Anomaly-based Intrusion Detection Research Articles

Anomaly-based Intrusion Detection System in Industrial IoT-Healthcare Environment Network

The Internet of Things (IoT) technology facilitates automation, monitoring, and control of tangible objects and surroundings by enabling connected devices to interact and exchange data over the Internet. Developments in edge computing, blockchain, and artificial intelligence (AI) are incorporated into IoT technologies for more reliable operations. Inadequate authorization, authentication, and encryption protocols could render IoT networks insecure and open the door to illegal access and data breaches which can have terrible consequences, most notably in the healthcare industry. In this regard, to identify malicious and incursion traffic, machine learning (ML) is crucial to Internet of Things (IoT) cybersecurity. The paper proposes a framework to detect intrusion or malicious traffic in IoT-enabled different medical equipment such as medical sensors, and controllers for real-time data collection, creating communication channels and data monitoring and analysis over locally available network nodes. IoT-Flock has been utilized for both normal and malicious traffic generation in a wide dataset found by the sensors connected to IoT integrated healthcare network. The feature selection-based proposed framework has been evaluated by three distinct machine learning classifiers, KNN, RF, and DT where corresponding accuracy, sensitivity, precision, and F1-score have been measured for performance analysis. With an accuracy of 99.74%, the KNN technique performed better than the other tactics used by RF and DT regarding intrusion detection in IoT networks. The suggested framework will be helpful in developing or analyzing security solutions in IoT-integrated network systems.

Generation & evaluation of datasets for anomaly-based intrusion detection systems in IoT environments

Generation & evaluation of datasets for anomaly-based intrusion detection systems in IoT environments

Self-healing hybrid intrusion detection system: an ensemble machine learning approach

The increasing complexity and adversity of cyber-attacks have prompted discussions in the cyber scenario for a prognosticate approach, rather than a reactionary one. In this paper, a signature-based intrusion detection system has been built based on C5 classifiers, to classify packets into normal and attack categories. Next, an anomaly-based intrusion detection was built based on the LSTM (Long-Short Term Memory) algorithm to detect anomalies. These anomalies are then fed into the signature generator to extract attributes. These attributes get uploaded into the C5 training set, aiding the ensemble model in continual learning with expanding signatures of unknown attacks. By generating signatures of unknown attacks, the self-healing attribute of the ensemble model contributes to the early detection of attacks. For the C5 classifier, the proposed model is evaluated on the UNSW-NB15 dataset, while for the LSTM model, it is evaluated on the ADFA-LD dataset. Compared to conventional models, the experimental results show better detection rates for both known and unknown attacks. The C5 classifier achieved a True Positive Rate of 97% while maintaining a false positive rate of 8%. Also, the LSTM model achieved a detection rate of 90% while retaining a 17% False Alarm Rate. As the proposed model learns, its performance in real network traffic also improves and it also eliminates human intervention when updating training data.

A Comprehensive Review of Dimensionality Reduction Techniques for Real time Network Intrusion Detection with Applications in Cybersecurity

This paper reviews popular signature and anomaly-based intrusion detection systems (IDS). Dimensionality reduction techniques (DRT) are used to increase the efficiency of such systems for real-time operation. Autoencoder-based IDS is rapidly gaining in popularity, primarily due to its inherent ability to denoise data and reduce dimensionality. In addition to the efficiency, we also look at the classification techniques used by various authors, and the overall impact of a model in terms of performance metrics. This article is written for novices in cybersecurityto get a jumpstart on the latest IDS algorithms. The purpose is to give useful insights into the broad and progressive view of various techniques in wide use, expose high-impact future research areas and to summarize classic IDS methods and feature selection techniques.

A Comprehensive Study on CIC-IDS2017 Dataset for Intrusion Detection Systems

In the present era of digital technology, electronic assaults result in the compromise of confidential information and substantial financial ramifications for individuals, organizations, and nations. Hence, the role of cybersecurity resources is essential in safeguarding data from any Cybersecurity event. Researchers are prioritizing the use of anomaly-based intrusion detection systems for the identification of cybersecurity threats. Machine learning algorithms are crucial in this endeavor since they possess the ability to identify such attacks reliably. It’s a dataset that enhances the efficiency of the machine learning algorithms. The datasets currently employed in intrusion detection systems exhibit a notable deficiency in accurately representing actual network threats and attacks. They also contain a significant number of concealed threats, thereby restricting the precision of detection within existing machine-learning intrusion detection system approaches. Consequently, these systems are unable to effectively cope with the growing number of novel attacks in the real word scenarios, in cloud environments. The objective of this study is to integrate the categorization and analysis of current datasets to enhance the generation of future datasets that accurately replicate actual network data. This will enhance the efficacy of the next generation of intrusion detection systems and correctly mirror network threats.

