Building Intrusion Detection Systems Research Articles

Federated learning-based intrusion detection system for the internet of things using unsupervised and supervised deep learning models

The adoption of the Internet of Things (IoT) in our technology-driven society is hindered by security and data privacy challenges. To address these issues, Artificial Intelligence (AI) techniques such as Machine Learning (ML) and Deep Learning (DL) can be applied to build Intrusion Detection Systems (IDS) that help securing IoT networks. Federated Learning (FL) is a decentralized approach that can enhance performance and privacy of the data by training IDS on individual connected devices. This study proposes the use of unsupervised and supervised DL models trained via FL to develop IDS for IoT devices. The performance of FL-trained models is compared to models trained via non-FL using the N-BaIoT dataset of nine IoT devices. To improve the accuracy of DL models, a randomized search hyperparameter optimization is performed. Various performance metrics are used to evaluate the prediction results. The results indicate that the unsupervised AutoEncoder (AE) model trained via FL is the best overall in terms of all metrics, based on testing both FL and non-FL trained models on all nine IoT devices.

A methodology for evaluating the effectiveness of intrusion detection system based on federated learning

The article investigates the problem of applying federated learning for building intrusion detection systems. Federated learning is a way of organizing distributed learning, in which data are not transferred to a single cloud storage, and the training of models is performed locally, the formation of a common global model is performed based on the parameters of local models. The article proposes a methodology for evaluating the performance of federated trained models, including the evaluation of the training throughput. The training throughput depends on the federated learning settings, the computational resources of the interacting devices and the network bandwidth, and obviously, the use of federated learning can significantly affect the performance of the device itself. This article presents a description of the experimental setup, and the results of a series of experiments that characterize the federated learning process with different settings.

An improved long short term memory network for intrusion detection.

Over the years, intrusion detection system has played a crucial role in network security by discovering attacks from network traffics and generating an alarm signal to be sent to the security team. Machine learning methods, e.g., Support Vector Machine, K Nearest Neighbour, have been used in building intrusion detection systems but such systems still suffer from low accuracy and high false alarm rate. Deep learning models (e.g., Long Short-Term Memory, LSTM) have been employed in designing intrusion detection systems to address this issue. However, LSTM needs a high number of iterations to achieve high performance. In this paper, a novel, and improved version of the Long Short-Term Memory (ILSTM) algorithm was proposed. The ILSTM is based on the novel integration of the chaotic butterfly optimization algorithm (CBOA) and particle swarm optimization (PSO) to improve the accuracy of the LSTM algorithm. The ILSTM was then used to build an efficient intrusion detection system for binary and multi-class classification cases. The proposed algorithm has two phases: phase one involves training a conventional LSTM network to get initial weights, and phase two involves using the hybrid swarm algorithms, CBOA and PSO, to optimize the weights of LSTM to improve the accuracy. The performance of ILSTM and the intrusion detection system were evaluated using two public datasets (NSL-KDD dataset and LITNET-2020) under nine performance metrics. The results showed that the proposed ILSTM algorithm outperformed the original LSTM and other related deep-learning algorithms regarding accuracy and precision. The ILSTM achieved an accuracy of 93.09% and a precision of 96.86% while LSTM gave an accuracy of 82.74% and a precision of 76.49%. Also, the ILSTM performed better than LSTM in both datasets. In addition, the statistical analysis showed that ILSTM is more statistically significant than LSTM. Further, the proposed ISTLM gave better results of multiclassification of intrusion types such as DoS, Prob, and U2R attacks.

Toward Improved Machine Learning-Based Intrusion Detection for Internet of Things Traffic

The rapid development of Internet of Things (IoT) networks has revealed multiple security issues. On the other hand, machine learning (ML) has proven its efficiency in building intrusion detection systems (IDSs) intended to reinforce the security of IoT networks. In fact, the successful design and implementation of such techniques require the use of effective methods in terms of data and model quality. This paper encloses an empirical impact analysis for the latter in the context of a multi-class classification scenario. A series of experiments were conducted using six ML models, along with four benchmarking datasets, including UNSW-NB15, BOT-IoT, ToN-IoT, and Edge-IIoT. The proposed framework investigates the marginal benefit of employing data pre-processing and model configurations considering IoT limitations. In fact, the empirical findings indicate that the accuracy of ML-based IDS detection rapidly increases when methods that use quality data and models are deployed. Specifically, data cleaning, transformation, normalization, and dimensionality reduction, along with model parameter tuning, exhibit significant potential to minimize computational complexity and yield better performance. In addition, MLP- and clustering-based algorithms outperformed the remaining models, and the obtained accuracy reached up to 99.97%. One should note that the performance of the challenger models was assessed using similar test sets, and this was compared to the results achieved using the relevant pieces of research.

