Anomaly Intrusion Detection System Research Articles

Analysis of a Fuzzy Based Intrusion Detection System in Wireless Ad Hoc Networks

Technology and its growth is considerably enormous. This massive growth allows the opening of new fields of application in the domain of wireless networking and mobile ad-hoc networks (MANET) is one of its kinds. Mobile ad hoc network is widely used from collaborative computing to time critical applications in indoor and outdoor environment. Mobility of ad hoc network makes very attractive in all areas of mobile applications. Nodes participating in mobile ad hoc networks are autonomous, self-configurable and act as a router as well. These types of networks are dynamic in nature and have sort life time. Dynamic nature and limitations of the wireless transmission medium make MANET unsecured and vulnerable to various attacks. It is very tough to implement security for this networks and it opens up doors for further research work on this area. There is a great scope for designing a system to identify attacks and take countermeasures to minimize it and keep the performance of the network within acceptable limits. Intrusion detection system is one of its kinds and considered as security mechanism for MANET. This thesis explores different types of intrusion detection system like misuse detection and anomaly detection for mobile ad hoc networks. Anomaly detection techniques for ad hoc networks depend on the characterization of normal behavior pattern of wireless nodes. This research work focuses on wireless node behavior based detection technique. Most of anomaly intrusion detection systems are focusing on upper layer traffic to a profile normal behavior of wireless node. This research work focus on media access control (MAC) layer and network layer of wireless node. It is inefficient to use a large feature set of MAC layer and network layer due to energy limitation in ad-hoc network. A minimal feature set from MAC layer and network layer were proposed. This research work proposed an anomaly intrusion detection system for mobile ad hoc network using fuzzy logic and weighted average method. The network performance of mobile ad hoc network with intrusion detection system was analyzed using various network parameters. Further the performance of the performance of the intrusion detection system was analyzed using detection rate and false alarms. Results show good improvement in detection rate and other performance metrics

A Hybrid Intrusion Detection Approach for Cyber Attacks

The field of cybersecurity constantly evolves as attackers develop new methods and technologies. Defending against cyberattacks involves a combination of robust security measures, regular updates, user education, and the use of advanced technologies, such as intrusion detection systems and artificial intelligence, to find out the threats in real-time. IDS are designed to identify and address any unauthorized actions or potential security threats within a computer network or system. A hybrid intrusion detection system (IDS) combines many detection techniques and strategies from different IDS types into a single, coherent solution. Combining the benefits of each approach should result in more comprehensive and effective intrusion detection. This paper outlines a proposed anomaly intrusion detection system (AIDS) framework that leverages a hybrid of deep learning strategies. It incorporates Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models, which were developed using XGBoost, and their efficacy was assessed with the NSL-KDD dataset. The evaluation of the suggested model focused on its accuracy, detection capabilities, and the rate of false positives. The outcomes of this research are noteworthy within the cybersecurity field. In this paper, a framework of an Anomaly IDS is proposed. The purpose of an anomaly IDS, or AIDS, is to spot odd behavior on a network or system that might point to a security breach or malevolent attempt to hack it. Anomaly-based IDSs concentrate on finding departures from accepted typical behavior, in contrast to signature-based detection systems, which depend on a predefined database of known attack patterns.

A novel botnet attack detection for IoT networks based on communication graphs

Intrusion detection systems have been proposed for the detection of botnet attacks. Various types of centralized or distributed cloud-based machine learning and deep learning models have been suggested. However, the emergence of the Internet of Things (IoT) has brought about a huge increase in connected devices, necessitating a different approach. In this paper, we propose to perform detection on IoT-edge devices. The suggested architecture includes an anomaly intrusion detection system in the application layer of IoT-edge devices, arranged in software-defined networks. IoT-edge devices request information from the software-defined networks controller about their own behaviour in the network. This behaviour is represented by communication graphs and is novel for IoT networks. This representation better characterizes the behaviour of the device than the traditional analysis of network traffic, with a lower volume of information. Botnet attack scenarios are simulated with the IoT-23 dataset. Experimental results show that attacks are detected with high accuracy using a deep learning model with low device memory requirements and significant storage reduction for training.Graphical abstract

