things (IoT) cybersecurity. The paper proposes a framework to detect intrusion or malicious traffic in IoT-enabled different medical equipment such as medical sensors, and controllers for real-time data collection, creating communication channels and data monitoring and analysis over locally available network nodes. IoT-Flock has been utilized for both normal and malicious traffic generation in a wide dataset found by the sensors connected to IoT integrated healthcare network. The feature selection-based proposed framework has been evaluated by three distinct machine learning classifiers, KNN, RF, and DT where corresponding accuracy, sensitivity, precision, and F1-score have been measured for performance analysis. With an accuracy of 99.74%, the KNN technique performed better than the other tactics used by RF and DT regarding intrusion detection in IoT networks. The suggested framework will be helpful in developing or analyzing security solutions in IoT-integrated network systems.

Mitigating Missing Rate and Early Cyberattack Discrimination Using Optimal Statistical Approach with Machine Learning Techniques in a Smart Grid

In the Industry 4.0 era of smart grids, the real-world problem of blackouts and cascading failures due to cyberattacks is a significant concern and highly challenging because the existing Intrusion Detection System (IDS) falls behind in handling missing rates, response times, and detection accuracy. Addressing this problem with an early attack detection mechanism with a reduced missing rate and decreased response time is critical. The development of an Intelligent IDS is vital to the mission-critical infrastructure of a smart grid to prevent physical sabotage and processing downtime. This paper aims to develop a robust Anomaly-based IDS using a statistical approach with a machine learning classifier to discriminate cyberattacks from natural faults and man-made events to avoid blackouts and cascading failures. The novel mechanism of a statistical approach with a machine learning (SAML) classifier based on Neighborhood Component Analysis, ExtraTrees, and AdaBoost for feature extraction, bagging, and boosting, respectively, is proposed with optimal hyperparameter tuning for the early discrimination of cyberattacks from natural faults and man-made events. The proposed model is tested using the publicly available Industrial Control Systems Cyber Attack Power System (Triple Class) dataset with a three-bus/two-line transmission system from Mississippi State University and Oak Ridge National Laboratory. Furthermore, the proposed model is evaluated for scalability and generalization using the publicly accessible IEEE 14-bus and 57-bus system datasets of False Data Injection (FDI) attacks. The test results achieved higher detection accuracy, lower missing rates, decreased false alarm rates, and reduced response time compared to the existing approaches.

Generation & evaluation of datasets for anomaly-based intrusion detection systems in IoT environments

Generation & evaluation of datasets for anomaly-based intrusion detection systems in IoT environments

Three layer hybrid learning to improve intrusion detection system performance

In imbalanced network traffic, malicious cyberattacks can be hidden in a large amount of normal traffic, making it difficult for intrusion detection systems (IDS) to detect them. Therefore, anomaly-based IDS with machine learning is the solution. However, a single machine learning cannot accurately detect all types of attacks. Therefore, a hybrid model that combines long short-term memory (LSTM) and random forest (RF) in three layers is proposed. Building the hybrid model starts with Nearmiss-2 class balancing, which reduces normal samples without increasing minority samples. Then, feature selection is performed using chi-square and RF. Next, hyperparameter tuning is performed to obtain the optimal model. In the first and second layers, LSTM and RF are used for binary classification to detect normal data and attack data. While the third layer model uses RF for multiclass classification. The hybrid model verified using the CSE-CIC-IDS2018 dataset, showed better performance compared to the single algorithm. For multiclass classification, the hybrid model achieved 99.76% accuracy, 99.76% precision, 99.76% recall, and 99.75% F1-score.

Comparative analysis on intrusion detection system using machine learning approach

The increasing popularity of online data storage and access has raised concerns about security and privacy in the face of growing online threats. However, with the rise of online threats, security and privacy have become major concerns. Intrusion detection systems (IDS) play an important role in protecting data integrity by identifying and quarantining records in the event of unexpected changes. Anomaly-based IDS, which uses machine learning-based approach and algorithms, is an effective way to detect known and unknown attacks, including zero-day attacks. The proposed project is used to create model to implement and analyze anomaly-based IDS to classify malicious attack types such as normal (non-intrusion), DoS, Probe, U2R and R2L. The analysis is conducted on KDDCup99 Dataset which consists of different attacks that a IDS go through. The Machine Learning Algorithms like KNN, SVM, Random Forest and LightGBM are used for the analysis. The Comparitive Analysis is made on KDDCup99 Dataset using the above Machine Learning Algorithms that uses the hybrid techniques and Ensemble techniques like Bagging and Boosting.