A new intrusion detection system based on using non-linear statistical analysis and features selection techniques

The increase in the number of connected devices to the Internet and Internet of Things (IoT) development accompanied a massive increase in the number and types of attacks. Most IoT devices have security vulnerabilities due to their limited computing and storage capabilities and specific protocols. Thus, there is essential to build Intrusion Detection Systems (IDSs) that can detect these threats that affect smart applications. Researchers examined different data mining techniques, statistical analysis techniques, and machine learning (ML) algorithms. In this paper, we propose a novel approach for building an anomaly-based intrusion detection system based on using a non-linear statistical analysis technique called recurrence quantification analysis (RQA). Our approach uses RQA to identify abnormal behavior in an individual feature extracted from a series of packets rather than inspecting the packet's payload. The proposed procedure implies finding the minimum number of features, applying the RQA technique to each effective feature separately, and applying different ML algorithms to classify the RQA measurements resulting from each effective feature. The system's performance was evaluated based on the accuracy and F-score using the UNSW-NB15 dataset. Results show our proposed approach's effectiveness in discovering hidden characteristics in the underlying series of an individual feature that leads to identifying different attacks. Besides, the proposed approach outperforms most previous works using one feature.

A Deep Learning Ensemble Approach to Detecting Unknown Network Attacks

The majority of the intrusion detection solutions proposed using machine learning and deep learning approaches are based on known attack classes only. Comprehensive threat detection systems should consider both known and unknown attacks. Rapidly changing network environment and the advanced tools and techniques used by adversaries to launch new sophisticated attacks highlight a growing need to build intrusion detection systems that are more realistic, diverse, and robust to detect known and unknown attacks. We employed deep-learning models in our experiments to detect unknown threats, never introduced before to the model. This paper also studied the bias issues in connection with unknown threats detection. Many recent research studies based on conventional machine learning may report biased results and restricted training due to relying only on a single dataset; thus, there are existing threats that the model is unaware of, although the model may have high accuracy (in the known territories). This study presents a realistic IDS approach in which a deep learning classifiers' ensemble is trained on four benchmark IDS datasets for testing the unknown attack instances. Specifically, the model has no prior knowledge of some labels and traffic patterns in those experiments. The architecture proposed builds a deep learning ensemble using classifiers well-known to process and produce good results for sequential data. Our empirical results indicate that the proposed ensemble model can detect a range of unknown attacks with reasonable performance measures and a practical approach towards building a comprehensive IDS solution.

Network intrusion detection system: machine learning approach

The main goal of intrusion detection system (IDS) is to monitor the network performance and to investigate any signs of any abnormalities over the network. Recently, intrusion detection systems employ machine learning techniques, due to the fact that machine learning techniques proved to have the ability of learning and adapting in addition to allowing a prompt response. This work proposes a model for intrusion detection and classification using machine learning techniques. The model first acquires the data set and transforms it in the proper format, then performs feature selection to pick out a subset of attributes that worth being considered. After that, the refined data set was processed by the Konstanz information miner (KNIME). To gain better performance and a decent comparative analysis, three different classifiers were applied. The anticipated classifiers have been executed and assessed utilizing the KNIME analytics platform using (CICIDS2017) datasets. The experimental results showed an accuracy rate ranging between (98.6) as the highest obtained while the average was (90.59%), which was satisfying compared to other approaches. The gained statistics of this research inspires the researchers of this field to use machine learning in cyber security and data analysis and build intrusion detection systems with higher accuracy.

Метрические характеристики обнаружения аномального трафика в сетях интернета вещей

The urgent problem of timely detection of abnormal traffic in the Internet of Things networks, which wastes the energy of sensor devices, is discussed. Anomalous traffic means traffic that contains malicious software that implements an attacking effect on the nodes of the Internet of Things. Timely detection of abnormal traffic contributes to the preservation of the service life and, accordingly, the performance of the services provided by the Internet of Things. The subject of this research is the application of metric characteristics to detect abnormal traffic in the Internet of Things networks. The aim of the work is to propose a system of metrics that allow registering signatures of individual sensor devices or patterns of their behavior and assessing the mode of operation of individual network segments. Since the Internet of Things is built on a hierarchical basis - from a wireless sensor network to a global network, the attack detection system covers all levels - from a sensor device to a global cloud. Detection of abnormal traffic both in the wireless sensor network and at the level of wired networks - local and global - is implemented using metrics. A metric is a qualitative or quantitative indicator that reflects one or another characteristic of the functioning of an infocommunication network. Analysis of the sources showed the lack of systematization of metric characteristics for the Internet of Things networks. Research findings include: a description of the elements that make up the IoT ecosystem; layered model of the architecture of the Internet of things; an abnormal traffic detection metrics system containing a wide range of predictive, diagnostic and retrospective metrics. The proposed system of metrics can be used to build intrusion detection systems in IoT networks.

