Intrusion Detection Architecture Research Articles

An Accurate Ensemble Network with Optimal Architecture for Intrusion Detection Based on Features Representation and Data Augmentation

Cyber security means protecting Internet-connected systems, including hardware, software, and data, against digital threats. In order to increase cyber security, intrusion detection systems (IDS) based on deep models are accepted as the best methods in the literature. However, these methods often face data set limitations. The datasets used are often unbalanced and of insufficient size. In this research, in order to solve these challenges, a precise ensemble network with an optimal architecture for intrusion detection based on features representation and data augmentation has been presented. In the proposed framework, a pre-processing stage is designed to better represent the dataset's features in the recognition process. Also, in the proposed method, data augmentation techniques have been used in the ensemble network training process to solve the challenge of imbalance and inadequacy of the data set. Hyperparameters of the CNN-LSTM model have also been optimized to create an optimal architecture of the ensemble network. The simulation results on the NSLKDD data set show that the proposed intrusion detection system can classify the type of traffic in terms of normality and intrusion with 94% accuracy.

ImagTIDS: an internet of things intrusion detection framework utilizing GADF imaging encoding and improved Transformer

As the Internet of Things (IoT) technology becomes extensively deployed, IoT security issues are increasingly prominent. The traffic patterns of IoT are complex and high-dimensional, which makes it difficult to distinguish the tiny differences between normal and malicious samples. To tackle the above problems, we propose an IoT intrusion detection architecture based on Gramian angular difference fields (GADF) imaging technology and improved Transformer, named ImagTIDS. Firstly, we encode the network traffic data of IoT into images using GADF to preserve more robust temporal and global features, and then we propose a model named ImagTrans for extracting local and global features from network traffic images. ImagTIDS utilizes the self-attention mechanism to dynamically adjust the attention weights and adaptively focus on the important features, effectively suppressing the adverse effects of redundant features. Furthermore, due to the serious class imbalance problem in IoT intrusion detection, we utilize Focal Loss to dynamically scale the model gradient and adaptively reduce the weights of simple samples to focus on hard-to-classify classes. Finally, we validate the effectiveness of the proposed method on the publicly available IoT intrusion detection datasets ToN_IoT and DS2OS, and the experimental results show that the proposed method achieves superior detection performance and higher robustness on class imbalance datasets compared to other remarkable methods.

Unveiling anomalies: transformative insights from transformer-based autoencoder models

Nowadays, Intrusion Detection Systems (IDS) play a critical role in safeguarding networks by identifying and mitigating unauthorized access and malicious activities, yet face challenges in accurately detecting sophisticated threats while minimizing false positives. In this paper, we present a comprehensive analysis of a Transformer-based Autoencoder model for network intrusion detection using the NSL-KDD dataset. We evaluate the model's anomaly detection performance based on key metrics such as Mean Squared Error (MSE), Precision-Recall Area Under Curve (AUC), and Root Mean Squared Error (RMSE) on the test set. Our findings reveal promising results, with the model achieving low MSE, high AUC, and relatively low RMSE values, indicating its effectiveness in detecting anomalies. Additionally, we provide an in-depth examination of the model architecture, highlighting the role of encoder and decoder layers, dropout regularization, and optimization techniques such as Adam optimizer. Our analysis sheds light on the efficacy of Transformer-based Autoencoder models for network intrusion detection tasks, offering insights into their architectural design and performance evaluation. The novelty of this study lies in the implementation of a Transformer-based Autoencoder architecture for network intrusion detection, showcasing its superior performance in anomaly detection compared to traditional methods.

Multi-Agent Locally Trained Progressive Instance Selected Assisted Federated Learning Architecture for Intrusion Detection in Industrial-IoT

In this work the focus is made on designing and developing a robust federated learning model (FLM) and architecture for multi-type network intrusion detection system (MT-NIDS) for IIoT applications. Unlike traditional intrusion detection systems, where the key focus is made on detecting and classifying single type of intrusion or attack condition, this research targets to perform multi-type network intrusion detection. This as a result can contribute a fit-to-all NIDS solution for IIoT environment.

