Collaborative Intrusion Detection Research Articles

Taxonomy and Survey of Collaborative Intrusion Detection System using Federated Learning

This review article looks at recent research on Federated Learning (FL) for Collaborative Intrusion Detection Systems (CIDS) to establish a taxonomy and survey. The motivation behind this review comes from the difficulty of detecting coordinated cyberattacks in large-scale distributed networks. Collaborative anomalies are one of the network anomalies that need to be detected through robust collaborative learning methods. FL is promising collaborative learning method in recent research. This review aims to offer insights and lesson learn for creating a taxonomy of collaborative anomaly detection in CIDS using FL as a collaborative learning method. Our findings suggest that a taxonomy is required to map the discussion area, including an algorithm for training the learning model, the dataset, global aggregation model, system architecture, security, and privacy. Our results indicate that FL is a promising approach for collaborative anomaly detection in CIDS, and the proposed taxonomy could be useful for future research in this area. Overall, this review contributes to the growing knowledge of FL for CIDS, providing insights and lessons for researchers and practitioners. This research also concludes significant challenges, opportunities, and future directions in CIDS based on collaborative anomaly detection using FL.

Collaborative Intrusion Detection System with Snort Machine Learning Plugin

The increasing prevalence of cybercrime and cyber-attacks underscores the imperative need for organizations to implement robust network security measures. Nevertheless, current Intrusion Detection Systems (IDS) often rely on single-sensor or multi-sensor in the same type of IDS, including Host-Based IDS (HIDS) or Network-Based IDS (NIDS), which inherently possess limited detection capabilities. To address this limitation, this research combines NIDS and HIDS components into a collaborative-IDS system, thus expanding the scope of intrusion detection and enhancing the efficacy of the established attack mitigation system. However, the integration of NIDS and HIDS introduces formidable challenges, notably the elevated rates of False Positive and False Negative alerts. To surmount these challenges, the researcher employs machine learning techniques in the form of Snort plugins and comparison methods to heighten the precision of attack detection. The obtained results unequivocally illustrate the effectiveness of this approach. Using a Support Vector Machine for static analysis of the NSL-KDD dataset attains an outstanding 99% detection rate for Denial of Service (DoS) attacks and an impressive 98% detection rate for Probe attacks. Furthermore, in dynamic real-time attack simulations, the machine learning plugins exhibit remarkable proficiency in detecting various types of DoS attacks, concurrently offering more comprehensive identification of SYN Flooding DoS attacks compared to the Snort community rules set. These findings signify a significant advancement in intrusion detection, paving the way for more robust and accurate network security systems in an era of escalating cyber threats.

Collaborative intrusion detection using weighted ensemble averaging deep neural network for coordinated attack detection in heterogeneous network

Detecting coordinated attacks in cybersecurity is challenging due to their sophisticated and distributed nature, making traditional Intrusion Detection Systems often ineffective, especially in heterogeneous networks with diverse devices and systems. This research introduces a novel Collaborative Intrusion Detection System (CIDS) using a Weighted Ensemble Averaging Deep Neural Network (WEA-DNN) designed to detect such attacks. The WEA-DNN combines deep learning techniques and ensemble methods to enhance detection capabilities by integrating multiple Deep Neural Network (DNN) models, each trained on different data subsets with varying architectures. Differential Evolution optimizes the model’s contributions by calculating optimal weights, allowing the system to collaboratively analyze network traffic data from diverse sources. Extensive experiments on real-world datasets like CICIDS2017, CSE-CICIDS2018, CICToNIoT, and CICBotIoT show that the CIDS framework achieves an average accuracy of 93.8%, precision of 78.6%, recall of 60.4%, and an F1-score of 62.4%, surpassing traditional ensemble models and matching the performance of local DNN models. This demonstrates the practical benefits of WEA-DNN in improving detection capabilities in real-world heterogeneous network environments, offering superior adaptability and robustness in handling complex attack patterns.

