Collaborative Intrusion Detection System Research Articles

Real-time fusion multi-tier DNN-based collaborative IDPS with complementary features for secure UAV-enabled 6G networks

UAV-enabled Integrated Sensing and Communication (ISAC) in sixth-generation (6G) wireless networks has sparked significant research interest. UAVs are positioned as aerial wireless platforms, extending coverage and improving Sensing and Communication (S&C) services. However, integrating UAVs introduces vulnerabilities due to multi-connectivity, necessitating robust security measures. To address this, efforts are focused on developing effective Intrusion Detection Systems (IDS). Here ML-based IDSs depend on the most suited Machine Learning (ML) algorithms for improved detection accuracy. However, inadequate detection features frequently contribute to the limitations of detection accuracy in various emerging cyber-attacks. Our study explores attack traits in UAV-enabled 6G networks, using complementary detection features to enhance ML-based attack detection. Additionally, existing Deep Neural Network (DNN) solutions for UAVs-enabled 6G networks mainly use single models (e.g., CNN, SVM, CGAN) instead of multi-tier models, (e.g., Hybrid, Fusion, Ensemble). Here, although the use of a single model can be faster for computer systems, it is difficult to understand the growing complexity of intrusion patterns in data. Also, these single models might not be good at recognizing the unique patterns of less common issues in datasets. Thus, we propose a fusion multi-tier DNN-based Collaborative Intrusion Detection and Prevention System (CIDPS) for critical UAV-enabled 6G networks. This system boosts accuracy without sacrificing latency reductions. Our approach learns decision boundaries from imbalanced data points using preceding DNNs sequentially. Moreover, most existing research works do not focus on intrusion prevention methods and deployment frameworks for UAV networks. This research proposes effective IPS mechanisms and deployment architecture for CIDPS in UAV-enabled 6G networks. It incorporates a CIDPS with an emergency response protocol, neutralizing attacks upon anomaly detection. We validate our solution through diverse dataset experiments (UAVIDS-2020, NF-UQ-NIDS-v2, 5G-NIDD). Unlike traditional practices where IDS are simulated, we implement CIDPS on actual UAV devices (PX4 Vision Dev Kit V1.5, DJI mini se, DJI mini 3 pro) and real-world UAV networks. Our approach outperforms prior algorithms with a 99.25% attack classification accuracy, higher detection efficiency, and lower resource usage, exceeding 99.05% detection rates.

Lightweight, Trust-Managing, and Privacy-Preserving Collaborative Intrusion Detection for Internet of Things

This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.

IoT-Driven solutions for VANET trustworthiness: Examining misconduct and position security challenges

Vehicular ad hoc networks (VANETs) improve the traffic management and road safety by exchanging real-time data between automobiles and roadside infrastructure. Reliable Intelligent Transport Systems (ITS) solutions tend to boost VANET data security, integrity and dependability. These systems communicate VANET data between infrastructure and automobiles using sensors, Internet of Things (IoT) devices and communication technologies. IoT-driven includes a Real-Time Traffic Observation optimizes VANET route design. Traffic management and safety improve with ITS-connected cars and infrastructure. Remote communication technologies enhance traffic management and decision-making by sending a real-time data between cars and infrastructure. Smart parking systems use real-time parking availability data from IoT sensors and devices to maximize space use and reduce congestion. Security and misbehavior are dependable problems in 40 IoT-driven VANET studies. Miscommunication and unstandardized are the main security issues which pose hazards. This review shows VANETs that requires authentication, encryption and anomaly detection to prevent attacks and IoT for transportation sector. This extensive review covers VANET reliability and IoT-driven real-time traffic monitoring, ITS, remote communication and intelligent parking systems. This review analyzes the metrics to assess the many detection techniques which includes, misconduct-Aware On-Demand Collaborative Intrusion Detection System (MACIDS) and Collision-Induced Dissociation Spectroscopy (CIDS), (i) Accuracy (ii) False Positive Rate, (iii) precision, (iv) recall (v) False Negative Rate and (vi) F1-Score in VANET security in Attack Detection Rates (ADR), misbehavior detection, evaluation metrics and detection algorithms were studied using CIC-IDS data. Due to misconduct and security issues, a strong IoT-driven solutions are required to improve VANET trustworthiness and offers a secure and reliable vehicular communication networks for safer and more efficient transportation systems.