A convolutional autoencoder architecture for robust network intrusion detection in embedded systems

Security threats are becoming an increasingly relevant concern in cyber–physical systems. Cyber attacks on these systems are not only common today but also increasingly sophisticated and constantly evolving. One way to secure the system against such threats is by using intrusion detection systems (IDSs) to detect suspicious or abnormal activities characteristic of potential attacks. State-of-the-art IDSs exploit both signature-based and anomaly-based strategies to detect network threats. However, existing solutions mainly focus on the analysis of statically defined features of the traffic flow, making them potentially less effective against new attacks that cannot be properly captured by analyzing such features. This paper presents an anomaly-based IDS approach that leverages unsupervised neural models to learn the expected network traffic, enabling the detection of unknown novel attacks (as well as previously-known ones). The proposed solution uses an autoencoder to reconstruct the received packets and detect malicious packets based on the reconstruction error. A careful optimization of the model architecture allowed improving detection accuracy while reducing detection time. The proposed solution has been implemented on a real embedded platform, showing that it can support modern high-performance communication interfaces, while significantly outperforming existing approaches in both detection accuracy, inference time, generalization capability, and robustness to poisoning (which is commonly ignored by state-of-the-art IDSs). Finally, a novel mechanism has been developed to explain the detection performed by the proposed IDS through an analysis of the reconstruction error.

An intrusion detection method combining variational auto-encoder and generative adversarial networks

Deep learning is a crucial research area in network security, particularly when it comes to detecting network attacks. While some deep learning algorithms have shown promising results in distinguishing between normal and abnormal traffic, identifying different types of imbalanced anomalous traffic data is still a challenging task at present. To enhance the detection performance of unbalanced anomalous flows, we propose a new intrusion detection architecture based on a variational auto-encoder (VAE) and generative adversarial networks (GAN) in this research. Firstly, we present the VAE-WGAN model, which combines the advantages of VAE and GAN and enables us to generate data with predefined labels to balance the original training dataset. In the intrusion detection phase, we use a hybrid neural network model based on stacked Long Short-Term Memory (LSTM) and Multi-Scale Convolutional Neural Network (MSCNN). Stacked LSTM and MSCNN networks can extract network characteristics at different depths and scales, and subsequent feature fusion is used to increase network attack detection rates. Finally, the results from the NSL-KDD and AWID datasets indicate that the proposed network intrusion detection model improves the accuracy of network attack detection. The model outperforms other existing intrusion detection approaches in terms of accuracy, precision, recall, and f1-score, obtaining 83.45% accuracy and 83.69% f1-score on the NSL-KDD dataset. Moreover, it attains an accuracy and f1-score exceeding 98.9% on the AWID dataset.

A Blockchain-Reinforced Federated Intrusion Detection Architecture for IIoT

A Blockchain-Reinforced Federated Intrusion Detection Architecture for IIoT

A differential privacy aided DeepFed intrusion detection system for IoT applications

AbstractIn the rapidly‐developing Internet of Things (IoT) ecosystem, safeguarding the privacy and accuracy of linked devices and networks is of utmost importance, with the challenge lying in effective implementation of intrusion detection systems on resource‐constrained IoT devices. This study introduces a differential privacy (DP)‐aided DeepFed architecture for intrusion detection in IoT contexts as a novel approach to addressing these difficulties. To build an intrusion detection model, we combined components of a convolutional neural network with bidirectional long short‐term memory. We apply this approach to the Bot‐IoT dataset, which was rigorously curated by the University of New South Wales (UNSW) and N‐BaIoT dataset. Our major goal is to create a model that delivers high accuracy while protecting privacy, an often‐overlooked aspect of IoT security. Intrusion detection tasks are distributed across multiple IoT devices using federated learning principles to protect data privacy, incorporating the DP framework to gauge and minimize information leakage, all while investigating the intricate relationship between privacy and accuracy in pursuit of an ideal compromise. The trade‐off between privacy preservation and model accuracy is investigated by adjusting the privacy loss and noise multiplier. Our research enhances IoT security by introducing a deep learning model for intrusion detection in IoT devices, explores the integration of DP in federated learning framework for IoT and offers guidance on minimizing the accuracy‐privacy trade‐off based on specific privacy and security needs. Our study explores the privacy‐accuracy trade‐off by examining the effects of varying epsilon values on accuracy for various delta values for a range of clients between 5 and 25. We also investigate the influence of several noise multipliers on accuracy and find a consistent accuracy curve, especially around a noise multiplier value of about 0.5. The findings of this study have the possibilities to enhance IoT ecosystem security and privacy, contributing to the IoT landscape's trustworthiness and sustainability.