The robust scheme for intrusion detection system in Internet of Things

Machine learning and deep learning-based anomaly intrusion detection systems (IDSs) have become prevalent in securing IoT networks due to their ability to monitor traffic and detect zero-day attacks. However, recent studies highlight the high vulnerability of these models to adversarial attacks, in which minor input perturbations can significantly decrease the detection accuracy. Although many studies have focused on adversarial attack and defense techniques for deep learning, machine learning, particularly decision trees, has received limited attention. In this study, we aim to assess the efficacy of the robust decision tree in adversarial IoT environments. Our first experiments reveal the robust decision tree’s sensitivity to the offset parameter. We thus propose a statistical approach to auto-select the offset value, enhancing model stability across varying attack offsets. Then, we present a robust scheme for IDSs in IoT environments. This approach employs the enhanced robust decision tree and a tabular deep learning model to detect and classify a range of cyber attacks. Our evaluation results on three popular IDS datasets—IoTID20, CIC-IDS-2017, and BOT-IoT—demonstrate that our proposed approach is robust under various adversarial attack conditions and achieves a consistent accuracy of over 95% in classifying different attack types.

An Intrusion Detection Model using election-Based Feature Selection and K-NN

The Internet of Things (IoT) is a harmonized embedded object and sensor set. It is a target of intrusions, which leads to considering the security of the IoT environment. Considering their vital role in network security, intrusion detection systems (IDS) have received significant interest in the research community. IDS can be divided into anomaly intrusion detection systems (AIDS) and signature intrusion detection systems (SIDS). In this work, we integrate AIDS to secure IoT environments better and enhance the privacy of data circulated within sensors and actuators which interact with the real world. However, a network intrusion detection system (NIDS) mitigates security issues. We present in this paper an effective NIDS for IoT security relying on machine learning such as K-NN and feature selection. Specifically, we designed our model using K-Nearest Neighbors (K-NN) algorithm to boost the performance and enhance the IDS accuracy (ACC), with feature selection algorithms separately, such as principal component analysis (PCA), genetic algorithm (GA) and univariate statistical test. We elected every feature that two or three methods have selected. Hence, our election-based feature selection method lasted with five features where the model has shown promising results in ACC, false alarm rate (FAR), and detection rate (DR). To evaluate the performance of our model on imbalanced datasets, we ran our tests on the Bot-IoT dataset. We measured the model using Matthew's Correlation Coefficient (MCC) to have a better performance evaluation, where it scored up to 97%. The suggested model resulted in 99.99% ACC and considerably changed the training time from 21696 seconds for the entire dataset to 102 seconds for the five selected features. Our proposed model provides significant performances compared with previous models

Harris hawk optimization trained artificial neural network for anomaly based intrusion detection system

SummaryAn integral part of security infrastructure is detecting and identifying malicious attacks commonly found in network environments. Despite its effectiveness at identifying anomalous network behaviors, an intrusion detection system (IDS) still has a low detection rate and a high rate of false alarms. This study proposes a novel effective anomaly IDS by integrating bio‐inspired optimization techniques, Harris hawk optimization (HHO), and an artificial neural network (ANN), called HHO‐ANN. Several experiments were conducted with other methods to verify the performance and capabilities of the proposed technique. The AWID, CIDDS001, NSL‐KDD, and NSL‐KDD datasets were used to benchmark the performance of the proposed method. Popular evolutionary algorithms, such as genetic algorithm, particle swarm optimization, moth‐flame optimization, and locust swarm optimization based on ANN trainer, were implemented to validate the result. Comparison with existing methods in the literature reveals that the proposed method offers more accuracy. Simulation results confirm that the proposed method has excellent speed convergence and a high‐reliability level due to a lower risk of getting stuck in the local minima region. The proposed method achieved accuracy of 96.71%, 98.03%, 98.25%, and 97.95% for AWID, CIDDS‐001, NSL‐KDD, and UNSW‐NB15, respectively.