A Comprehensive Review of Dimensionality Reduction Techniques for Real time Network Intrusion Detection with Applications in Cybersecurity

This paper reviews popular signature and anomaly-based intrusion detection systems (IDS). Dimensionality reduction techniques (DRT) are used to increase the efficiency of such systems for real-time operation. Autoencoder-based IDS is rapidly gaining in popularity, primarily due to its inherent ability to denoise data and reduce dimensionality. In addition to the efficiency, we also look at the classification techniques used by various authors, and the overall impact of a model in terms of performance metrics. This article is written for novices in cybersecurityto get a jumpstart on the latest IDS algorithms. The purpose is to give useful insights into the broad and progressive view of various techniques in wide use, expose high-impact future research areas and to summarize classic IDS methods and feature selection techniques.

CFS-AE: Correlation-based Feature Selection and Autoencoder for Improved Intrusion Detection System Performance

The major problem computer network users face concerning data – whether in storage, in transit, or being processed - is unauthorized access. This unauthorized access typically leads to the loss of confidentiality, integrity, and availability of data. Consequently, it is essential to implement an accurate Intrusion Detection System (IDS) for every information system. Many researchers have proposed machine learning and deep learning models, such as autoencoders, to enhance existing IDS. However, the accuracy of these models remains a significant research challenge. This paper proposes a Correlation-Based Feature Selection and Autoencoder (CFS-AE) to enhance detection accuracy and reduce the false alarms associated with the current anomaly-based IDS. The first step involves feature selection for the NSL-KDD and CIC-IDS2017 datasets which are used to train and test our model. Subsequently, an autoencoder is employed as a classifier to categorize data traffic into attack and normal categories. The results from our experimental study revealed an accuracy of 94.32% and 97.71% for the NSL-KDD and CIC-IDS2017 datasets, respectively. These results demonstrate improved performance over existing IDS systems.

Statistical performance assessment of supervised machine learning algorithms for intrusion detection system

<span lang="EN-US">Several studies have shown that an ensemble classifier's effectiveness is directly correlated with the diversity of its members. However, the algorithms used to build the base learners are one of the issues encountered when using a stacking ensemble. Given the number of options, choosing the best ones might be challenging. In this study, we selected some of the most extensively applied supervised machine learning algorithms and performed a performance evaluation in terms of well-known metrics and validation methods using two internet of things (IoT) intrusion detection datasets, namely network-based anomaly internet of things (N-BaIoT) and internet of things intrusion detection dataset (IoTID20). Friedman and Dunn's tests are used to statistically examine the significant differences between the classifier groups. The goal of this study is to encourage security researchers to develop an intrusion detection system (IDS) using ensemble learning and to propose an appropriate method for selecting diverse base classifiers for a stacking-type ensemble. The performance results indicate that adaptive boosting, and gradient boosting (GB), gradient boosting machines (GBM), light gradient boosting machines (LGBM), extreme gradient boosting (XGB) and deep neural network (DNN) classifiers exhibit better trade-off between the performance parameters and classification time making them ideal choices for developing anomaly-based IDSs.</span>

A Comprehensive Study on CIC-IDS2017 Dataset for Intrusion Detection Systems

In the present era of digital technology, electronic assaults result in the compromise of confidential information and substantial financial ramifications for individuals, organizations, and nations. Hence, the role of cybersecurity resources is essential in safeguarding data from any Cybersecurity event. Researchers are prioritizing the use of anomaly-based intrusion detection systems for the identification of cybersecurity threats. Machine learning algorithms are crucial in this endeavor since they possess the ability to identify such attacks reliably. It’s a dataset that enhances the efficiency of the machine learning algorithms. The datasets currently employed in intrusion detection systems exhibit a notable deficiency in accurately representing actual network threats and attacks. They also contain a significant number of concealed threats, thereby restricting the precision of detection within existing machine-learning intrusion detection system approaches. Consequently, these systems are unable to effectively cope with the growing number of novel attacks in the real word scenarios, in cloud environments. The objective of this study is to integrate the categorization and analysis of current datasets to enhance the generation of future datasets that accurately replicate actual network data. This will enhance the efficacy of the next generation of intrusion detection systems and correctly mirror network threats.