Models versus Datasets: Reducing Bias through Building a Comprehensive IDS Benchmark

Today, deep learning approaches are widely used to build Intrusion Detection Systems for securing IoT environments. However, the models’ hidden and complex nature raises various concerns, such as trusting the model output and understanding why the model made certain decisions. Researchers generally publish their proposed model’s settings and performance results based on a specific dataset and a classification model but do not report the proposed model’s output and findings. Similarly, many researchers suggest an IDS solution by focusing only on a single benchmark dataset and classifier. Such solutions are prone to generating inaccurate and biased results. This paper overcomes these limitations in previous work by analyzing various benchmark datasets and various individual and hybrid deep learning classifiers towards finding the best IDS solution for IoT that is efficient, lightweight, and comprehensive in detecting network anomalies. We also showed the model’s localized predictions and analyzed the top contributing features impacting the global performance of deep learning models. This paper aims to extract the aggregate knowledge from various datasets and classifiers and analyze the commonalities to avoid any possible bias in results and increase the trust and transparency of deep learning models. We believe this paper’s findings will help future researchers build a comprehensive IDS based on well-performing classifiers and utilize the aggregated knowledge and the minimum set of significantly contributing features.

A new approach to combine multiplex networks and time series attributes: Building intrusion detection systems (IDS) in cybersecurity

• A new computationally and temporally efficient methodology to represent the relationships between assets through a multiplexed network whose edges include temporal attributes. • A combination of two mathematical domains (signal processing and complex networks) increases the accuracy of each of them separately. • An application of a new methodology in the cybersecurity domain provides promising results with a more computationally efficient effort. Intrusion Detection Systems (IDS) are fundamental tools in cybersecurity environments. In this paper, we present a new methodology for the creation of intrusion detection systems (IDS) based on a strategy that combines the use of multiplex networks and time series analysis to provide a probability that an IP address be an attacker in a certain time. This approach reduces the number of alerts to a small number of IP addresses as well as the computation effort by not having to analyze each event independently. The evaluation of all traffic happens only at pre-defined times. The methodology relies on both the original utilization of some unsupervised machine learning techniques and on the use of certain time series attributes and their representation as a complex multiplex network, achieving a very significant reduction in the dimensionality of the resulting data representation. The result is a very effective intrusion detection system in large corporate environments and a new approach in the representation of the analyzed data as shown in the real case presented.

Building a Fuzzy Classifier Based on Whale Optimization Algorithm to Detect Network Intrusions

The quantity of network attacks and the harm from them is constantly increasing, so the detection of these attacks is an urgent task in the information security field. In this paper, we investigate an approach to building intrusion detection systems using a classifier based on fuzzy rules. The process of creating a fuzzy classifier based on a given set of input and output data can be presented as a solution to the problems of clustering, informative features selection, and the parameters of the rule antecedents optimization. To solve these problems, the whale optimization algorithm is used. The performance of algorithms for constructing a fuzzy classifier based on this metaheuristic is estimated using the KDD Cup 1999 intrusion detection dataset. On average, the resulting classifiers have a type I error of 0.92% and a type II error of 1.07%. The obtained results are also compared with the results of other classifiers. The comparison shows the competitiveness of the proposed method.