A Real Time Deep Learning Based Approach for Detecting Network Attacks

Anomaly-based Intrusion Detection is a key research topic in network security due to its ability to face unknown attacks and new security threats. For this reason, many works on the topic have been proposed in the last decade. Nonetheless, an ultimate solution, able to provide a high detection rate with an acceptable false alarm rate, has still to be identified. In the last years big research efforts have focused on the application of Deep Learning techniques to the field, but no work has been able, so far, to propose a system achieving good detection performance, while processing raw network traffic in real time. For this reason in the paper we propose an Intrusion Detection System that, leveraging on probabilistic data structures and Deep Learning techniques, is able to process in real time the traffic collected in a backbone network, offering excellent detection performance and low false alarm rate. Indeed, the extensive experimental tests, run to validate our system and compare different Deep Learning techniques, confirm that, with a proper parameter setting, we can achieve about 92% of detection rate, with an accuracy of 0.899. Finally, with minimal changes, the proposed system can provide some information about the kind of anomaly, although in the multi-class scenario the detection rate is slightly lower (around 86%).

Review on Approaches of Federated Modeling in Anomaly-Based Intrusion Detection for IoT Devices

Review on Approaches of Federated Modeling in Anomaly-Based Intrusion Detection for IoT Devices

Development of a stacked hybrid Decision Tree model leveraging the NSL-KDD dataset

Intrusion detection in information technology as well as operational technology networks is highly required in modern day systems due to the increased spate of cyber-attacks in both number and complexity. Anomaly-based intrusion detection systems which have the capacity to detect novel or zero-day attacks are highly employed in this regard. One important component of anomaly-based intrusion detection systems which ensures their behaviour is artificial intelligence in general and machine learning in particular. The burden in modern day cybersecurity research is to investigate and develop models that can outperform existing ones. This paper is aimed at developing a hybrid decision tree model using the stacking ensemble approach. Performances were measured on the basis of recall, precision, accuracy, F1-score, receiver operating characteristics and confusion matrices. The hybrid model presented a precision of 97%, accuracy of 81%, F1-score of 80% and AUC score of 0.96, respectively.

Enhancing Anomaly-Based Intrusion Detection Systems: A Hybrid Approach Integrating Feature Selection and Bayesian Hyperparameter Optimization

Enhancing Anomaly-Based Intrusion Detection Systems: A Hybrid Approach Integrating Feature Selection and Bayesian Hyperparameter Optimization

Bilgisayar Ağlarında Saldırı Tespiti için Makine Öğrenme Yöntemleri: Karşılaştırmalı Bir Analiz

The widespread use of the Internet and the exponential increase in the number of devices connected to it bring along significant challenges as well as numerous benefits. The most important of these challenges, and the one that needs to be addressed as soon as possible, is cyber threats. These attacks against individuals, organisations and even entire nations can lead to financial, reputational and temporal losses. The aim of this research is to compare and analyse machine learning methods to create an anomaly-based intrusion detection system that can detect and identify network attacks with a high degree of accuracy. Examining, tracking and analysing the data patterns and volume in a network will enable the creation of a reliable Intrusion Detection System (IDS) that will maintain the health of the network and ensure that it is a safe place to share information. To have high accuracy in the prediction of the data set by using Decision Trees, Random Forest, Extra Trees and Extreme Gradient Boosting machine learning techniques. CSE-CIC-IDS2018 dataset containing common malicious attacks such as DOS, DDOS, Botnet and BruteForce is used. The result of the experimental study shows that the Extreme Gradient Boosting algorithm has an impressive success rate of 98.18% accuracy in accurately identifying threatening incoming packets.

Numerical Feature Selection and Hyperbolic Tangent Feature Scaling in Machine Learning-Based Detection of Anomalies in the Computer Network Behavior

Anomaly-based intrusion detection systems identify the computer network behavior which deviates from the statistical model of typical network behavior. Binary classifiers based on supervised machine learning are very accurate at classifying network data into two categories: normal traffic and anomalous activity. Most problems with supervised learning are related to the large amount of data required to train the classifiers. Feature selection can be used to reduce datasets. The goal of feature selection is to select a subset of relevant input features to optimize the evaluation and improve performance of a given classifier. Feature scaling normalizes all features to the same range, preventing the large size of features from affecting classification models or other features. The most commonly used supervised machine learning models, including decision trees, support vector machine, k-nearest neighbors, weighted k-nearest neighbors and feedforward neural network, can all be improved by using feature selection and feature scaling. This paper introduces a new feature scaling technique based on a hyperbolic tangent function and damping strategy of the Levenberg–Marquardt algorithm.