Enhanced collaborative intrusion detection for industrial cyber-physical systems using permissioned blockchain and decentralized federated learning networks

In the digital economy, the security of Cyber-Physical Systems (CPSs) is paramount. Despite the deployment of various Intrusion Detection Systems (IDSs) in industrial CPSs, the primary obstacles to the advanced research include class imbalance, privacy gap, model homogenization, and arbitrary aggregation. Thus, in this paper, a Permissioned Blockchain-enabled decentralized federated distillation Generative Adversarial Network (GAN), namely PB-fdGAN, is proposed for Collaborative IDSs (CIDSs) in industrial CPSs. The novel Local Differential Privacy (LDP)-external classifier GAN (ecGAN) addresses class imbalance and privacy concerns by integrating label conditions into the latent space and using Wasserstein distance for stability in semi-supervised learning. Additionally, a Decentralized Federated Distillation (DFD) scheme allows for collaborative model building without data exchange, enhancing privacy and diversity. Moreover, a Quality of Service (QoS)-consortium blockchain framework with a new QoS evaluation strategy ensures reliable and effective model aggregation. The experimental evaluation demonstrates the high effectiveness of PB-fdGAN in detecting various types of cyber threats and the superiorities over state-of-the-art IDS solutions.

Real-time fusion multi-tier DNN-based collaborative IDPS with complementary features for secure UAV-enabled 6G networks

UAV-enabled Integrated Sensing and Communication (ISAC) in sixth-generation (6G) wireless networks has sparked significant research interest. UAVs are positioned as aerial wireless platforms, extending coverage and improving Sensing and Communication (S&C) services. However, integrating UAVs introduces vulnerabilities due to multi-connectivity, necessitating robust security measures. To address this, efforts are focused on developing effective Intrusion Detection Systems (IDS). Here ML-based IDSs depend on the most suited Machine Learning (ML) algorithms for improved detection accuracy. However, inadequate detection features frequently contribute to the limitations of detection accuracy in various emerging cyber-attacks. Our study explores attack traits in UAV-enabled 6G networks, using complementary detection features to enhance ML-based attack detection. Additionally, existing Deep Neural Network (DNN) solutions for UAVs-enabled 6G networks mainly use single models (e.g., CNN, SVM, CGAN) instead of multi-tier models, (e.g., Hybrid, Fusion, Ensemble). Here, although the use of a single model can be faster for computer systems, it is difficult to understand the growing complexity of intrusion patterns in data. Also, these single models might not be good at recognizing the unique patterns of less common issues in datasets. Thus, we propose a fusion multi-tier DNN-based Collaborative Intrusion Detection and Prevention System (CIDPS) for critical UAV-enabled 6G networks. This system boosts accuracy without sacrificing latency reductions. Our approach learns decision boundaries from imbalanced data points using preceding DNNs sequentially. Moreover, most existing research works do not focus on intrusion prevention methods and deployment frameworks for UAV networks. This research proposes effective IPS mechanisms and deployment architecture for CIDPS in UAV-enabled 6G networks. It incorporates a CIDPS with an emergency response protocol, neutralizing attacks upon anomaly detection. We validate our solution through diverse dataset experiments (UAVIDS-2020, NF-UQ-NIDS-v2, 5G-NIDD). Unlike traditional practices where IDS are simulated, we implement CIDPS on actual UAV devices (PX4 Vision Dev Kit V1.5, DJI mini se, DJI mini 3 pro) and real-world UAV networks. Our approach outperforms prior algorithms with a 99.25% attack classification accuracy, higher detection efficiency, and lower resource usage, exceeding 99.05% detection rates.

Lightweight, Trust-Managing, and Privacy-Preserving Collaborative Intrusion Detection for Internet of Things

This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.