ARTINALI++: Multi-dimensional Specification Mining for Complex Cyber-Physical System Security

Cyber-Physical Systems (CPSes) have been investigated as a key area of research since they are the core of Internet of Things. CPSs integrate computing and communication with control and monitoring of entities in the physical world. Due to the tight coupling of cyber and physical domains, and to the possible catastrophic consequences of the malicious attacks on critical infrastructures, security is one of the key concerns. However, the exponential growth of IoT has led to deployment of CPSes without support for enforcing important security properties. Specification-based Intrusion Detection Systems (IDS) have been shown to be effective for securing these systems. Mining the specifications of CPSes by experts is a cumbersome and error-prone task. Therefore, it is essential to dynamically monitor the CPS to learn its common behaviors and formulate specifications for detecting malicious bugs and security attacks. Existing solutions for specification mining only combine data and events, but not time. However, time is a semantic property in CPS systems, and hence incorporating time in addition to data and events, is essential for obtaining high accuracy.This paper proposes ARTINALI++, which dynamically mines specifications in CPS systems with arbitrary size and complexity. ARTINALI++ captures the security properties by incorporating time as a substantial property of the system, and generate a multi-dimensional model for the general CPS systems. Moreover, it enhances the model through discovering invariants that represent the physical motions and distinct operational modes in complex CPS systems. We build Intrusion Detection Systems based on ARTINALI++ for three CPSes with various levels of complexity including smart meter, smart artificial pancreas and unmanned aerial vehicle, and measure their detection accuracy. We find that the ARTINALI++ significantly reduces the ratio of false positives and false negatives by 23.45% and 73.6% on average, respectively, over other dynamic specification mining tools on the three CPS platforms.

WITHDRAWN: Kulczynski indexed dragonfly feature optimization based Polytomous Adaptive Base classifier for anomaly intrusion detection

Abstract Anomaly-based intrusion detection plays a major role in the rapid growth of network technology to monitor the network activity and to protect from attacks. Recently, the machine learning techniques have been applied to build intrusion detection systems (IDS) for anomaly detection. Most of the works failed to find different types of attacks with minimum computation time. Kulczynski Similarity Indexed Dragonfly Optimization based Polytomous Adaptive Base Class Ensemble (KSIDO-PABCE) is introduced for anomaly intrusion detection in WSN to provide higher accuracy and lesser time consumption. KSIDO-PABCE technique comprised feature selection and classification. The feature selection is carried out using KSIDO. The designed optimization is a meta heuristic technique to determine the optimally better solution in search space depending on the behaviour of seeking the food source. The optimization technique generates the initial population of dragonflies (i.e. features) in search space. After initialization process, fitness of each dragonfly is determined by Kulczynski similarity index. Depending on fitness evaluation, the optimal features are chosen. With selected optimal features, PABCE technique is used to find different types of attacks. The ensemble classifier employs the weak learners as Support Vector Machine (SVM) for recognizing the suspicious activities to categorize data into normal or anomalous. After finding the anomalous, different types of attacks are correctly identified. Experimental evaluation with discussed results proves that the KSIDO-PABCE technique is more efficient compared to the existing state-of-art approaches.

Improved feature selection method for features reduction in intrusion detection systems

Many methods have been used to build intrusion detection system based on the intended aim to be achieved in with the selected method. The hybrid methods (more than one method) usually gives better results and accuracy. The recent developments and popularization of network & information technologies have necessitated the need for network information security. Human-based smart intrusion detection systems (IDSs) are built with the capability to either warn or intercept network intrusion; this is not possible with the conventional network security systems. However, most information security studies have focused on improvement of the effectiveness of smart network IDSs. This study used TLBO algorithm as a feature selection algorithm to choose the best subset features and SVM classifier to classify the packet if it is intrusion or normal packet, two machine learning datasets used to test the proposed algorithm, the results show that the proposed algorithm perform better than many of the existing work in IDS.

Binary Classification of Network-Generated Flow Data Using a Machine Learning Algorithm

This study proposes a model for building intrusion detection systems. The dataset used, CICIDS 2017, contains 14 different attacks with 85 features for each attack. This high dimensionality of the data is a major challenge when building efficient intrusion detection systems, especially in today's big data environment, since a lot of the features are redundant. The main goal in this paper was to reduce the number of features and present a detailed discussion of the important features. For feature selection, information gain was used in an iterative way, and for classification, a machine learning algorithm, the J48 decision tree algorithm, was used. The important features for the classification of each attack were identified, and the features that were important for classifying multiple attacks were also identified and discussed.