Hybrid deep architecture for intrusion detection in cyber‐physical system: An optimization‐based approach

SummaryIntrustion Detection System (IDS) refers to the gear or software that monitors a network or system for malicious activity or policy violations. Periodically, the system records any intrusion action or breach, which frequently modifies the administrator. Cyber Physical System (CPS) is particularly called as networked connected system, in which the system components are spatially distributed and integrated via the communication network. The control mechanism ensures computation significance; however, the system does affect attacks. Researchers are trying to handle this issue via the existing anomaly datasets. In this way, this paper follows an intrusion detection system under three major stages including extraction of features, selection of feature, and detection. The primary stage is the extraction of Statistical features like standard deviation, mean, mode, variance, and median, as well as higher‐order statistical features like moment, percentile, improved correlation, kurtosis, mutual information, skewness, flow‐based features, and information gain‐based features. The curse of dimensionality becomes a significant problem in this scenario, so it is crucial to choose the right features. Improved Linear Discriminant Analysis (LDA) is utilized to choose the right features. The selected features are subjected to a Hybrid classifier for final detection. Here, models like CNN (Convolutional Neural Network) and Bi‐GRU (Bidirectional Gated Recurrent Unit) are combined. A new Bernoulli Map Estimated Arithmetic Optimization Algorithm (BMEAOA) is added to train the system by adjusting the ideal weights of the two classifiers, leading to improved detection outcomes. Ultimately, the effectiveness is assessed in comparison to the other traditional techniques.

Enhancing Industrial IoT Security: Utilizing Blockchain-Assisted Deep Federated Learning for Collaborative Intrusion Detection

The Industrial Internet of Things (IIoT) is a rapidly evolving features with multiple applications, including critical infrastructure. Privacy policies are required to preserve the protection of user data in the threat intelligence community. Blockchain is a modern technology which used recently to provide more secure storage and efficiency. In this research, Blockchain Assisted Deep Federated Learning (BC_DFL) system is used to detect intruders. The three key processes used in the proposed intrusion detection architecture are data collection, pre-processing and intrusion detection. Data normalization, reduction, cleaning and transformation are used in pre-processing to remove extraneous information and improve data quality. This pre-processed data is sent to the Blockchain Assisted Deep Federated Learning (BC_DFL) system for intrusion detection. To detect intruders, the federated learning-based Capsule Auto-Encoder (FL_CAE) architecture first learns the properties from the inputs. Blockchain technology (BCTech) is not only used for storage but also improves security by eliminating the possibility of threatening node and individual server failure. The ToN_IoT and UNSW-NB15 data sets are used in the implementation and performance evaluation study. The proposed model is evaluated using existing in the Results section. In the UNSW-NB15 dataset, proposed model achieved an accuracy, precision, recall and F1 score of 97.26%, 97.28%, 96.89% and 96.96% respectively as well as in ToN_IoT data set proposed model achieved an accuracy, precision, recall and F1 score of 95.74%, 99.54 %, 99.49% and 99.24%, respectively. The execution of the proposed approach takes 2.31 seconds in the UNSW-NB15 dataset and 1.66 seconds in the ToN_IoT dataset. Blockchain offers a transparent and impenetrable ledger for transaction recording and verification. Within the framework of cooperative intrusion detection, it guarantees a secure and reliable exchange of threat intelligence and detection models between various users of IIoT ecosystem.