Privacy-Preserving Collaborative Intrusion Detection in Edge of Internet of Things: A Robust and Efficient Deep Generative Learning Approach

Privacy-Preserving Collaborative Intrusion Detection in Edge of Internet of Things: A Robust and Efficient Deep Generative Learning Approach

IoT-Driven solutions for VANET trustworthiness: Examining misconduct and position security challenges

Vehicular ad hoc networks (VANETs) improve the traffic management and road safety by exchanging real-time data between automobiles and roadside infrastructure. Reliable Intelligent Transport Systems (ITS) solutions tend to boost VANET data security, integrity and dependability. These systems communicate VANET data between infrastructure and automobiles using sensors, Internet of Things (IoT) devices and communication technologies. IoT-driven includes a Real-Time Traffic Observation optimizes VANET route design. Traffic management and safety improve with ITS-connected cars and infrastructure. Remote communication technologies enhance traffic management and decision-making by sending a real-time data between cars and infrastructure. Smart parking systems use real-time parking availability data from IoT sensors and devices to maximize space use and reduce congestion. Security and misbehavior are dependable problems in 40 IoT-driven VANET studies. Miscommunication and unstandardized are the main security issues which pose hazards. This review shows VANETs that requires authentication, encryption and anomaly detection to prevent attacks and IoT for transportation sector. This extensive review covers VANET reliability and IoT-driven real-time traffic monitoring, ITS, remote communication and intelligent parking systems. This review analyzes the metrics to assess the many detection techniques which includes, misconduct-Aware On-Demand Collaborative Intrusion Detection System (MACIDS) and Collision-Induced Dissociation Spectroscopy (CIDS), (i) Accuracy (ii) False Positive Rate, (iii) precision, (iv) recall (v) False Negative Rate and (vi) F1-Score in VANET security in Attack Detection Rates (ADR), misbehavior detection, evaluation metrics and detection algorithms were studied using CIC-IDS data. Due to misconduct and security issues, a strong IoT-driven solutions are required to improve VANET trustworthiness and offers a secure and reliable vehicular communication networks for safer and more efficient transportation systems.

TICPS: A trustworthy collaborative intrusion detection framework for industrial cyber–physical systems

The networking of industrial cyber–physical systems (CPS) introduces increased security vulnerabilities, necessitating advanced intrusion detection systems (IDS). Many current studies aiming to enhance IDS capabilities leverage Federated Learning (FL) technology for collaborative intrusion detection. However, devices deployed in an industrial setting in a distributed manner are vulnerable to cyber and poisoning attacks. Compromised clients can create malicious parameters to disrupt intrusion detection models, making them ineffective in identifying attacks. Nevertheless, existing FL-based intrusion detection methods exhibit suboptimal performance in detecting malicious clients and resisting poisoning attacks. To address these issues, we propose TICPS, a collaborative intrusion detection framework based on a trustworthy model update strategy to detect cyber threats from industrial CPS. The framework enables multiple industrial CPS to collaboratively construct an intrusion detection model and evaluate the security of each industrial CPS node using an update evaluation mechanism, ensuring effective intrusion detection even in the presence of poisoning. Extensive experiments on real-world industrial CPS datasets demonstrate that TICPS can effectively detect various types of cyber threats targeting industrial CPS. In particular, the framework achieves an intrusion detection accuracy of 94% even when the proportion of malicious agents reaches 80% under three typical poisoning attacks.

Enhancing Industrial IoT Security: Utilizing Blockchain-Assisted Deep Federated Learning for Collaborative Intrusion Detection

