Intrusion Detection Approach Research Articles

Use of Singular Value Decomposition for a Deep Learning-Based Fast Intrusion Detection System

تقنية الذكاء الاصطناعي القائمة على الشبكات العصبية الاصطناعية لتحديد المخاطر السيبرانية. اعتمدت مجموعة من المهن، بما في ذلك التعرف على أنماط أو فئات محددة، منهجيات التعلم العميق. تم استخدام البيانات من تقييمات كشف التسلل ومراقبة الأحداث الأمنية لتقييم حالة الشبكة. يجب تحسين أداء ودقة الكشف. قررنا اختبار مجموعة من الأساليب باستخدام مجموعة بيانات مفتوحة لتحديد أفضل نهج لاكتشاف التسلل. تهدف الدراسة الحالية إلى استكشاف إمكانية استخدام تحليل القيمة المفردة (SVD) كخطوة ما قبل المعالجة لتقليل أبعاد البيانات. بالإضافة إلى تقليل التشويش الناتج عن البيانات، تعمل خطوة المعالجة المسبقة هذه على تقليل أبعاد البيانات لتوفير الوقت في العمليات الحسابية. يمكن للاستراتيجية المقترحة أن تساعد الأساليب الأخرى المستخدمة حاليًا على الأداء بشكل أفضل. لقد قمنا باختبار استراتيجيات التخفيض على مجموعة بيانات UNSW-NB15، وكانت النتائج إيجابية للغاية.

A two stage lightweight approach for intrusion detection in Internet of Things

The prevalence of the Internet of Things (IoT) in people’s life has led to a significant rise in the amounts of breaches against different IoT devices. Given that IoT devices are typically installed in settings with constrained resources and limited processing power, and malicious traffic samples are difficult to collect, resulting in traditional deep learning algorithms that do not handle intrusion detection in IoT network well. In this work, we present a two-stage lightweight intrusion detection model based on self-supervised contrastive learning and self-knowledge distillation to reduce model’s over-reliance on labels, optimize the model’s capacity for generalization and significantly increase the IoT network’s intrusion detection speed while lowering the model’s complexity. The representations of the network traffic are extracted in the first step using self-supervised contrastive learning, and the representations learnt by the teacher model are transferred to the student model in the second stage using self-knowledge distillation. On the benchmark datasets KDD CUP99, NSL-KDD, UNSW-NB15, CIC IDS2017 and BoT-IoT, we carried out in-depth studies, and the experimental results demonstrate that our proposed model outperforms recent state-of-the-art models in addition to achieving superior intrusion detection capabilities. The code will be released at https://github.com/RicardoMLi/CL-SKD.

An RFE/Ridge-ML/DL based anomaly intrusion detection approach for securing IoMT system

Smart healthcare is one of the promising areas of the Internet of Things (IoT), particularly in the case of the Covid-19 pandemic. Real-time patient monitoring and remote diagnostics facilitate better medical services to preserve human lives using Internet of Medical Things (IoMT) technology. Regardless of the numerous benefits, IoMT devices are susceptible to sophisticated cyber-attacks at a breakneck pace, which lead to tampering with healthcare data and threaten patients' lives. In a similar context, the 2022 ransomware cyber-attack on Versailles André-Mignot Hospital compromised the healthcare system and disclosed tremendous amounts of patient information. Towards this direction, most researchers have solely developed either machine learning or Deep learning algorithms to identify network traffic anomalies. Motivated by the above challenges, an effort has been made in this paper to design a Recursive Feature Elimination (RFE) integrated with machine learning paradigms and a Ridge regression merged into deep learning models for implementing accurate anomaly intrusion detection based on the real-time dataset WUSTL-EHMS. Among the paradigms used, the proposed approach confirms that the RFE-based Decision Tree (DT) outperforms state-of-the-art techniques with a training accuracy of 99 % and a testing accuracy of 97.85 % while maintaining a reduction of FAR to 0.03. In a nutshell, it has been proven that the suggested framework can be deployed to build anomaly intrusion detection, reinforcing IoMT against widespread cyber-attacks and safeguarding the integrity of advanced healthcare systems.