Deep ensemble of classifier for intrusion detection in WSN and improved attack mitigation process

SummaryAttacks have a significant negative impact on the wireless sensor network's network operations. They target to weaken the network layer, if they are not completely eradicated, the networks' ability to execute their desired function becomes collapsed. While intended to monitor such unexpected attacks, anomaly‐based intrusion detection systems (AIDS) have a high risk of false positives. This article intends to propose a Deep Ensemble Intrusion detection with a Self‐adaptive Sewing Training‐Based Optimization (DIED‐SASTO) model that includes the following steps: (a) preprocessing, (b) feature extraction, (c) optimal feature selection, and (d) detection. Initially, an improved class imbalance processing will take place to solve the imbalance problem during the preprocessing step. Subsequently, the features are extracted including higher‐order statistical features, improved entropy, and correlation‐based features during the feature extraction step. From the extracted feature set, as the curse of dimensionality becomes a serious challenge, it is significant to choose the optimal features. In the optimal feature selection process, a new Self‐adaptive Sewing Training‐Based Optimization (SASTO) is used. In addition, the intrusion detection will be employed based on the selected optimal features and trained using deep ensemble models like Deep maxout, Deep Belief Network (DBN), and Bidirectional Long short‐term memory (Bi‐LSTM). Once the presence of an attack is detected, it is mandatory to mitigate the attacker node form the network. For Attack Mitigation, improved entropy will be progressed. The effectiveness of the DIED‐SASTO is evaluated over conventional methods in terms of various metrics.

A Hybrid Intrusion Detection Approach for Cyber Attacks

The field of cybersecurity constantly evolves as attackers develop new methods and technologies. Defending against cyberattacks involves a combination of robust security measures, regular updates, user education, and the use of advanced technologies, such as intrusion detection systems and artificial intelligence, to find out the threats in real-time. IDS are designed to identify and address any unauthorized actions or potential security threats within a computer network or system. A hybrid intrusion detection system (IDS) combines many detection techniques and strategies from different IDS types into a single, coherent solution. Combining the benefits of each approach should result in more comprehensive and effective intrusion detection. This paper outlines a proposed anomaly intrusion detection system (AIDS) framework that leverages a hybrid of deep learning strategies. It incorporates Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models, which were developed using XGBoost, and their efficacy was assessed with the NSL-KDD dataset. The evaluation of the suggested model focused on its accuracy, detection capabilities, and the rate of false positives. The outcomes of this research are noteworthy within the cybersecurity field. In this paper, a framework of an Anomaly IDS is proposed. The purpose of an anomaly IDS, or AIDS, is to spot odd behavior on a network or system that might point to a security breach or malevolent attempt to hack it. Anomaly-based IDSs concentrate on finding departures from accepted typical behavior, in contrast to signature-based detection systems, which depend on a predefined database of known attack patterns.

Development of a stacked hybrid Decision Tree model leveraging the NSL-KDD dataset

Intrusion detection in information technology as well as operational technology networks is highly required in modern day systems due to the increased spate of cyber-attacks in both number and complexity. Anomaly-based intrusion detection systems which have the capacity to detect novel or zero-day attacks are highly employed in this regard. One important component of anomaly-based intrusion detection systems which ensures their behaviour is artificial intelligence in general and machine learning in particular. The burden in modern day cybersecurity research is to investigate and develop models that can outperform existing ones. This paper is aimed at developing a hybrid decision tree model using the stacking ensemble approach. Performances were measured on the basis of recall, precision, accuracy, F1-score, receiver operating characteristics and confusion matrices. The hybrid model presented a precision of 97%, accuracy of 81%, F1-score of 80% and AUC score of 0.96, respectively.

