Intrusion Detection Approach Research Articles

A lightweight approach for intrusion detection in WSNs based on DCGAN

A lightweight approach for intrusion detection in WSNs based on DCGAN

A Novel Few-Shot ML Approach for Intrusion Detection in IoT

A Novel Few-Shot ML Approach for Intrusion Detection in IoT

Unified and evolved approach based on neural network and deep learning methods for intrusion detection

Currently, network security has become a major concern for all entities around the world. Attackers employ various methods to disrupt services, which requires new methods to stop them all in one way. Moreover, these intrusions can evolve and overcome security measures and devices, which pushes to use new evolving methods able to accompany the evolution of these threats, to block them. In our paper, we propose a new approach for intrusion detection, founded on neural network (NN) and deep learning (DL) methods. This approach is planned to not only identify threats, but also to develop a long-term memory of them, in order to detect new ones resembling these memorized attacks, and simultaneously, to provide a single way to stop all kinds of intrusions. To test our model, we have chosen the most recently employed methods in literature, NN and DL algorithms: feedforward neural network (FNN), convolutional neural network (CNN), and long short-term memory (LSTM), then we have applied them on network security layer-knowledge discovery in databases (NSL KDD) intrusions dataset. The results of experiments were impressive for all the algorithms, with maximum performances noted by LSTM, which affirms the efficacy of our proposed method for intrusion detection.

Corrections to “A Hierarchical Unmanned Aerial Vehicle Network Intrusion Detection and Response Approach Based on Immune Vaccine Distribution”

Corrections to “A Hierarchical Unmanned Aerial Vehicle Network Intrusion Detection and Response Approach Based on Immune Vaccine Distribution”

A novel deep anomaly detection approach for intrusion detection in futurisitic network

<span lang="EN-US">In an era where networks are increasingly heterogeneous and multi-domain, establishing robust security models to protect data and network infrastructure is becoming ever more complex. Traditional intrusion detection systems (IDS) often struggle with novel or variant attacks that fall outside predefined rule sets, resulting in significant detection challenges. This paper proposes a methodologically refined approach leveraging data-driven insights and statistically robust feature selection to enhance the training dataset. The study presents a long short-term memory-autoencoder (LSTM-AE) based learning model designed for multi-class anomaly detection. The model's novelty lies in its application of distance metrics to define distinct thresholds for varied attack classifications, a strategy that significantly amplifies detection precision. Experimental results validate the superior performance of the proposed system, achieving 94.82% accuracy rate, outperforming similar existing works. The study also proactively addresses common issues of class imbalance and skewed data representation in benchmark datasets by strategically training the model on normal traffic, enhancing its capability to generalize and identify anomalies effectively.</span>

CNN-GWO-voting & hybrid: ensemble learning inspired intrusion detection approaches for cyber-physical systems

CNN-GWO-voting & hybrid: ensemble learning inspired intrusion detection approaches for cyber-physical systems

Enhancing Cyber Security in Autonomous Vehicles: A Hybrid XG Boost-Deep Learning Approach for Intrusion Detection in the CAN Bus

Enhancing Cyber Security in Autonomous Vehicles: A Hybrid XG Boost-Deep Learning Approach for Intrusion Detection in the CAN Bus

Securing fog-assisted IoT smart homes: a federated learning-based intrusion detection approach

Securing fog-assisted IoT smart homes: a federated learning-based intrusion detection approach

Advancing IoT security: A novel intrusion detection system for evolving threats in industry 4.0 using optimized convolutional sparse Ficks law graph point trans-Net

With the rapid advancement of Industry 4.0, the integration of Internet of Things (IoT) strategies in industrial environments has increased exponentially. While this integration enhances productivity and efficiency, it also introduces significant security vulnerabilities. Previous research has employed several deep learning approaches for intrusion detection; however, these methods often suffer from insufficient accuracy, increased computational time, complexity, and higher error rates. To address these issues, this work proposes an innovative solution: "Advancing IoT Security: A Novel Intrusion Detection System (IDS) for Evolving Threats in Industry 4.0 using optimized Convolutional Sparse Fick's Law Graph Pointtrans-Net (CSFLGPtrans-Net)." The proposed system utilizes a comprehensive intrusion detection dataset composed of four different datasets: ToN-IoT, NSL-KDD, CSE‑CIC‑IDS2018, and IoT_bot. Initially, the input data undergoes a pre-processing stage that includes cleaning columns and rows, encoding features, and normalizing data. Following this, a hybrid optimization method, combining the Fire Hawk Optimizer with the Spider Wasp Optimizer, is applied for feature selection. This step is crucial for identifying the most significant features to enhance classification accuracy. The refined data is then classified using the CSFLGPtrans-Net model. To ensure secure data transfer, Fuzzy-based Elliptic Curve Cryptography (FECC) is employed. Experimental simulations conducted on the Python platform demonstrate that the proposed method outperforms existing approaches across various performance metrics, achieving a higher accuracy of 98% and a recall of 0.993. These results highlight the method's superior efficiency and potential for further advancement in securing Industry 4.0 environments.