Machine Learning Approaches for Network Intrusion Detection: An Evaluation of their Efficacy in Bolstering Security

Abstract: In today's digital environment, securing networked systems is critical due to the increasing sophistication and frequency of cyberattacks. Network Intrusion Detection Systems (NIDS) are essential for detecting and addressing unauthorized and harmful activities within a network. NIDS function by continuously monitoring network traffic and analyzing data packets for signs of suspicious behavior or known attack patterns. This paper provides an in-depth examination of NIDS, focusing on the application of three machine learning algorithms—K Neighbors Classifier, Logistic Regression, and Random Forest Classifier—to create a robust model for network intrusion detection using the NSL-KDD dataset. Our findings highlight the superior performance of the Random Forest Classifier, which achieved an accuracy of 99.31%, proving its effectiveness in differentiating between normal and malicious traffic. The analysis of ICMP, TCP, and UDP protocols reveals unique attack patterns, underscoring the need for protocol-specific security measures. Additionally, the study emphasizes the importance of integrating NIDS with other security systems for a multi-layered defense strategy and the crucial role of skilled personnel in managing and interpreting NIDS alerts. The results advocate for ongoing innovation and adaptation in NIDS technologies and strategies to effectively counter evolving cyber threats

A Hybrid Machine Learning Approach for Intrusion Detection and Mitigation on IoT Smart Healthcare

Strong cybersecurity solutions are becoming more and more important as Internet of Things (IoT) technology integration in healthcare settings develops. This study offers a method for feature extraction, selection, and attack classification by fusing the discriminative capacity of feedforward neural networks (FNNs) with the adaptability of fuzzy logic systems. In delicate healthcare database of IoT wearable devices, to reduce false alarm and guaranteeing intrusion detection dependability are the main priorities. The suggested method uses a feature extraction, selection technique, training and testing based on FNN, which allows the model to adjust to the dynamic and varied character of medical data. During the assessment stage, a dataset including a range of healthcare IoT scenarios, including different kinds of attacks, is used to train and evaluate the model, the ToN_IoT dataset was used. Fuzzy logic improves the system's resilience in identifying pertinent features by managing uncertainties and imprecise input. Fuzzy logic is one of the best technique for handling uncertainty, its linguistic representation and rule reasoning helps in better identification and classification. The findings indicate a noteworthy decrease in the frequency of false alarms when juxtaposed with conventional intrusion detection systems. Results obtained from the model are 99.2, 98.8, 99.5, 99.1 & 0.008 for accuracy, precision, recall, F1-Score and False alarm respectively. Promising outcomes in protecting IoT healthcare environments are demonstrated by the suggested system, opening the door to better patient data privacy and system resilience against cyberattacks.

Sensor and Decision Fusion-Based Intrusion Detection and Mitigation Approach for Connected Autonomous Vehicles

Sensor and Decision Fusion-Based Intrusion Detection and Mitigation Approach for Connected Autonomous Vehicles

Evaluating intrusion detection for microservice applications: Benchmark, dataset, and case studies

Microservices are predominant for cloud-based applications, which serve millions of customers daily, that commonly run business-critical systems on software containers and multi-tenant environments; so, it is of utmost importance to secure these systems. Intrusion detection is a widely applied technique that is now being used in microservices to build behavior detection models and report possible attacks during runtime. However, it is cumbersome to evaluate and compare the effectiveness of different approaches. Standardized frameworks are non-existent and without fairly comparing new techniques to the state-of-the-art, it is difficult to understand their pros and cons. This paper presents a comprehensive approach to evaluate and compare different intrusion detection approaches for microservice applications. A benchmarking methodology is proposed to allow users to standardize the process for a representative and reproducible evaluation. We also present a dataset that applies representative workloads and technologies based on microservice applications state-of-the-art. The benchmark and dataset are used in three case studies, characterized by dynamicity, scalability, and continuous delivery, to evaluate and compare state-of-the-art algorithms with the objective of tackling intrusion detection in microservices. Experiments show the usefulness and wide application range of the benchmark while showing the capacity of intrusion detection algorithms in different applications and deployments.

MEMFO-KELM: A Deep Learning Approach for Real-Time Intrusion Detection in Cloud Environments