A comprehensive survey of network traffic anomalies and DDoS attacks detection schemes using fuzzy techniques

Anomaly intrusion detection systems are a class of intrusion detection systems that do not rely on the security attacks' signatures and focus on finding unknown malicious behaviors and attacks. In this context, some of the anomaly detection schemes benefit from various fuzzy data mining and statistical methods to deal with ambiguity in the intrusion detection process. The main objective of this article is to put forward an extensive and structured survey of the fuzzy logic-based network traffic anomaly and Distributed Denial of Service (DDoS) attack detection approaches. It groups the investigated scheme concerning the fuzzy techniques applied to deal with network anomalies and DDoS attacks. It illuminates how the fuzzy network anomaly detection approaches have integrated various techniques such as classifiers, feature selection/extraction methods, and statistical and clustering algorithms to find anomalous traffic. Besides, the significant challenges, issues, and ideas in network anomaly detection are discussed. Lastly, several future research topics are provided to better lead the subsequent studies in this context.

Enhance density peak clustering algorithm for anomaly intrusion detection system

In this paper proposed new model of Density Peak Clustering algorithm to enhance clustering of intrusion attacks. The Anomaly Intrusion Detection System (AIDS) by using original density peak clustering algorithm shows the stable in result to be applied to data-mining module of the intrusion detection system. The proposed system depends on two objectives; the first objective is to analyzing the disadvantage of DPC; however, we propose a novel improvement of DPC algorithm by modifying the calculation of local density method based on cosine similarity instead of the cat off distance parameter to improve the operation of selecting the peak points. The second objective is using the Gaussian kernel measure as a distance metric instead of Euclidean distance to improve clustering of high-dimensional complex nonlinear inseparable network traffic data and reduce the noise. The experimentations evaluated with NSL-KDD dataset.

Enhance density peak clustering algorithm for anomaly intrusion detection system

In this paper proposed new model of Density Peak Clustering algorithm to enhance clustering of intrusion attacks. The Anomaly Intrusion Detection System (AIDS) by using original density peak clustering algorithm shows the stable in result to be applied to data-mining module of the intrusion detection system. The proposed system depends on two objectives; the first objective is to analyzing the disadvantage of DPC; however, we propose a novel improvement of DPC algorithm by modifying the calculation of local density method based on cosine similarity instead of the cat off distance parameter to improve the operation of selecting the peak points. The second objective is using the Gaussian kernel measure as a distance metric instead of Euclidean distance to improve clustering of high-dimensional complex nonlinear inseparable network traffic data and reduce the noise. The experimentations evaluated with NSL-KDD dataset.

DNA Encoding and STR Extraction for Anomaly Intrusion Detection Systems

Deoxyribonucleic acid (DNA) can be used to discover the presence of diseases in the human body. Similarly, its functionality can be leveraged in an intrusion detection system (IDS) to detect attacks against computer systems and network traffic. Various approaches have been proposed for using DNA sequences in IDSs. The most popular is the DNA sequence matching method, which is also used in biology. A technique that uses the DNA sequence in an IDS has previously been proposed to generate a normal signature sequence with an alignment threshold value. However, its detection rate is very low. Therefore, this paper considers the two main factors that affect the detection accuracy via the DNA sequence, DNA encoding and the short tandem repeat (STR) (i.e., the DNA keys and their positions). It then proposes two DNA encoding methods, named DEM3sel, and DEMdif, which differ in terms of the length of the DNA sequence and the network traffic representation. DEM3sel uses three characters to represent all 41 network attributes but uses a single fixed character to distinguish between nominal and numerical attributes. DEMdif uses different characters to represent all the network attributes based on the attribute values and uses a single fixed character to distinguish between nominal and numerical attributes. In all these methods, the Teiresias algorithm is used to extract the short tandem repeat (STR), which includes both the keys and their positions in the network traffic, while the Knuth-Morris-Pratt algorithm is used as a matching process to determine whether the network traffic is normal or an attack. An experiment is conducted to assess the proposed methods’ performance on two standard datasets: KDDCup 99 and NSL-KDD. The experiment is run 30 times for each DNA encoding method. The results show that DEM3sel obtains the best result compared with DEMdif, where the detection rate, false alarm rate, and accuracy of detection are 99.58%, 35.53%, and 92.74% respectively. The results also show that using more keys and their positions improves the false alarm rate and the accuracy of DEM3sel by up to 26.48% and 1.75%, respectively. Moreover, the performance of the proposed method DEM3sel is comparable to or better than state-of-the-art algorithms. Thus, it can be concluded that the proposed DNA sequence method is suitable for use in an IDS.