WIRELESS LAN DESIGN AND FUTURE INTERNET ARCHITECTURE

In this research thesis, an advance work is being done on the Wireless Local Area Network (WLAN) design and future internet architecture for intrusion detection. There has been a large shift worldwide in using technology in almost every aspect of our lives. This trend has been termed in many industries as the "Internet of Things" (IoT), where the Internet and cloud- based activities are seeing more and more use for control, monitoring and data storage applications. As stated earlier, these assumptions were made because of the extreme difficulty in obtaining any related telemetry from an actual WLAN system or business-critical network. To improve the validity of the simulation, it would be beneficial to obtain even sanitized telemetry from an actual system. Then, the simulation could be refined to better reflect the dynamics of the signals in a real system. If actual WLAN system data is unobtainable, then the test by itself can be modified to reflect more processes seen in these systems. First, a small flow loop with sensing and control elements could be constructed and driven by the servers of the test bed. The primary server in the test bed that acts as the WLAN server could then be programmed to poll the sensors, issue commands and collect data. Time synchronous averaging techniques are used to resample telemetry sources that have different sampling rates. The research provides several case studies to prove the efficacy of the newly developed variable grouping technique for WLAN. Recall that variable grouping methods are needed to extract sets or subsets of variables that give the lowest model prediction errors. The research also presents AAKR and AAMSET model results for several successfully detected intrusion activities from two different data sets. The models utilized four different clusters of telemetry taken from the Linux kernel to determine which class of telemetry was more effective for intrusion detection. The knowledge-based system is certainly the most numerous and widely used type that uses signatures or features of known wireless network attacks for detection purposes. While this type is easy to implement and has a low rate of false/missed alarms, it will always miss the so-called zero-day wireless network attacks. Recall that a zero-day wireless network attack is a new, unknown intrusion. Because the knowledge-based system has never seen a zero-day intrusion event, it will classify this new behavior as normal. In contrast, the behavior-based system can detect known and zero-day wireless network attacks with an accuracy of 97.86% correctly. This type uses data-driven modeling techniques to learn normal system behavior. Once trained, any future monitored telemetry that deviates from this learned behavior will be labeled as an intrusion event.

Spark-MLlib intrusion detection mechanism using machine learning models

<p align="justify"><span>Typically, a single method is employed in machine learning (ML) based intrusion detection to identify intrusion information. However, this approach lacks flexibility, has a low detection rate, and struggles to handle high-dimensional data. Consequently, it is not efficient in addressing these challenges. This study proposes a new intrusion detection architecture that utilizes Spark and ensures resilient data dissemination across the platform to improve its effectiveness. It consists of preprocessing module, a label encoder module, a feature extraction module, a classification module and a database module. The preprocessing module compresses information by utilizing the module for label encoding. This generates a lower-dimensional reconstruction and classification characteristic. The database module has the capability to store the compressed characteristics of all traffic. This enables the classifier to be tested and then returns these features back into the original traffic, facilitating retraining. In order to evaluate the efficacy of the framework, simulations were conducted using the CICIDS 2017 dataset to accurately replicate the network traffic. Based on the test findings, the accuracy of both multiclass and binary classification surpasses that of earlier studies. High precision was achieved for the traffic that was restored. The possible application of the proposed architecture for edge/fog networks is discussed in the conclusion.</span></p>

Improved Transformer-Based Privacy-Preserving Architecture for Intrusion Detection in Secure V2X Communications

Improved Transformer-Based Privacy-Preserving Architecture for Intrusion Detection in Secure V2X Communications

Hybrid evolutionary machine learning model for advanced intrusion detection architecture for cyber threat identification.

In response to the rapidly evolving threat landscape in network security, this paper proposes an Evolutionary Machine Learning Algorithm designed for robust intrusion detection. We specifically address challenges such as adaptability to new threats and scalability across diverse network environments. Our approach is validated using two distinct datasets: BoT-IoT, reflecting a range of IoT-specific attacks, and UNSW-NB15, offering a broader context of network intrusion scenarios using GA based hybrid DT-SVM. This selection facilitates a comprehensive evaluation of the algorithm's effectiveness across varying attack vectors. Performance metrics including accuracy, recall, and false positive rates are meticulously chosen to demonstrate the algorithm's capability to accurately identify and adapt to both known and novel threats, thereby substantiating the algorithm's potential as a scalable and adaptable security solution. This study aims to advance the development of intrusion detection systems that are not only reactive but also preemptively adaptive to emerging cyber threats." During the feature selection step, a GA is used to discover and preserve the most relevant characteristics from the dataset by using evolutionary principles. Through the use of this technology based on genetic algorithms, the subset of features is optimised, enabling the subsequent classification model to focus on the most relevant components of network data. In order to accomplish this, DT-SVM classification and GA-driven feature selection are integrated in an effort to strike a balance between efficiency and accuracy. The system has been purposefully designed to efficiently handle data streams in real-time, ensuring that intrusions are promptly and precisely detected. The empirical results corroborate the study's assertion that the IDS outperforms traditional methodologies.