A Literary Review of Pattern Matching Techniques in Network Intrusion Detection

With the exponential growth in devices and services being added to networks, we are also witnessing an increase in the volume and complexity of threats, urging an increased efficiency in network intrusion detection systems which primarily rely on pattern matching to identify malicious activity on the network. In this literary review of pattern matching techniques in network intrusion detection, we explore the limitations and the research carried out in both signature-based and anomaly-based intrusion detection systems to overcome them. It focuses on the performance improvements in signature-based intrusion detection systems achieved through methodologies and technologies like regular expressions, Hyperscan, RE2, Flashtext, a generalized Aho-Corasick algorithm, usage of Bloom filters and payload sampling. It also covers the usage of machine learning techniques, including genetic algorithms, Support Vector Machines (SVM) and Improved Self-Adaptive Bayesian Algorithm (ISABA), which are used to detect anomalous behavior and identify potential threats in a network in anomaly-based network intrusion detection to assist the security analysts carry out their job functions. Additionally, this review explores the integration of the MITRE ATT&CK framework and Security Information and Event Management (SIEM) systems in network intrusion detection as this framework provides a structured and standardized approach for analyzing the tactics and techniques used by attackers to classify them, while SIEM systems enable the correlation of threat activity across multiple sources, allowing for a more comprehensive and accurate view of the network security. Overall, this literary review provides insights into the state-of-the-art techniques and frameworks used in Network Intrusion Detection based on Pattern Matching, highlighting the significant improvements in performance and detection capabilities.

XOR-Based Detector of Different Decisions on Anomalies in the Computer Network Traffic

Anomaly-based intrusion detection systems are designed to scan computer network traffic for abnormal behavior. Binary classifiers based on supervised machine learning have proven to be highly accurate tools for classifying instances as normal or abnormal. Main disadvantages of supervised machine learning are the long processing time and large amount of training data required to ensure accurate results. Two preprocessing steps to reduce data sets are feature selection and feature scaling. In this article, we present a new hyperbolic tangent feature scaling approach based on the linearization of the tangent hyperbolic function and the damping strategy of the Levenberg-Marquardt algorithm. Experiments performed on the Kyoto 2006+ dataset used four high-precision binary classifiers: weighted k-nearest neighbors, decision tree, feedforward neural networks, and support vector machine. It is shown that hyperbolic tangent scaling reduces processing time by more than twofold. An XOR-based detector is proposed to determine conflicting decisions about anomalies. The decisions of the FNN and wk-NN models are compared. It is shown that decisions sometimes turn out differently. The percentage of the opposite decisions has been shown to vary and is not affected by dataset size.

Smart Cyber-Attack Diagnosis and Mitigation in a Wind Farm Network Operator

With the rise of wind energy production in global power generation, wind farm facilities are becoming increasingly attractive targets for malicious attacks, in particular those affecting wind farm network operators' cyber subsystems and functionalities. Given the significance of this problem, this paper proposes a novel anomaly-based intrusion detection and diagnosis system to carry out in-line monitoring as with firewalls. Also, an innovative cyber-attack-resilient active power control is designed to responsively mitigate the impacts of cyber-attacks on the safe regulation of active power from wind farms. An offshore wind farm benchmark is used to implement and demonstrate the effectiveness of the proposed solutions in the presence of wind turbulences, measurement noises and realistic smart cyber-attack scenarios.

Adversarial Deep Learning in Anomaly based Intrusion Detection Systems for IoT Environments

Adversarial Deep Learning in Anomaly based Intrusion Detection Systems for IoT Environments

An effective technique for detecting minority attacks in NIDS using deep learning and sampling approach

Anomaly-based intrusion detection system have been consistently used in business organizations and military to detect a breach in network by identifying any activity that deviates from the baseline pattern. In this paper, we propose an effective intrusion detection technique to identify and predict the minority attacks with three layers. Here, the first layer utilizes a Weighted Deep Neural Network (WDNN) for identifying the suspicious traffic samples in network and it is passed to the second layer. Layer 2 classifies the traffic samples as normal or majority and minority attacks using Convolutional Neural Network (CNN) and Long-Short Term Memory (LSTM). Any traffic sample classified as minority attack is sent to Layer 3 that utilizes XGBoost algorithm. Layer 3 classifies the samples into their respective minority attack classes. To boost the detection rate of minority attacks, system employs a One-Sided Selection under-sampling algorithm to remove noisy samples from the majority attack classes. An Adaptive Synthetic (ADASYN) oversampling algorithm generates synthetic samples of minority attack classes. To evaluate the system, the datasets namely NSL KDD, CICIDS-2017 and CIDDS 001 dataset are used. The system attained an overall accuracy of 97.94% on NSL KDD dataset, 98.3% on CICIDS-2017 dataset and 97.9% on CIDDS 001 dataset.