FedSBS: Federated-Learning participant-selection method for Intrusion Detection Systems

Federated Learning (FL) is a decentralized machine learning approach in which multiple participants collaboratively train a model. Participants keep data locally, train their local models, and aggregate them in a single global model in a federated server. Collaborative FL-based Intrusion Detection Systems face challenges on an uneven statistical distribution of data and malicious participants trying to subvert the learning process. The statistical hurdles associated with imbalanced data and malicious participants pose a risk of skewing the training with biased or random data. The inability to effectively manage these statistical inconsistencies may degrade system performance, leading to false intrusion detection or opening avenues for cybersecurity breaches. To overcome these challenges, we propose a training method that employs score-based participant selection and utilizes global momentum for model aggregation. Our method improves the global model performance while mitigating the risks posed by malicious participants. The proposal incorporates a scoring system based on an information gain variant to evaluate each participant’s contribution. The scoring system and an epsilon greedy selection method ensure robust participant selection in each aggregation round. Furthermore, incorporating a global momentum term helps preserve previous knowledge at each aggregation round, contributing to model stability and overall learning. The proposed solution has demonstrated superior performance, delivering 80% F1-Score and 90% accuracy on experiments even in the presence of malicious participants, revealing the robustness and effectiveness of the proposal in mitigating statistical challenges. Consequently, the proposed method significantly enhances the performance of federated learning models, leading to more secure and efficient collaborative intrusion detection systems.

CVMIDS: Cloud–Vehicle Collaborative Intrusion Detection System for Internet of Vehicles

CVMIDS: Cloud–Vehicle Collaborative Intrusion Detection System for Internet of Vehicles

Review of routing protocol for low power and lossy network in the internet of things

The growth of internet of things (IoT) devices and apps has caused disruptions in key sectors such as smart environment, healthcare, and mission-critical tool. Security of IoT devices, networks, and infrastructure is the biggest challenge. RPL, a routing protocol optimised for low-power and lossy networks, is applied by the IoT to offer seamless information transfer among the myriad of interconnected entities. So, the paper delves into the nuts and bolts of RPL, covering its protocol settings, trickle timer, and objective function, as well as the IoT’s architecture and applications. This article also provides a framework for categorising past research on the effects of RPL-IoT on energy consumption, transportation, service quality, traffic congestion, and safety. The future of energy efficiency, congestion, objective function, mobility, stability, security, collaborative intrusion detection systems, active learning, and Key Management are all considered in this analysis.

Collaborative Intrusion Detection System for SDVN: A Fairness Federated Deep Learning Approach

Collaborative Intrusion Detection System for SDVN: A Fairness Federated Deep Learning Approach

A blockchain-assisted security management framework for collaborative intrusion detection in smart cities

Aiming to safeguard a decentralized setup such as smart cities, collaborative intrusion detection system (CIDS) has become a mainstream security mechanism to protect different types of computer networks, especially decentralized computing platforms such as Internet of Things (IoT). The main benefit of CIDS relies on the information sharing process among devices, nodes, software and hardware entities. However, traditional CIDS often requires a trusted third partner, e.g., a centralized computing server, to help build up a trusted communication channel among various entities. Such requirement is not practical in real-world implementation, making the integrity of shared information compromised easily. With the wide adoption, blockchain technology has given a solution to protect the distributed/collaborative detection system. In the current market, blockchain technology has been extensively researched across many detection scenarios, but there is a need to explore how such technology can overall contribute to CIDS and a general distributed detection system. In this work, we introduce a blockchain-assisted security management framework for CIDS, which summarizes and provides an integrated protection given by blockchain. In the case study, we evaluate our proposed framework in both a simulated and a real CIDS setup with challenge-based mechanism. The results demonstrate the promising benefits provided by blockchain in CIDS.