A Hybrid Approach for Intrusion Detection by Dragonfly Optimization and Bayesian Neural Network Methodologies

The technique of keeping an eye out for malicious activity or policy violations on a computer network or system is known as intrusion detection. It entails examining system logs, network traffic, and other data sources to spot potential security breaches, misuse, and illegal access. Network-based and host-based intrusion detection systems (IDS) are the two types available. The former analyzes network traffic and packets, while the latter concentrates on specific hosts or devices. This paper investigates how to improve intrusion detection systems in cyber security by combining dragonfly optimization (DFO) and Bayesian neural network (BNN) methodologies. The NSL-KDD dataset, which is tested and trained in the system, is the source of the dataset used in the study. By utilizing the optimization skills of DFO and the probabilistic reasoning powers of BNN, the hybrid technique improves the accuracy and flexibility of detecting and addressing network intrusions. This research illustrates the effectiveness of the suggested methodology in navigating dynamic network environments and identifying emerging dangers through a thorough examination. In addition to improving detection performance, the integration of BNN and DFO gives enterprises insightful information about infiltration patterns and the ability to take proactive measures to thwart hostile activity. The created model's enhanced intrusion detection performance is demonstrated by the experimental findings. These results are validated in terms of accuracy, precision, recall, execution time, and F1 score by comparing them with models that are currently in use.

Network anomaly detection using Deep Autoencoder and parallel Artificial Bee Colony algorithm-trained neural network

Cyberattacks are increasingly becoming more complex, which makes intrusion detection extremely difficult. Several intrusion detection approaches have been developed in the literature and utilized to tackle computer security intrusions. Implementing machine learning and deep learning models for network intrusion detection has been a topic of active research in cybersecurity. In this study, artificial neural networks (ANNs), a type of machine learning algorithm, are employed to determine optimal network weight sets during the training phase. Conventional training algorithms, such as back-propagation, may encounter challenges in optimization due to being entrapped within local minima during the iterative optimization process; global search strategies can be slow at locating global minima, and they may suffer from a low detection rate. In the ANN training, the Artificial Bee Colony (ABC) algorithm enables the avoidance of local minimum solutions by conducting a high-performance search in the solution space but it needs some modifications. To address these challenges, this work suggests a Deep Autoencoder (DAE)-based, vectorized, and parallelized ABC algorithm for training feed-forward artificial neural networks, which is tested on the UNSW-NB15 and NF-UNSW-NB15-v2 datasets. Our experimental results demonstrate that the proposed DAE-based parallel ABC-ANN outperforms existing metaheuristics, showing notable improvements in network intrusion detection. The experimental results reveal a notable improvement in network intrusion detection through this proposed approach, exhibiting an increase in detection rate (DR) by 0.76 to 0.81 and a reduction in false alarm rate (FAR) by 0.016 to 0.005 compared to the ANN-BP algorithm on the UNSW-NB15 dataset. Furthermore, there is a reduction in FAR by 0.006 to 0.0003 compared to the ANN-BP algorithm on the NF-UNSW-NB15-v2 dataset. These findings underscore the effectiveness of our proposed approach in enhancing network security against network intrusions.

ML-ACID: a Modified Machine Learning Algorithm Coupled With a Novel Ant Colony Approach for Intrusion Detection in IOT

ML-ACID: a Modified Machine Learning Algorithm Coupled With a Novel Ant Colony Approach for Intrusion Detection in IOT

An ensemble learning approach for intrusion detection in IoT-based smart cities

An ensemble learning approach for intrusion detection in IoT-based smart cities

VAE-WACGAN: An Improved Data Augmentation Method Based on VAEGAN for Intrusion Detection.