An Improvement of Neural Network Algorithm for Anomaly Intrusion Detection System

An Improvement of Neural Network Algorithm for Anomaly Intrusion Detection System

Detection of malicious packet dropping attacks in RPL-based internet of things

The routing protocol for low-power and lossy networks (RPL) is an IPv6-based routing protocol optimised for internet of things (IoT) environments. However, it is susceptible to malicious packet dropping attacks. If a node with a lower rank that is closer to the root node attempts a malicious packet dropping, it may disrupt basic data transmission or even the entire IoT application service. In this paper, we present a novel detection method for malicious packet dropping attacks against RPL-based networks. The proposed method is based on the anomaly intrusion detection system and detects malicious packet dropping in the presence of normal packet losses. We evaluate the performance of the method on Contiki's network simulator, Cooja. The evaluation results show that the method has good performance in detecting malicious packet dropping attacks. In every case, the successful detection rate is greater than 94% and the false alarm rate is less than 3%.

An enhanced J48 classification algorithm for the anomaly intrusion detection systems

In this paper, we have developed an enhanced J48 algorithm, which uses the J48 algorithm for improving the detection accuracy and the performance of the novel IDS technique. This enhanced J48 algorithm is seen to help in an effective detection of probable attacks which could jeopardise the network confidentiality. For this purpose, the researchers used many datasets by integrating different approaches like the J48, Naive Bayes, Random Tree and the NB-Tree. An NSL KDD intrusion dataset was applied while carrying out all experiments. This dataset was divided into 2 datasets, i.e., training and testing, which was based on the data processing. Thereafter, a feature selection method based on the WEKA application was used for evaluating the efficacy of all the features. The results obtained suggest that this algorithm showed a better, accurate and more efficient performance without using the above-mentioned features when compared to the feature selection procedure. An implementation of this algorithm guaranteed the dataset classification based on a detection accuracy of 99.88% for all the features when using the 10-fold cross-validation test, a 90.01% accuracy for the supplied test set after using the complete test datasets along with all the features and a 76.23% accuracy for supplying the test set after using the test-21 dataset along with all features.

A Learnable Anomaly Detection System using Attributional Rules

The continuous changing networks introduce new attacks, which represent an explicit problem that affects the security of enterprise resources. Thus, there is a real need to build up intelligent intrusion detection systems that can learn from the network behavior. In this paper, a learnable anomaly intrusion detection system based on attributional rules is presented. The proposed model is chosen with the advantages of being expressive, flexible and can operate in noisy and inconsistent environments. The system is a real-time intrusion detector that utilizes incremental supervised machine learning technique. Such technique makes use of the Algorithm Quasi-optimal (AQ) which is based on attributional calculus. Here, an Algorithm Quasi-optimal for Intrusion Detection System (AQ4IDS) is exploited and implemented using attributional rules to discriminate between normal and anomalous network traffic. The behavior of AQ4IDS is tested, and to illustrate its superiority. The experimental results showed that, the model automatically accommodates new rules from continuous network stream. Many experiments have verified the fact that AQ4IDS can efficiently discriminate between normal and anomalous network traffic, in addition to offering the advantage of detecting novel and zero day attacks.

Anomaly based IDS using Backpropagation Neural Network

means illegal entry or unwelcome addition of the system. So, Intrusion detection system is used to find out the signatures of an intrusion. The goal of the system is to protect system for various network attacks like Dos, U2R, R2L, Probing etc. Intrusion detection system (IDS) collects information from various parts of network and system. This paper introduces the Anomaly Intrusion Detection System that can detect various network attacks.The aim of this work is to identify those attacks with the support of supervised neural network, i.e. back propagation artificial neural network algorithm and make complete data safe. In this paper, system comprises experimenting neural networks that use only the (17 of 41) most significant features of the KDD 99 dataset. The proposed IDS use a supervised neural network to study system's performance.