With the increasing importance of network security in cloud environments, effective intrusion detection systems (IDS) are crucial for safeguarding data transmission and protecting against cyber attacks. This research proposes a novel IDS model named Mutation Enhanced Moth-Flame Optimization based Kernel Extreme Learning Machine (MEMFO-KELM) algorithm. The objective is to address the challenges associated with cloud environments and enhance the accuracy of intrusion detection in real-time scenarios. The MEMFO-KELM algorithm incorporates advanced techniques to improve classification performance and ensure accurate detection. The deep learning model architecture includes convolutional layers for capturing complex patterns, recurrent layers for modelling temporal dependencies, and fully connected layers for feature extraction. L1 regularization (Lasso) is applied to the fully connected layers to enhance interpretability and reduce model complexity. Here, four datasets are represented to validate the performance with different attacks and normal classes are implemented: MQTT-IoT-IDS2020, CSE-CIC-IDS2018, NSL-KDD, and Apache Web Server. The proposed IDS model achieves remarkable performance, with an accuracy of 98.4%, a false alarm rate of 0.056, a detection rate of 98%, and a computational time of 120 s. These results highlight the effectiveness of the MEMFO-KELM algorithm in accurately detecting intrusions. Comparative analysis reveals that the proposed real-time IDS model demonstrates its superiority compared to other methods. By addressing the challenges of cloud environments and incorporating advanced techniques, the MEMFO-KELM IDS model contributes to enhanced network security, mitigates the risks associated with cyber attacks, and ensures the integrity of globally distributed resources.

ESVI-GaMM: A fast network intrusion detection approach based on the Bayesian gamma mixture model

As the application of networks permeates various aspects of daily life, maintaining network security has become a crucial challenge. A network intrusion detection system (NIDS) functions as a critical technique for securing cyberspace and has gained considerable attention. Although researchers have made significant progress in developing NIDSs, challenges still exist in high-speed networks with overwhelming network traffic. Existing methods largely focus on improving model detection accuracy and often overlook speed and computational efficiency. This oversight renders most current methods impractical for real-world high-speed network scenarios. To address this issue, we propose an innovative and efficient network intrusion detection algorithm, namely, the Bayesian gamma mixture model (GaMM) classifier. With the recently proposed extended stochastic variational inference (ESVI) framework, we introduce lower-bound approximations to the evidence lower bound (ELBO), namely, the original variational object function. An analytically tractable Bayesian estimation algorithm for a GaMM is derived through stochastic optimization of the obtained lower bound and we validate its performance and computational efficiency on three publicly available datasets (CICMalmem2022, OPCUA, and CICIDS2018). The experimental results indicate that the proposed classifier not only achieves a detection performance comparable to that of other benchmark models but also significantly reduces both the training and detection times.

Group-Based Federated Knowledge Distillation Intrusion Detection

Intrusion detection based on federated learning allows the sharing of more high-quality attack samples to improve the intrusion detection performance of local models while preserving the privacy of local data. Most research on federated learning intrusion detection requires local models to be homogeneous. However, in practical scenarios, local models often include both homogeneous and heterogeneous models due to differences in hardware capabilities and business requirements among nodes. Additionally, there is still room for improvement in the accuracy of recognizing novel attacks in existing researches. To address the challenges mentioned above, we propose a Group-based Federated Knowledge Distillation Intrusion Detection approach. First, through a step-by-step grouping method, we achieve the grouping effect of intra-group homogeneity and inter-group heterogeneity, laying the foundation for reducing the aggregation difficulty in intra-group homogenous aggregation and inter-group heterogeneous aggregation. Second, in intra-group homogenous aggregation, a dual-objective optimization model is employed to quantify the learning quality of local models. Weight coefficients are assigned based on the learning quality to perform weighted aggregation. Lastly, in inter-group heterogeneous aggregation, the group leader model’s learning quality is used to classify and aggregate local soft labels, generating global soft labels. Group leader models utilize global soft labels for knowledge distillation to acquire knowledge from heterogeneous models. Experimental results on NSL-KDD and UNSW-NB datasets demonstrate the superiority of our proposed method over other algorithms.

NERO: NEural algorithmic reasoning for zeRO-day attack detection in the IoT: A hybrid approach

Anomaly detection approaches for network intrusion detection learn to identify deviations from normal behavior on a data-driven basis. However, current approaches strive to infer the degree of abnormality of out-of-distribution samples when these appertain to different zero-day attacks. Inspired by the successes of the neural algorithmic reasoning paradigm to leverage the generalization of rule-based behavior, this paper presents a deep learning strategy for solving zero-day network attack detection and categorization. Moreover, focusing on the particular scenario of the Internet of Things (IoT), the privacy preservation requirement may imply a low training data regime for any learning algorithm. To this respect, the presented framework uses metric-based meta-learning to achieve few-shot learning capabilities. The presented pipeline is called NERO, as it imports the encode-process-decode architecture from the NEural algorithmic reasoning blueprint to converge zeRO-day attack detection policies within constrained training data.