PRISM: A Hierarchical Intrusion Detection Architecture for Large-Scale Cyber Networks

The increase in scale of cyber networks and the rise in sophistication of cyber-attacks have introduced several challenges in intrusion detection. The primary challenge is the requirement to detect complex multi-stage attacks in realtime by processing the immense amount of traffic produced by present-day networks. In this paper we present PRISM, a hierarchical intrusion detection architecture that uses a novel attacker behavior model-based sampling technique to minimize the realtime traffic processing overhead. PRISM has a unique multi-layered architecture that monitors network traffic distributedly to provide efficiency in processing and modularity in design. PRISM employs a Hidden Markov Model-based prediction mechanism to identify multi-stage attacks and ascertain the attack progression for a proactive response. Furthermore, PRISM introduces a stream management procedure that rectifies the issue of alert reordering when collected from distributed alert reporting systems. To evaluate the performance of PRISM, multiple metrics have been proposed, and various experiments have been conducted on a multi-stage attack dataset. The results exhibit up to 7.5x improvement in processing overhead as compared to a standard centralized IDS without the loss of prediction accuracy while demonstrating the ability to predict different attack stages promptly.

A cognitive security framework for detecting intrusions in IoT and 5G utilizing deep learning

The fast growth of Internet of Things (IoT) gadgets and 5G networks has increased linkage and accessibility. However, growing interconnectivity poses new threat levels in these environments, making intrusion detection critical. In this article, we introduce a novel security framework that centres on deep learning and is tailored to support the particular risks posed by IoT channels and 5G networks. Deep neural networks are used in our proposed framework to effectively analyze network activity patterns and recognize any possible breaches in real-time communication. Deep learning autonomously learns complicated features and patterns, facilitating the proposed model's adaptability to changing threat vectors and traffic features. This research proposed a Hybrid model using enhanced light-weight CNNs architecture (MobileNetV3-SVM) and Transfer learning (TL) for intrusion detection in 5G communication. The proposed model utilizes the advantages of a multi-layered structure, which enables it to acquire knowledge from raw network information hierarchically. It provides the ability to distinguish between authentic and malicious behaviour efficiently. We have implemented several cutting-edge strategies to maximize the effectiveness of intrusion detection in environments characterized by limited availability of resources, such as those associated with the IoT and high-speed 5G networks. The proposed hybrid model processes network packets in real-time using light-weight MobileNet, reducing the computational overhead and making it suitable for IoT and 5G edge devices. In the proposed model, a MobileNetV3-SVM auto-classifies the network's intrusion images, enhancing the overall accuracy. In addition, to address the issue of limited labelled data in dynamic and constantly changing systems, we use a transfer learning strategy to deal with this issue. The proposed hybrid model and existing CNN- architectures, i.e., VGG-16, VGG-19, Efficient-Net and Inception-Net, are tested on CICIDS-2017, 2018 and UNSW-NB15 IoT 5G security datasets. During the experimental assessment, we demonstrated the strength of the proposed model by simulating a wide range of network settings and intrusion scenarios. Experimental findings show considerable improvements by the proposed hybrid model in accuracy, precision, false positive rates, Matthew's Correlation Coefficient (MCC) and AUC-ROC over existing approaches.