Enhancing Anomaly-Based Intrusion Detection Systems: A Hybrid Approach Integrating Feature Selection and Bayesian Hyperparameter Optimization

Enhancing Anomaly-Based Intrusion Detection Systems: A Hybrid Approach Integrating Feature Selection and Bayesian Hyperparameter Optimization

Enhancing network security through machine learning: A study on intrusion detection system using supervised algorithms

The topic of Intrusion Detection System (IDS) has become a highly debated issue in cybersecurity, generating intense discussions among experts in the field. IDS can be broadly categorized into two types: signature-based and anomaly-based. Signature-based IDS employ a collection of known network attacks to identify the precise attack the network is experiencing, while anomaly-based IDS employ machine learning models to detect anomalies present in the network traffic that could indicate a potential attack. In this study, we concentrate on anomaly-based IDS, evaluating the effectiveness of three supervised learning algorithms - Decision Tree (DT), Naive Bayes (NB), and K-Nearest Neighbor (KNN) - to determine the most suitable algorithm for each dataset based on its source. We conducted tests to evaluate each algorithm's performance and choose the best one for each dataset. Our findings show that anomaly-based IDS is highly effective in enhancing network security, providing valuable insights for organizations looking to improve their security measures.

An ensemble learning framework for the detection of RPL attacks in IoT networks based on the genetic feature selection approach

The rapid proliferation of Internet of Things (IoT) devices has raised critical concerns regarding the security of corresponding IoT networks. The Routing Protocol for Low-Power and Lossy Networks (RPL), a foundational element in IoT communication, is susceptible to diverse routing attacks due to IoT nodes’ constrained resources and open nature. This underscores the necessity for an Intrusion Detection System (IDS) to safeguard RPL-based IoT networks. Existing anomaly-based IDS suffer from high false alarm rates (FAR). In response to these challenges, this paper presents the Ensemble Learning-based Intrusion Detection System (ELG-IDS), which employs stacking and extreme parameter optimization to detect three RPL internal attacks: version number, decreased rank, and DIS flooding attacks. ELG-IDS employs enhanced feature extraction and genetic algorithm (GA)-based feature selection. Experimental results on a dedicated dataset demonstrate ELG-IDS's remarkable accuracy: 99.18%, 99.38%, 99.66%, and 97.90% for version number, rank attack, DIS flooding, and an average accuracy of 97.90% in multi-classification mode, respectively. This study advances IoT network security through ELG-IDS, enhancing protection against evolving security challenges.

Bilgisayar Ağlarında Saldırı Tespiti için Makine Öğrenme Yöntemleri: Karşılaştırmalı Bir Analiz

The widespread use of the Internet and the exponential increase in the number of devices connected to it bring along significant challenges as well as numerous benefits. The most important of these challenges, and the one that needs to be addressed as soon as possible, is cyber threats. These attacks against individuals, organisations and even entire nations can lead to financial, reputational and temporal losses. The aim of this research is to compare and analyse machine learning methods to create an anomaly-based intrusion detection system that can detect and identify network attacks with a high degree of accuracy. Examining, tracking and analysing the data patterns and volume in a network will enable the creation of a reliable Intrusion Detection System (IDS) that will maintain the health of the network and ensure that it is a safe place to share information. To have high accuracy in the prediction of the data set by using Decision Trees, Random Forest, Extra Trees and Extreme Gradient Boosting machine learning techniques. CSE-CIC-IDS2018 dataset containing common malicious attacks such as DOS, DDOS, Botnet and BruteForce is used. The result of the experimental study shows that the Extreme Gradient Boosting algorithm has an impressive success rate of 98.18% accuracy in accurately identifying threatening incoming packets.