Hierarchical multistep approach for intrusion detection and identification in IoT and Fog computing-based environments

Special security techniques, such as intrusion detection mechanisms, are indispensable in modern computer systems. With the emergence of the Internet of Things they have become even more important. It is important to detect and identify the attack in a category so that countermeasures specific to the threat category can be resolved. However, most existing multiclass detection approaches have some weaknesses, mainly related to detecting specific categories of attacks and problems with false positives. This article addresses this research problem and advances state-of-the-art, bringing contributions to a two-stage detection architecture called DNNET-Ensemble, combining binary and multiclass detection. While the benign traffic can be quickly released on the first detection, the intrusive traffic can be subjected to a robust analysis approach without causing delay issues. Additionally, we propose the DNNET binary approach for the binary detection level, which can provide more accurate and faster binary detection. We present the proposal of a federated strategy to train the neural model of the DNNET method without sending data to the cloud, thus preserving the privacy of local data. The proposed Hybrid Attribute Selection strategy can find an optimal subset of attributes through a wrapper method with a lower training cost due to pre-selection using a filter method. Furthermore, the proposed Soft-SMOTE improvement allows operating with a balanced dataset with a minor training time increase, even in scenarios where there are a large number of classes with a large imbalance among them. Results obtained from experiments on renowned intrusion datasets and laboratory experiments demonstrate that the approach can achieve superior detection rates and false positive performance compared to other state-of-the-art approaches.

An adversarial environment reinforcement learning-driven intrusion detection algorithm for Internet of Things

The increasing prevalence of Internet of Things (IoT) systems has made them attractive targets for malicious actors. To address the evolving threats and the growing complexity of detection, there is a critical need to search for and develop new algorithms that are fast and robust in detecting and classifying dangerous network traffic. In this context, deep reinforcement learning (DRL) is gaining recognition as a prospective solution in numerous fields as it enables autonomous agents to cooperate with their environment for decision-making without relying on human experts. This article presents an innovative approach to intrusion detection in IoT systems using an adversarial reinforcement learning (RL) algorithm known for its exceptional predictive capabilities. The predictive process relies on a classifier, implemented as a streamlined and highly efficient neural network. Embedded within this classifier is a policy function meticulously trained using an innovative RL model. Importantly, this model ensures that the environment’s behavior is dynamically fine-tuned simultaneously with the learning process, improving the overall effectiveness of the intrusion detection approach. The efficiency of our proposal was assessed using the Bot-IoT database, consisting of a mixture of legitimate IoT network traffic and simulated attack scenarios. Our scheme shows superior performance compared to existing ones. Therefore, our approach to IoT intrusion detection can be considered a valuable alternative to existing methods, capable of significantly improving the IoT systems’ security.

ENHANCED NETWORK SECURITY: A DATA MINING APPROACH TO INTRUSION DETECTION

In the ever-evolving landscape of network security, the role of Intrusion Detection Systems (IDSs) is critical. These systems serve as the guardians of digital networks, defending against a relentless tide of cyber threats. However, the efficacy of IDSs in accurately detecting and preventing these threats remains a critical concern. The emergence of new attack vectors and the growing sophistication of cyberattacks underscore the need for innovative approaches to intrusion detection. Nonetheless, there is an information vacuum about the efficacy of different data mining approaches in intrusion detection. This study investigates the deployment of seven data mining models, which include Decision Tree, Random Forest, Support Vector Machine (SVM), Logistic Regression, Naïve Bayes, and two types of Recurrent Neural Networks (RNN) on five (5) IDS benchmark datasets. Based on the undertaken experiments, it is evident that the RNN is the best classifier as it obtained 100% accuracy for all datasets. Due to its strength in modelling time-dependent and sequential data problems, RNN has become powerful in predicting future attacks. As our digital world evolves, so must our cyber defences; hence, this study strives to equip network security professionals with the knowledge and tools needed to fortify their networks, ensuring resilience against the ever-adaptive landscape of cyber threats.

A computationally efficient dimensionality reduction and attack classification approach for network intrusion detection

A computationally efficient dimensionality reduction and attack classification approach for network intrusion detection

Enhancing Network Security: Leveraging Machine Learning for Intrusion Detection

In order to precisely identify and categorise different kinds of network attacks, this study focuses on applying machine learning approaches for network intrusion detection. Data collection, preprocessing, feature scaling, model definition, feature selection, and assessment metrics are all part of the methodology. Different machine learning models, including Decision Tree Classifier and Random Forest Classifier, are considered, along with the use of all features or some part of features for each attack category. Evaluation is performed using K-fold cross-validation, with metrics such as accuracy, precision, recall, and F1-score analysed. Results indicate the efficiency of Random Forest Classifier in handling high-dimensional datasets and improving detection accuracy, making it a superior choice for network intrusion detection tasks.