Hybrid VGG19 and 2D-CNN for intrusion detection in the FOG-cloud environment

Fog computing (FC) extends cloud technology by providing services, storage, and network interaction between data centers and end devices. By putting storage and processing closer to the network edge, fog computing may improve IDS effectiveness and efficiency. We develop a cloud-fog intrusion detection system (CFIDS) that employs cloud and fog resources to identify threats in the current research. However, the attack affects data packets from Fog layer nodes. The majority of intrusive cyber-attacks are close variants of previously identified cyber attacks with duplicate data and attributes. In addition, the data packet must be analyzed to determine the intrusion. SYN packets, used to initiate TCP connections, flood a victim's network in a syn threat. To mitigate the impact of syn attacks in a FC environment, it is essential to implement the necessary security measures. Deep learning-based IDS are suitable for protecting fog computing layers from attacks and addressing current issues. The authors of this paper have put forth a new hybrid architecture for DL intrusion detection in fog computing, which combines the use of DL models. Due to the large dimensionality of network data, Radial basis function-based support vector regression (RBFSVR)is initially used to minimize the dimensionality of the data and reduce the training time. Then, on the cloud server, the integrated VGG19 and 2DCNN are utilized to complete the dataset's training and transfer it to the fog layer, where data transmission is observed and threats are recognized. Experiments with the UNSW-NB15, CICIDS2017, and CICIDS2018 datasets demonstrate that the techniques presented in this paper outperforms other comparable techniques in terms of detection rate, F-score, precision, recall, FAR, and accuracy, thereby solving the problem of intrusion detection. In addition, by analyzing irregular patterns of network traffic, flow duration isutilized to avoid harmful attacks in a fog computing environment.

Novel Approach to Intrusion Detection: Introducing GAN-MSCNN-BILSTM with LIME Predictions

This paper introduces an innovative intrusion detection system that harnesses Generative Adversarial Networks (GANs), Multi-Scale Convolutional Neural Networks (MSCNNs), and Bidirectional Long Short-Term Memory (BiLSTM) networks, supplemented by Local Interpretable Model-Agnostic Explanations (LIME) for interpretability. Employing a GAN, the system generates realistic network traffic data, encompassing both normal and attack patterns. This synthesized data is then fed into an MSCNN-BiLSTM architecture for intrusion detection. The MSCNN layer extracts features from the network traffic data at different scales, while the BiLSTM layer captures temporal dependencies within the traffic sequences. Integration of LIME allows for explaining the model's decisions. Evaluation on the Hogzilla dataset, a standard benchmark, showcases an impressive accuracy of 99,16 % for multi-class classification and 99,10 % for binary classification, while ensuring interpretability through LIME. This fusion of deep learning and interpretability presents a promising avenue for enhancing intrusion detection systems by improving transparency and decision support in network security

A Novel Architecture for Network Intrusion Detection and Prevention

This paper affords an investigation, regarding experiments, which suggests that modern-day network intrusion, detection, and prevention systems (NIDPSs) have numerous shortcomings in detecting or stopping growing undesirable traffic and feature numerous threats in high-pace environments. It suggests that the NIDPS overall performance may be vulnerable withinside the face of high-pace and high-load malicious traffic in phrases of packet drops, high-quality packets without analysis, and failing to detect/save you undesirable traffic. A novel exceptional of service (QoS) structure has been designed to growth the intrusion detection and prevention overall performance. Our studies have proposed and evaluated an answer the usage of a unique QoS configuration in a multi-layer transfer to arrange packets/ traffic and parallel strategies to growth the packet processing pace. The new structure turned into examined below extraordinary traffic speeds, types, and tasks. The experimental consequences display that the structure improves the community and protection overall performance that is can cowl up to eight Gb/s with zero packets dropped. This paper additionally suggests that this number (8Gb/s) may be improved, however it relies upon at the gadget ability that is constantly limited. Keywords: Security, intrusion, prevention, Dynamic Anomaly, Network Attacks, Computer security, computer networks,

Intrusion Detection in Big Data Era: A Multi- Objective Approach for Longer Model Lifespans

Despite highly accurate intrusion detection schemes based on machine learning (ML) reported in the literature, changes in network traffic behaviour quickly yield low accuracy rates. An intrusion detection model update is not easily feasible due to the enormous amount of network traffic to be processed in near real-time for high- speed networks, in particular, under big data settings. In this paper, we propose a new scalable long-lasting intrusion detection architecture for the processing of network content and the building of a reliable ML-based intrusion detection model. Experiments performed through the analysis of five years of network traffic, about 20 TB of data, have shown that our approach extends the lifespan of our model by up to six weeks. That occurs because the average accuracy rate of our proposal lasted eight weeks after the training phase, and traditional ones reached only two weeks after the model building. Additionally, our proposal achieves up to 10 Gbps of detection throughput in a 20-core big data processing cluster. KEYWORDS: Machine Learning, Intrusion Detection, Big Data, High-Speed Networks.