Numerical Feature Selection and Hyperbolic Tangent Feature Scaling in Machine Learning-Based Detection of Anomalies in the Computer Network Behavior

Anomaly-based intrusion detection systems identify the computer network behavior which deviates from the statistical model of typical network behavior. Binary classifiers based on supervised machine learning are very accurate at classifying network data into two categories: normal traffic and anomalous activity. Most problems with supervised learning are related to the large amount of data required to train the classifiers. Feature selection can be used to reduce datasets. The goal of feature selection is to select a subset of relevant input features to optimize the evaluation and improve performance of a given classifier. Feature scaling normalizes all features to the same range, preventing the large size of features from affecting classification models or other features. The most commonly used supervised machine learning models, including decision trees, support vector machine, k-nearest neighbors, weighted k-nearest neighbors and feedforward neural network, can all be improved by using feature selection and feature scaling. This paper introduces a new feature scaling technique based on a hyperbolic tangent function and damping strategy of the Levenberg–Marquardt algorithm.

A Literary Review of Pattern Matching Techniques in Network Intrusion Detection

With the exponential growth in devices and services being added to networks, we are also witnessing an increase in the volume and complexity of threats, urging an increased efficiency in network intrusion detection systems which primarily rely on pattern matching to identify malicious activity on the network. In this literary review of pattern matching techniques in network intrusion detection, we explore the limitations and the research carried out in both signature-based and anomaly-based intrusion detection systems to overcome them. It focuses on the performance improvements in signature-based intrusion detection systems achieved through methodologies and technologies like regular expressions, Hyperscan, RE2, Flashtext, a generalized Aho-Corasick algorithm, usage of Bloom filters and payload sampling. It also covers the usage of machine learning techniques, including genetic algorithms, Support Vector Machines (SVM) and Improved Self-Adaptive Bayesian Algorithm (ISABA), which are used to detect anomalous behavior and identify potential threats in a network in anomaly-based network intrusion detection to assist the security analysts carry out their job functions. Additionally, this review explores the integration of the MITRE ATT&CK framework and Security Information and Event Management (SIEM) systems in network intrusion detection as this framework provides a structured and standardized approach for analyzing the tactics and techniques used by attackers to classify them, while SIEM systems enable the correlation of threat activity across multiple sources, allowing for a more comprehensive and accurate view of the network security. Overall, this literary review provides insights into the state-of-the-art techniques and frameworks used in Network Intrusion Detection based on Pattern Matching, highlighting the significant improvements in performance and detection capabilities.

XOR-Based Detector of Different Decisions on Anomalies in the Computer Network Traffic

Anomaly-based intrusion detection systems are designed to scan computer network traffic for abnormal behavior. Binary classifiers based on supervised machine learning have proven to be highly accurate tools for classifying instances as normal or abnormal. Main disadvantages of supervised machine learning are the long processing time and large amount of training data required to ensure accurate results. Two preprocessing steps to reduce data sets are feature selection and feature scaling. In this article, we present a new hyperbolic tangent feature scaling approach based on the linearization of the tangent hyperbolic function and the damping strategy of the Levenberg-Marquardt algorithm. Experiments performed on the Kyoto 2006+ dataset used four high-precision binary classifiers: weighted k-nearest neighbors, decision tree, feedforward neural networks, and support vector machine. It is shown that hyperbolic tangent scaling reduces processing time by more than twofold. An XOR-based detector is proposed to determine conflicting decisions about anomalies. The decisions of the FNN and wk-NN models are compared. It is shown that decisions sometimes turn out differently. The percentage of the opposite decisions has been shown to vary and is not affected by dataset size.

Smart Cyber-Attack Diagnosis and Mitigation in a Wind Farm Network Operator

With the rise of wind energy production in global power generation, wind farm facilities are becoming increasingly attractive targets for malicious attacks, in particular those affecting wind farm network operators' cyber subsystems and functionalities. Given the significance of this problem, this paper proposes a novel anomaly-based intrusion detection and diagnosis system to carry out in-line monitoring as with firewalls. Also, an innovative cyber-attack-resilient active power control is designed to responsively mitigate the impacts of cyber-attacks on the safe regulation of active power from wind farms. An offshore wind farm benchmark is used to implement and demonstrate the effectiveness of the proposed solutions in the presence of wind turbulences, measurement noises and realistic smart cyber-attack scenarios.