Design and Analysis of Multimodel-Based Anomaly Intrusion Detection Systems in Industrial Process Automation

Industrial process automation is undergoing an increased use of information communication technologies due to high flexibility interoperability and easy administration. But it also induces new security risks to existing and future systems. Intrusion detection is a key technology for security protection. However, traditional intrusion detection systems for the IT domain are not entirely suitable for industrial process automation. In this paper, multiple models are constructed by comprehensively analyzing the multidomain knowledge of field control layers in industrial process automation, with consideration of two aspects: physics and information. And then, a novel multimodel-based anomaly intrusion detection system with embedded intelligence and resilient coordination for the field control system in industrial process automation is designed. In the system, an anomaly detection based on multimodel is proposed, and the corresponding intelligent detection algorithms are designed. Furthermore, to overcome the disadvantages of anomaly detection, a classifier based on an intelligent hidden Markov model, is designed to differentiate the actual attacks from faults. Finally, based on a combination simulation platform using optimized performance network engineering tool, the detection accuracy and the real-time performance of the proposed intrusion detection system are analyzed in detail. Experimental results clearly demonstrate that the proposed system has good performance in terms of high precision and good real-time capability.

Feature Selection Based Hybrid Anomaly Intrusion Detection System Using K Means and RBF Kernel Function

In Information Security, intrusion detection is the act of detecting actions that attempt to compromise the security goals. One of the primary challenges to intrusion detection is the problem of misjudgment, misdetection and lack of real time response to the attack. Various data mining techniques as clustering, classification and association rule discovery are being used for intrusion detection. The proposed hybrid technique combines data mining approaches like K Means clustering algorithm and RBF kernel function of Support Vector Machine as a classification module. The main purpose of proposed technique is to decrease the number of attributes associated with each data point. So, the proposed technique can perform better in terms of Detection Rate and Accuracy when applied to KDDCUP’99 Data Set.

A Fraud Detection System Based on Anomaly Intrusion Detection Systems for E-Commerce Applications

The concept of exchanging goods and services over the Internet has seen an exponential growth in popularity over the years. The Internet has been a major breakthrough of online transactions, leaping over the hurdles of currencies and geographic locations. However, the anonymous nature of the Internet does not promote an idealistic environment for transactions to occur. The increase in online transactions has been added with an equal increase in the number of attacks against security of online systems. Auction sites and e-commerce web applications have seen an increase in fraudulent transactions. Some of these fraudulent transactions that are executed in e-commerce applications happen due to successful computer intrusions on these web sites. Although a lot of awareness has been raised about these facts, there has not yet been an effective solution to adequately address the problem of application-based attacks in e-commerce. This paper proposes a fraud detection system that uses different anomaly detection techniques to predict computer intrusion attacks in e-commerce web applications. The system analyses queries that are generated when requesting server-side code on an e-commerce site, and create models for different features when information is extracted from these queries. Profiles associated with the e-commerce application are automatically derived from a training dataset.

A Semantic Approach to Host-Based Intrusion Detection Systems Using Contiguousand Discontiguous System Call Patterns

Host-based anomaly intrusion detection system design is very challenging due to the notoriously high false alarm rate. This paper introduces a new host-based anomaly intrusion detection methodology using discontiguous system call patterns, in an attempt to increase detection rates whilst reducing false alarm rates. The key concept is to apply a semantic structure to kernel level system calls in order to reflect intrinsic activities hidden in high-level programming languages, which can help understand program anomaly behaviour. Excellent results were demonstrated using a variety of decision engines, evaluating the KDD98 and UNM data sets, and a new, modern data set. The ADFA Linux data set was created as part of this research using a modern operating system and contemporary hacking methods, and is now publicly available. Furthermore, the new semantic method possesses an inherent resilience to mimicry attacks, and demonstrated a high level of portability between different operating system versions.

An Embedded System Used as Intelligent Node of Distributed Surveillance

The demand for intelligent surveillance is grown with the popularization of the camera monitoring network. An embedded system used as intelligent node of distributed surveillance is designed in this paper to improve the intelligent level of camera monitoring. Target detection and tracking can be implemented in this node and an anomaly intrusion detection system is designed based on the tracking results. Information sharing is realized via transmitting highly abstract object descriptors via the wireless network. A simple camera monitoring network is built in the labs to test the designed intelligent node and the experimental results indicate its effectiveness and accuracy.