To address the class imbalance issue in network intrusion detection, which degrades performance of intrusion detection models, this paper proposes a novel generative model called VAE-WACGAN to generate minority class samples and balance the dataset. This model extends the Variational Autoencoder Generative Adversarial Network (VAEGAN) by integrating key features from the Auxiliary Classifier Generative Adversarial Network (ACGAN) and the Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP). These enhancements significantly improve both the quality of generated samples and the stability of the training process. By utilizing the VAE-WACGAN model to oversample anomalous data, more realistic synthetic anomalies that closely mirror the actual network traffic distribution can be generated. This approach effectively balances the network traffic dataset and enhances the overall performance of the intrusion detection model. Experimental validation was conducted using two widely utilized intrusion detection datasets, UNSW-NB15 and CIC-IDS2017. The results demonstrate that the VAE-WACGAN method effectively enhances the performance metrics of the intrusion detection model. Furthermore, the VAE-WACGAN-based intrusion detection approach surpasses several other advanced methods, underscoring its effectiveness in tackling network security challenges.

AED: A Novel Approach for Intrusion Detection without Abnormal Samples in Big Data Environment

The rapid advance of multimedia devices, including sensors, cameras and mobile phones, has given rise to the prevalence of Internet of Multimedia Things (IoMT), generating huge volumes of application-oriented multimedia data. At the same time, network security issues in the multimedia big data environment also increases. Network intrusion detection (NID) system demonstrates its power in preventing cyber-attacks against multimedia platforms. However, the existing NID methods which are based on machine learning or deep learning classifiers may fail when there is a lack of abnormal traffic samples for training in the real-world scenario. We propose a novel approach for intrusion detection based on deep AutoEncoder and Differential comparison named AED, which only requires the normal traffic samples in the training phase. We conduct extensive experiments on two real-world datasets to evaluate the effectiveness of the proposed AED. The experimental results show that AED can outperform the baseline methods of three categories in terms of accuracy, precision, recall and F1-score.

An efficient intrusion detection system for IoT security using CNN decision forest.

The adoption and integration of the Internet of Things (IoT) have become essential for the advancement of many industries, unlocking purposeful connections between objects. However, the surge in IoT adoption and integration has also made it a prime target for malicious attacks. Consequently, ensuring the security of IoT systems and ecosystems has emerged as a crucial research area. Notably, advancements in addressing these security threats include the implementation of intrusion detection systems (IDS), garnering considerable attention within the research community. In this study, and in aim to enhance network anomaly detection, we present a novel intrusion detection approach: the Deep Neural Decision Forest-based IDS (DNDF-IDS). The DNDF-IDS incorporates an improved decision forest model coupled with neural networks to achieve heightened accuracy (ACC). Employing four distinct feature selection methods separately, namely principal component analysis (PCA), LASSO regression (LR), SelectKBest, and Random Forest Feature Importance (RFFI), our objective is to streamline training and prediction processes, enhance overall performance, and identify the most correlated features. Evaluation of our model on three diverse datasets (NSL-KDD, CICIDS2017, and UNSW-NB15) reveals impressive ACC values ranging from 94.09% to 98.84%, depending on the dataset and the feature selection method. Notably, our model achieves a remarkable prediction time of 0.1 ms per record. Comparative analyses with other recent random forest and Convolutional Neural Networks (CNN) based models indicate that our DNDF-IDS performs similarly or even outperforms them in certain instances, particularly when utilizing the top 10 features. One key advantage of our novel model lies in its ability to make accurate predictions with only a few features, showcasing an efficient utilization of computational resources.

Z-K-R: A Novel Framework in Intrusion Detection system through enhanced techniques

Abstract Intrusion detection systems (IDS) are an important tool for securing computer networks from various types of cyberattacks. The increasing complexity of network attacks demands more sophisticated approaches to intrusion detection. This paper presents an innovative method for IDS that involves combining Z-Score outlier detection, KMeans clustering, and Random Forest classification techniques. We tested our methodology using the CICIDS2017 dataset, which is a standardization dataset for intrusion detection that is frequently utilized. Our proposed approach first uses Z-Score outlier detection to identify abnormal traffic flows in the network. Next, KMeans clustering is used to group the traffic flows into different clusters based on their similarity. Finally, Random Forest classification is used to classify each traffic flow into normal or abnormal categories. Based on our experimental results, our approach for intrusion detection shows superior performance compared to several other state-of-the-art methods in terms of accuracy and precision. Our proposed method achieved an accuracy rate of 95.75% and a precision of 95.76%, surpassing the performance of KNN, SVM, and decision trees approaches. In conclusion, the proposed Z-K-R approach offers a promising solution for IDS by leveraging the strengths of Z-Score outlier detection, KMeans clustering, and Random Forest classification techniques. This strategy has the potential to increase the efficiency of IDS and boost network security in applications that take place in the real world.