Federated Learning for Distributed IIoT Intrusion Detection Using Transfer Approaches

Considering that low-cost and resource-constrained sensors coupled inherently could be vulnerable to growing numbers of intrusion threats, industrial Internet-of-Things (IIoT) systems are faced with severe security concerns. Data sharing for building high-performance intrusion detection models is also prohibited due to the sensitivity, privacy, and high value of IIoT data. This paper presents an anomaly-based intrusion detection system with federated learning for privacy-preserving machine learning in future IIoT networks. To tackle the urgent issue of training local models with non-independent and identically distributed (non-IID) data, we adopt instance-based transfer learning at local. Furthermore, to boost the performance of this system for IIoT intrusion detection, we propose a rank aggregation algorithm with a weighted voting approach. The proposed system achieves superior detection performance with 95.97% and 73.70% accuracy for AdaBoost and Random Forest respectively, outperforming the baseline models by 12.72% and 14.8%.

Euler : Detecting Network Lateral Movement via Scalable Temporal Link Prediction

Lateral movement is a key stage of system compromise used by advanced persistent threats. Detecting it is no simple task. When network host logs are abstracted into discrete temporal graphs, the problem can be reframed as anomalous edge detection in an evolving network. Research in modern deep graph learning techniques has produced many creative and complicated models for this task. However, as is the case in many machine learning fields, the generality of models is of paramount importance for accuracy and scalability during training and inference. In this article, we propose a formalized approach to this problem with a framework we call Euler . It consists of a model-agnostic graph neural network stacked upon a model-agnostic sequence encoding layer such as a recurrent neural network. Models built according to the Euler framework can easily distribute their graph convolutional layers across multiple machines for large performance improvements. Additionally, we demonstrate that Euler -based models are as good, or better, than every state-of-the-art approach to anomalous link detection and prediction that we tested. As anomaly-based intrusion detection systems, our models efficiently identified anomalous connections between entities with high precision and outperformed all other unsupervised techniques for anomalous lateral movement detection. Additionally, we show that as a piece of a larger anomaly detection pipeline, Euler models perform well enough for use in real-world systems. With more advanced, yet still lightweight, alerting mechanisms ingesting the embeddings produced by Euler models, precision is boosted from 0.243, to 0.986 on real-world network traffic.

Anomaly-based intrusion detection system based on feature selection and majority voting

Recently, cyberattacks have been more complex than in the past, as a new cyber-attack is initiated almost every day. Therefore, researchers should develop efficient intrusion detection systems (IDS) to detect cyber-attacks. In order to improve the detection and prevention of the aforementioned cyber-attacks, several articles developed IDSs exploiting machine learning and deep learning. In this paper, a way to find network intrusions using a combination of feature selection and adoptive voting is investigated. NSL-KDD dataset, a high-dimensional dataset that has been widely used for network intrusion detection, is applied in this approach. Feature selection plays an important role for improving accuracy and testing time as it eliminates the less significant attributes from the data set, thus saving computational power and effort. The experimental results show that the proposed approach achieves an accuracy of 86.5% on the NSL-KDD test dataset using an adoptive voting algorithm trained with the selected features. In addition, the time to process each record is 97.5 microseconds, which reflects the proposed model's superior performance. Comparing the proposed model with the existing models in the literature shows that the proposed adaptive voting approach significantly improves intrusion detection accuracy, enhances computational efficiency, and reduces false positives.

Dynamic Inertia Weight Particle Swarm Optimization for Anomaly Detection: A Case of Precision Irrigation

Anomaly-based Intrusion Detection System (IDS) is a type of IDS that detects abnormal behaviors by analyzing system activity and network traffic. Anomaly-based IDS works by establishing a baseline of normal behavior for a system or a network. However, these types of systems are less used compared to signature-based IDS for one primary challenge: How to define this normal behavior baseline? The answer to this question is complicated, since it involves not only analyzing or learning from historical data, but requires and understanding of the business domain the system is implemented in. The present study proposes a novel approach to constructing an unsupervised data classifier that combines both Particle Swarm Optimization (PSO) and clustering techniques for anomaly detection. The primary objective of this methodology is to surmount the limitations that conventional clustering algorithms suffer from, such as their inability to identify non-linear patterns within the data, susceptibility to initial conditions, and difficulty in overcoming the problem of local optima. The concept of particle systems is discussed by examining their origins, search strategies, and convergence mechanisms. We use a variant of the Particle Swarm Optimization called Dynamic Inertia Weight-Particle Swarm optimization (DIW-PSO) for our clustering process, and we elaborate on the reasoning behind this decision. Subsequently, we describe the labeling algorithm used for the resulting clusters and we explain the process for identifying anomalous clusters. We have demonstrated the effectiveness of our method by applying it to an intelligent irrigation control system for cotton plants. The results show that our classifier was able to accurately detect abnormal patterns that deviated from the optimal water requirements and growth conditions of the plants.