Federated Learning for IoT Intrusion Detection

The number of Internet of Things (IoT) devices has increased considerably in the past few years, resulting in a large growth of cyber attacks on IoT infrastructure. As part of a defense in depth approach to cybersecurity, intrusion detection systems (IDSs) have acquired a key role in attempting to detect malicious activities efficiently. Most modern approaches to IDS in IoT are based on machine learning (ML) techniques. The majority of these are centralized, which implies the sharing of data from source devices to a central server for classification. This presents potentially crucial issues related to privacy of user data as well as challenges in data transfers due to their volumes. In this article, we evaluate the use of federated learning (FL) as a method to implement intrusion detection in IoT environments. FL is an alternative, distributed method to centralized ML models, which has seen a surge of interest in IoT intrusion detection recently. In our implementation, we evaluate FL using a shallow artificial neural network (ANN) as the shared model and federated averaging (FedAvg) as the aggregation algorithm. The experiments are completed on the ToN_IoT and CICIDS2017 datasets in binary and multiclass classification. Classification is performed by the distributed devices using their own data. No sharing of data occurs among participants, maintaining data privacy. When compared against a centralized approach, results have shown that a collaborative FL IDS can be an efficient alternative, in terms of accuracy, precision, recall and F1-score, making it a viable option as an IoT IDS. Additionally, with these results as baseline, we have evaluated alternative aggregation algorithms, namely FedAvgM, FedAdam and FedAdagrad, in the same setting by using the Flower FL framework. The results from the evaluation show that, in our scenario, FedAvg and FedAvgM tend to perform better compared to the two adaptive algorithms, FedAdam and FedAdagrad.

Using Federated Learning for Collaborative Intrusion Detection Systems

Neural networks have become cutting edge machine learning models for detecting network attacks. Traditional implementations provide fast and accurate predictions, but require centralised storage of labelled historical data for training. This solution is not always suitable for real-world applications, where regulatory constraints and privacy concerns hamper the collection of sensitive data into a single server. Federated Learning has recently been proposed as a framework for training a centralised model without the need to share data between different providers. We use the CICIDS2017 dataset provided by the Canadian Institute of Cybersecurity to demonstrate the benefits of Neural Networks-based Federated Learning for the detection of the most relevant types of network attacks. We conclude that a federated-trained neural network outperforms locally-trained models (at isoarchitecture) in terms of F1-score and False Negative detection ratio. Further, such model has a minor loss of performance and convergence rapidity compared to a model trained over a hypothetical centralised dataset.

Improving Collaborative Intrusion Detection System Using Blockchain and Pluggable Authentication Modules for Sustainable Smart City

The threat of cyber-attacks is ever increasing in today’s society. There is a clear need for better and more effective defensive tools. Intrusion detection can be defined as the detection of anomalous behavior either in the host or in the network. An intrusion detection system can be used to identify the anomalous behavior of the system. The two major tasks of intrusion detection are to monitor data and raise an alert to the system administrators when an intrusion takes place. The current intrusion detection system is incapable of tackling sophisticated attacks which take place on the entire network containing large number of nodes while maintaining a low number of login attempts on each node in the system. A collaborative intrusion detection system (CIDS) was designed to remove the inefficiency of the current intrusion detection system which failed to detect coordinated distributed attacks. The main problem in the CIDS is the concept of trust. Hosts in the network need to trust the data sent by other peers in the network. To bring in the concept of trust and implement the proof-of-concept, blockchain was used. Pluggable authentication modules (PAM) were also used to track login activity securely before an intruder could modify the login activity. To implement blockchain, an Ethereum-based private blockchain was used.

Scalable Collaborative Intrusion Detection in Autonomous Vehicular Networks: A hierarchical framework based on game theory

Autonomous Vehicles (AVs) networks are vulnerable to security attacks targeting data integrity and service availability. To successfully operate in emerging automated highway systems (AHS), securing communications among the AVs and with the transportation infrastructure is paramount. An Intrusion Detection System (IDS) is the foremost defense artifact against malicious AV activities. However, individual IDS on board of the AV may not be sufficient enough against diverse and increasingly emerging new threats. In addition, not all security vendors synchronize their update of new IDS security features. Therefore, the collaboration among individual IDSs of AVs enables the vehicles to benefit from the collective knowledge and information of their neighbors and achieve more accurate intrusion detection. This paper presents a hierarchical framework for a Collaborative Intrusion Detection Network (CIDN) that allows the AV platoons to share detection knowledge based on trust and increase the accuracy of their individual IDS. The proposed CIDN involves intra-platoon and inter-platoon collaborations to improve scalability. The experimental results show that collaborative IDSs yield higher accuracy than individual IDSs in detecting misbehaviors in AV networks while achieving scalability.