A Critical Review of Artificial Intelligence Based Approaches in Intrusion Detection: A Comprehensive Analysis

Intrusion detection (ID) is critical in securing computer networks against various malicious attacks. Recent advancements in machine learning (ML), deep learning (DL), federated learning (FL), and explainable artificial intelligence (XAI) have drawn significant attention as potential approaches for ID. DL-based approaches have shown impressive performance in ID by automatically learning relevant features from data but require significant labelled data and computational resources to train complex models. ML-based approaches require fewer computational resources and labelled data, but their ability to generalize to unseen data is limited. FL is a relatively new approach that enables multiple entities to train a model collectively without exchanging their data, providing privacy and security benefits, making it an attractive option for ID. However, FL-based approaches require more communication resources and additional computation to aggregate models from different entities. XAI is critical for understanding how AI models make decisions, improving interpretability and transparency. While existing literature has explored the strengths and weaknesses of DL, ML, FL, and XAI-based approaches for ID, a significant gap exists in providing a comprehensive analysis of the specific use cases and scenarios where each approach is most suitable. This paper seeks to fill this void by delivering an in-depth review that not only highlights strengths and weaknesses but also offers guidance for selecting the appropriate approach based on the unique ID context and available resources. The selection of an appropriate approach depends on the specific use case, and this work provides insights into which method is best suited for various network sizes, data availability, privacy, and security concerns, thus aiding practitioners in making informed decisions for their ID needs.

Adaptive weighted kernel support vector machine-based circle search approach for intrusion detection in IoT environments

Adaptive weighted kernel support vector machine-based circle search approach for intrusion detection in IoT environments

Enhancing IoT Security: A Few-Shot Learning Approach for Intrusion Detection

Recently, the number of Internet of Things (IoT)-connected devices has increased daily. Consequently, cybersecurity challenges have increased due to the natural diversity of the IoT, limited hardware resources, and limited security capabilities. Intrusion detection systems (IDSs) play a substantial role in securing IoT networks. Several researchers have focused on machine learning (ML) and deep learning (DL) to develop intrusion detection techniques. Although ML is good for classification, other methods perform better in feature transformation. However, at the level of accuracy, both learning techniques have their own certain compromises. Although IDSs based on ML and DL methods can achieve a high detection rate, the performance depends on the training dataset size. Incidentally, collecting a large amount of data is one of the main drawbacks that limits performance when training datasets are lacking, and such methods can fail to detect novel attacks. Few-shot learning (FSL) is an emerging approach that is employed in different domains because of its proven ability to learn from a few training samples. Although numerous studies have addressed the issues of IDSs and improved IDS performance, the literature on FSL-based IDSs is scarce. Therefore, an investigation is required to explore the performance of FSL in IoT IDSs. This work proposes an IoT intrusion detection model based on a convolutional neural network as a feature extractor and a prototypical network as an FSL classifier. The empirical results were analyzed and compared with those of recent intrusion detection approaches. The accuracy results reached 99.44%, which shows a promising direction for involving FSL in IoT IDSs.

Rap-Densenet Framework for Network Attack Detection and Classification

Cybersecurity is becoming increasingly important with the rise in Internet usage. The two most frequent cyberattacks that can seriously harm a website or a server and render them inaccessible to other customers are denial of service (DoS) and distributed denial of service (DDoS) attacks. These attacks are so common and take many different forms, it is difficult to identify and respond to them with previous methods. Furthermore, computational complexity, inconsistency, and irrelevant data are problems for traditional intrusion detection methods. As a result, a powerful deep learning-based technique is applied in this study for the identification and categorisation of DoS and DDoS attacks. Refined Attention Pyramid Network (RAPNet)-based feature extraction is used in this proposed framework to extract features from the input data. Then, Binary Pigeon Optimisation Algorithm (BPOA) is used to determine the best features. After choosing optimal characteristics, Densenet201-based deep learning is deployed to categorise the assaults in Bot-IoT, CICIDS2017, and CICIDS2019 datasets. Furthermore, the Conditional Generative Adversarial Network (CGAN) is used to provide extra data samples for minority classes to address the issue of imbalanced data. The findings show that the proposed model can precisely identify and categorise DoS and DDoS assaults in comparison to the existing intrusion detection approaches with 99.43%, 99.26%, and 99.38% accuracy for CICIDS2019, CICIDS2017, and BoT-IoT correspondingly.