Utilising Deep Learning Techniques for Effective Zero-Day Attack Detection

Machine Learning (ML) and Deep Learning (DL) have been used for building Intrusion Detection Systems (IDS). The increase in both the number and sheer variety of new cyber-attacks poses a tremendous challenge for IDS solutions that rely on a database of historical attack signatures. Therefore, the industrial pull for robust IDSs that are capable of flagging zero-day attacks is growing. Current outlier-based zero-day detection research suffers from high false-negative rates, thus limiting their practical use and performance. This paper proposes an autoencoder implementation for detecting zero-day attacks. The aim is to build an IDS model with high recall while keeping the miss rate (false-negatives) to an acceptable minimum. Two well-known IDS datasets are used for evaluation—CICIDS2017 and NSL-KDD. In order to demonstrate the efficacy of our model, we compare its results against a One-Class Support Vector Machine (SVM). The manuscript highlights the performance of a One-Class SVM when zero-day attacks are distinctive from normal behaviour. The proposed model benefits greatly from autoencoders encoding-decoding capabilities. The results show that autoencoders are well-suited at detecting complex zero-day attacks. The results demonstrate a zero-day detection accuracy of 89–99% for the NSL-KDD dataset and 75–98% for the CICIDS2017 dataset. Finally, the paper outlines the observed trade-off between recall and fallout.

OPTIMIZATION ALGORITHMS FOR INTRUSION DETECTION SYSTEM: A REVIEW

With the growth and development of the Internet, the devices and the hosts connected to the Internet have become the target for attackers and intruders. Consequently, the integrity of systems and data has become more sophisticated. Meanwhile, many institutions suffer from money-losing or other losses due to attacks on computer systems. Accordingly, the detection of intrusion and attacks has become a challenge and a vital necessity at the same time. Many different methods were used to build intrusion detection systems (IDSs), and all these methods seek to a plus the efficiency of intrusion detection systems. This paper is a survey which tries to covers some of the optimization algorithms used in the field of intrusion detection in past ten years such as Artificial Bee Colony (ABC), Genetic Algorithm (GA), Cuttlefish Algorithms (CFA), and Particle Swarm Optimization (PSO). It is hoped that this review will provide useful insights about the intrusion detection literature and is a good source for anyone interested in applying one of the used optimization algorithms in the field of intrusion detection.

Fuzzy Generalized Hebbian Algorithm for Large-Scale Intrusion Detection System

The huge number of irrelevant and redundant data used in building intrusion detection systems (IDS) is one of the common issues in network intrusion detection systems. This paper proposed the use of Fuzzy Generalized Hebbian Algorithm as a novel data reduction method to overcome this problem of data redundancy in IDS. Two methods for dimensionality reduction (GHA and Fuzzy GHA) were used and compared in this study. This allowed retaining the most relevant traffic data information from the network. Furthermore, the K Nearest Neighbor algorithm was applied for the classification of the test connections into 2 categories (attack or normal). The investigations were carried out on the KDDCUP ‘99 dataset and the results showed the Fuzzy GHA method to perform better than GHA in the detection of both U2R and DoS attacks.

A feature selection algorithm for intrusion detection system based on Pigeon Inspired Optimizer

Feature selection plays a vital role in building machine learning models. Irrelevant features in data affect the accuracy of the model and increase the training time needed to build the model. Feature selection is an important process to build Intrusion Detection System (IDS). In this paper, a wrapper feature selection algorithm for IDS is proposed. This algorithm uses the pigeon inspired optimizer to utilize the selection process. A new method to binarize a continuous pigeon inspired optimizer is proposed and compared to the traditional way for binarizing continuous swarm intelligent algorithms. The proposed algorithm was evaluated using three popular datasets: KDDCUP99, NLS-KDD and UNSW-NB15. The proposed algorithm outperformed several feature selection algorithms from state-of-the-art related works in terms of TPR, FPR, accuracy, and F-score. Also, the proposed cosine similarity method for binarizing the algorithm has a faster convergence than the sigmoid method.

Statistical Based Feature Selection and Ensemble Model for Network Intrusion Detection using Data Mining Technique

In today’s world, Information society, computer networks and their interconnected applications are the emerging technologies. Intrusion Detection System (IDS) is used to distinguish the attitude of the network. Now a days, due to frequent and heavy attacks an Network devices, the Intrusion Detection System has become growing and censorious component to secure Network devices. A huge amount of data is needed to build the perfect Intrusion Detection System. This proposed system focuses on feature selection and ensemble of tree based classification methods to build Intrusion Detection System. The implementation of feature selection is fulfilled by using the NSL-KDD dataset. Statistical based feature selection methods such as Pearson's Correlation, Chi-square, Gain ratio and Symmetrical uncertainty are used to generate four modified datasets. By using that modified datasets the tree based Intrusion Detection models are built using J48, REP Tree and simple CART algorithms. To acquire better prediction of accuracy the algorithms J48, REP tree and simple CART are combined using ensemble method and built perfect tree based Intrusion Detection System.