Task offloading of cooperative intrusion detection system based on Deep Q Network in mobile edge computing

Due to the performance and resource limitations of wireless devices at the edge of the network, the intrusion detection system deployed on the mobile edge network will cause severe packet loss when faced with large traffic. Based on this, a collaborative intrusion detection system (CIDS) architecture applied to mobile edge computing is proposed, which can offload part of the detection tasks to an intrusion detection system with better performance and resources on the edge server. On this basis, a task offloading scheduling algorithm based on Deep Q Network (DQN) is proposed. First, the time delay, energy consumption, and offloading decision models are established. Then, the task scheduling process is described as a Markov decision process and the relevant space and value function are established. Finally, the problem of excessive state and action space in Q-learning is solved by the Deep Q Network. Experiments have shown that our proposed scheme enables the system to have advantages over the comparative algorithms in terms of response time, energy consumption, and packet loss rate, etc..

EFFICIENT AND SECURE DATA SHARING SCHEME FOR INTRUSION AVOIDANCE WITH PRIVACY PRESERVING IN CLOUDLET ENVIRONMENT

–Customary medical services framework frequently requires the conveyance of clinical information to the cloud, which includes clients' sensitiveinformation and causes correspondence energy utilization. For all intents and purposes, clinical information sharing is a basic and testing issue. Thus,in this paper, we develop a clever medical services framework by using the adaptability of cloudlet. The elements of cloudlet incorporate privacyprotection, information sharing and interruption location. In the phase of information assortment, we initially use Number Theory Research Unit technique to encode client's body information gathered by wearable gadgets. That information will be communicated to neighboring cloudlet in an energyefficient style. Besides, we present another trust model to assist clients with choosing trustable accomplices who need to share put away information in thecloudlet. The trust model additionally assists comparable patients with speaking with one another about their infections. Thirdly, we partition users'medical information put away in remote haze of clinic into three sections and give them legitimate security. At last, to shield thehealthcare framework from malevolent assaults, we foster an original cooperative interruption discovery framework (IDS) strategy in view of cloudletmesh, which can successfully forestall the far off medical care huge information cloud from assaults. Index Terms – Privacy protection, data sharing, collaborative intrusion detection system (IDS), healthcare.

MidSiot: A Multistage Intrusion Detection System for Internet of Things

Internet of Things (IoT) has been thriving in recent years, playing an important role in a multitude of various domains, including industry 4.0, smart transportation, home automation, and healthcare. As a result, a massive number of IoT devices are deployed to collect data from our surrounding environment and transfer these data to other systems over the Internet. This may lead to cybersecurity threats, such as denial of service attacks, brute-force attacks, and unauthorized accesses. Unfortunately, many IoT devices lack solid security mechanisms and hardware security supports because of their limitations in computational capability. In addition, the heterogeneity of devices in IoT networks causes nontrivial challenges in detecting security threats. In this article, we present a collaborative intrusion detection system (IDS), namely, MidSiot, deployed at both Internet gateways and IoT local gateways. Our proposed IDS consists of three stages: (1) classifying the type of each IoT device in the IoT network; (2) differentiating between benign and malicious network traffic; and (3) identifying the type of attacks targeting IoT devices. The last two stages are handled by the Internet gateways, whereas the first stage is on the local gateway to leverage the computational resources from edge devices. The evaluation results on three popular IDS datasets (IoTID20, CIC-IDS-2017, and BOT-IoT) indicate our proposal could detect seven common cyberattacks targeting IoT devices with an average accuracy of 99.68% and outperforms state-of-the-art IDSs. This demonstrates that MidSiot could be an effective and practical IDS to protect IoT networks.

Surveying Trust-Based Collaborative Intrusion Detection: State-of-the-Art, Challenges and Future Directions

Owing to the swift growth in cyber attacks, intrusion detection systems (IDSs) have become a necessity to help safeguard personal and organizational assets. However, with the increasing size of computer networks, it becomes difficult for a stand-alone IDS to identify sophisticated and advanced threats, such as DDoS attack, due to the lack of contextual information and knowledge regarding the deployed environments. To tackle this issue, distributed and collaborative IDSs (DIDSs and CIDSs) are developed, which enable a set of IDS nodes to operate in a collaborative way through exchanging required information. In this survey, we first summarize the state-of-the-art for traditional DIDSs according to the collaboration topology, e.g., centralized, decentralized, and distributed, and discuss major external and internal threats. Because of the distributed nature and various threats, trust is often enforced among various IDS nodes. We then summarize the relevant research on trust-based DIDSs/CIDSs in a chronological order. Also, we highlight challenges and future directions in this field. The main purpose of this survey is to stimulate more research efforts in developing robust and practical trust-based collaborative intrusion detection.