Hybrid software defined network-based deep learning framework for enhancing internet of medical things cybersecurity

<p>The risk of cyber-attacks has increased significantly with the rapid development of the Internet of Medical Things (IoMT). The proliferation of IoMT devices in healthcare facilities has made conventional intrusion detection approaches challenging to employ. Our study proposes a novel hybrid framework leveraging Software Defined Network (SDN) controllers and deep learning techniques, specifically Convolutional Neural Networks (CNN) and Bidirectional Long-Term Memory (Bi-LSTM), to address these challenges. Our framework introduces a unique combination of SDN and deep learning, allowing for dynamic and efficient management of IoMT security. The integration of CNN and Bi-LSTM enables the system to handle diverse data types encountered in IoMT, offering a comprehensive approach to threat detection. Unlike traditional methods, our hybrid solution adapts seamlessly to the evolving threat landscape of healthcare IoT systems. The urgency of our research is affirmed by the critical need to fortify IoMT security amid escalating cyber threats. The conventional methods struggle to cope with the complex nature of IoMT networks, making our exploration of a hybrid SDN-based deep learning framework imperative. With a background in cybersecurity and a dedicated focus on healthcare IoT, we recognize the urgency to develop a solution that not only enhances detection accuracy but also ensures real-time responsiveness in healthcare settings. The proposed method has been validated using the “IoT-Healthcare security” dataset, revealing its efficacy in detecting numerous frequent threats and outperforming current state-of-the-art techniques in terms of high detection accuracy of 99.97% and less than 1.8 (s) in terms of speed efficiency.</p>

An intrusion detection method combining variational auto-encoder and generative adversarial networks

Deep learning is a crucial research area in network security, particularly when it comes to detecting network attacks. While some deep learning algorithms have shown promising results in distinguishing between normal and abnormal traffic, identifying different types of imbalanced anomalous traffic data is still a challenging task at present. To enhance the detection performance of unbalanced anomalous flows, we propose a new intrusion detection architecture based on a variational auto-encoder (VAE) and generative adversarial networks (GAN) in this research. Firstly, we present the VAE-WGAN model, which combines the advantages of VAE and GAN and enables us to generate data with predefined labels to balance the original training dataset. In the intrusion detection phase, we use a hybrid neural network model based on stacked Long Short-Term Memory (LSTM) and Multi-Scale Convolutional Neural Network (MSCNN). Stacked LSTM and MSCNN networks can extract network characteristics at different depths and scales, and subsequent feature fusion is used to increase network attack detection rates. Finally, the results from the NSL-KDD and AWID datasets indicate that the proposed network intrusion detection model improves the accuracy of network attack detection. The model outperforms other existing intrusion detection approaches in terms of accuracy, precision, recall, and f1-score, obtaining 83.45% accuracy and 83.69% f1-score on the NSL-KDD dataset. Moreover, it attains an accuracy and f1-score exceeding 98.9% on the AWID dataset.

A hybrid intrusion detection approach based on message queuing telemetry transport (MQTT) protocol in industrial internet of things

AbstractThe number of attacks against Industrial Internet of Things (IIoT) devices has increased over the past years, particularly on widely used communication protocols like Message Queuing Telemetry Transfer (MQTT). The fast increase in IIoT applications brings both critical challenges and technical gaps in cybersecurity. On the other hand, traditional cyber‐attack detection approaches scrap to address and support the run‐time responsibilities of IIoT environments. This study presents a hybrid Genetic Algorithm and Random Forest (GA_RF) method for detecting cyber‐attacks in Industrial Control Machines (ICS) that use MQTT protocol in the IIoT environment. This architecture integrates ICS with edge devices and cloud servers, using a GA_RF algorithm to detect anomalies in data collected by sensors. Normal data is processed locally and then sent to the cloud for storage and return, ensuring continuous monitoring and security. Also, the MQTT‐IOT‐IDS2020 dataset as a real test case was applied for prediction of the proposed GA_RF method with compare to some other powerful machine and deep learning models. The experimental results show that the proposed GA_RF method has an optimum accuracy of 99.87%–100% for detecting cyber‐attacks. This hybrid algorithm also achieved 0–0.0015 in Mean Absolute Error (MAE) and 100% in Precision, Recall, and F‐score factors. This result led to the proposed architecture, which connects the ICS to a server while running GA_RF on the IIoT environment. In conclusion, this study indicates the effectiveness of GA_RF and aims to improve security by using the MQTT protocol in IIoT.