Augmenting zero trust architecture to endpoints using blockchain: A state‐of‐the‐art review

AbstractWith the purpose of defending against lateral movement in today's borderless networks, zero trust architecture (ZTA) adoption is gaining momentum. With a full‐scale ZTA implementation, it is unlikely that adversaries will be able to spread through the network starting from a compromised endpoint. However, the already authenticated and authorized session of a compromised endpoint can be leveraged to carry out limited, though malicious, activities ultimately rendering the endpoints the Achilles heel of ZTA. To effectively detect such attacks, distributed collaborative intrusion detection systems with an attack scenario‐based approach have been developed. Nonetheless, advanced persistent threats have demonstrated their ability to bypass this approach with a high success ratio. As a result, adversaries can pass undetected or potentially alter the detection logging mechanisms to achieve a stealthy presence. Recently, blockchain technology has demonstrated solid use cases in the cyber security domain. In this paper, motivated by the convergence of ZTA and blockchain‐based intrusion detection and prevention, we examine how ZTA can be augmented onto endpoints. Namely, we perform a state‐of‐the‐art review of ZTA models, real‐world architectures with a focus on endpoints, and blockchain‐based intrusion detection systems. We discuss the potential of blockchain's immutability fortifying the detection process and identify open challenges as well as potential solutions and future directions.

Designing consensus algorithm for collaborative signature-based intrusion detection system

<span>Signature-based collaborative intrusion detection system (CIDS) is highly depends on the reliability of nodes to provide IDS attack signatures. Each node in the network is responsible to provide new attack signature to be shared with other node. There are two problems exist in CIDS highlighted in this paper, first is to provide data consistency and second is to maintain trust among the nodes while sharing the attack signatures. Recently, researcher find that blockchain has a great potential to solve those problems. Consensus algorithm in blockchain is able to increase trusts among the node and allows data to be inserted from a single source of truth. In this paper, we are investigating three blockchain consensus algorithms: proof of work (PoW), proof of stake (PoS), and hybrid PoW-PoS chain-based consensus algorithm which are possibly to be implemented in CIDS. Finally, we design an extension of hybrid PoW-PoS chain-based consensus algorithm to fulfill the requirement. This extension we name it as proof of attack signature (PoAS).</span>

A Survey on Multi-Agent Based Collaborative Intrusion Detection Systems

Abstract Multi-Agent Systems (MAS) have been widely used in many areas like modeling and simulation of complex phenomena, and distributed problem solving. Likewise, MAS have been used in cyber-security, to build more efficient Intrusion Detection Systems (IDS), namely Collaborative Intrusion Detection Systems (CIDS). This work presents a taxonomy for classifying the methods used to design intrusion detection systems, and how such methods were used alongside with MAS in order to build IDS that are deployed in distributed environments, resulting in the emergence of CIDS. The proposed taxonomy, consists of three parts: 1) general architecture of CIDS, 2) the used agent technology, and 3) decision techniques, in which used technologies are presented. The proposed taxonomy reviews and classifies the most relevant works in this topic and highlights open research issues in view of recent and emerging threats. Thus, this work provides a good insight regarding past, current, and future solutions for CIDS, and helps both researchers and professionals design more effective solutions.

D2Gen: A Decentralized Device Genome Based Integrity Verification Mechanism for Collaborative Intrusion Detection Systems

Collaborative Intrusion Detection Systems are considered an effective defense mechanism for large, intricate, and multilayered Industrial Internet of Things against many cyberattacks. However, while a Collaborative Intrusion Detection System successfully detects and prevents various attacks, it is possible that an inside attacker performs a malicious act and compromises an Intrusion Detection System node. A compromised node can inflict considerable damage on the whole collaborative network. For instance, when a malicious node gives a false alert of an attack, the other nodes will unnecessarily increase their security and close all of their services, thus, degrading the system’s performance. On the contrary, if the spurious node approves malicious traffic into the system, the other nodes would also be compromised. Therefore, to detect a compromised node in the network, this article introduces a device integrity check mechanism based on “Digital Genome.” In medical science, a genome refers to a set that contains all of the information needed to build and maintain an organism. Based on the same concept, the digital genome is computed over a device’s vital hardware, software, and other components. Hence, if an attacker makes any change in a node’s hardware and software components, the digital genome will change, and the compromised node will be easily detected. It is envisaged that the proposed integrity attestation protocol can be used in diverse Internet of Things and other information technology applications to ensure the legitimate operation of end devices. This study also proffers a comprehensive security and performance analysis of the proposed framework.