The Industrial Internet of Things (IIoT) is a rapidly evolving features with multiple applications, including critical infrastructure. Privacy policies are required to preserve the protection of user data in the threat intelligence community. Blockchain is a modern technology which used recently to provide more secure storage and efficiency. In this research, Blockchain Assisted Deep Federated Learning (BC_DFL) system is used to detect intruders. The three key processes used in the proposed intrusion detection architecture are data collection, pre-processing and intrusion detection. Data normalization, reduction, cleaning and transformation are used in pre-processing to remove extraneous information and improve data quality. This pre-processed data is sent to the Blockchain Assisted Deep Federated Learning (BC_DFL) system for intrusion detection. To detect intruders, the federated learning-based Capsule Auto-Encoder (FL_CAE) architecture first learns the properties from the inputs. Blockchain technology (BCTech) is not only used for storage but also improves security by eliminating the possibility of threatening node and individual server failure. The ToN_IoT and UNSW-NB15 data sets are used in the implementation and performance evaluation study. The proposed model is evaluated using existing in the Results section. In the UNSW-NB15 dataset, proposed model achieved an accuracy, precision, recall and F1 score of 97.26%, 97.28%, 96.89% and 96.96% respectively as well as in ToN_IoT data set proposed model achieved an accuracy, precision, recall and F1 score of 95.74%, 99.54 %, 99.49% and 99.24%, respectively. The execution of the proposed approach takes 2.31 seconds in the UNSW-NB15 dataset and 1.66 seconds in the ToN_IoT dataset. Blockchain offers a transparent and impenetrable ledger for transaction recording and verification. Within the framework of cooperative intrusion detection, it guarantees a secure and reliable exchange of threat intelligence and detection models between various users of IIoT ecosystem.

FedSBS: Federated-Learning participant-selection method for Intrusion Detection Systems

Federated Learning (FL) is a decentralized machine learning approach in which multiple participants collaboratively train a model. Participants keep data locally, train their local models, and aggregate them in a single global model in a federated server. Collaborative FL-based Intrusion Detection Systems face challenges on an uneven statistical distribution of data and malicious participants trying to subvert the learning process. The statistical hurdles associated with imbalanced data and malicious participants pose a risk of skewing the training with biased or random data. The inability to effectively manage these statistical inconsistencies may degrade system performance, leading to false intrusion detection or opening avenues for cybersecurity breaches. To overcome these challenges, we propose a training method that employs score-based participant selection and utilizes global momentum for model aggregation. Our method improves the global model performance while mitigating the risks posed by malicious participants. The proposal incorporates a scoring system based on an information gain variant to evaluate each participant’s contribution. The scoring system and an epsilon greedy selection method ensure robust participant selection in each aggregation round. Furthermore, incorporating a global momentum term helps preserve previous knowledge at each aggregation round, contributing to model stability and overall learning. The proposed solution has demonstrated superior performance, delivering 80% F1-Score and 90% accuracy on experiments even in the presence of malicious participants, revealing the robustness and effectiveness of the proposal in mitigating statistical challenges. Consequently, the proposed method significantly enhances the performance of federated learning models, leading to more secure and efficient collaborative intrusion detection systems.

Designing energy-aware collaborative intrusion detection in IoT networks

The Internet of Things (IoT) with its evolution brings many benefits to people’s routine life, while at the same time posing various security challenges, due to the lack of software updates and access control policies. For protection, collaborative/distributed detection networks are one essential security solution, which can enhance the detection capability of a separate detection node by governing a set of eligible detection nodes to share information. However, internal intruders/attacks are the main threat source to the distributed structure including both IoT and CIDNs. In the literature, the CIDNs with challenge-based trust mechanism is found to be secure under many common external threats, but would be ineffective to advanced insider threats. Motivated by this issue, this work considers the factor of energy consumption and develops an enhanced challenge-based CIDN, called EnergyCIDN. The main idea relies on the observation that advanced attacks should consume more energy than a benign node. Under the evaluation on our EnergyCIDN, we conduct a set of experiments and tests in many scenarios, including simulated network, practical IoT network, and medical network. In comparison with the existing similar approaches, our EnergyCIDN showcases better detection capability regarding both common and advanced insider attacks.

Federated Random Forest with Feature Selection for Collaborative Intrusion Detection in Internet of Things

This research explores using a Federated Random Forest (FRF) model with feature selection techniques to improve collaborative intrusion detection in Internet of Things (IoT) settings. In the world of IoT security, where devices have limited resources and privacy is crucial, this study aims to overcome challenges like resource constraints and data privacy. The FRF model, building on the effectiveness of Random Forest (RF), is enhanced with feature selection methods to improve intrusion detection accuracy while managing dimensionality issues. By allowing devices to work together on intrusion detection without revealing sensitive data, this research aims to establish a stronger and privacy-conscious IoT security framework. The study also investigates the performance of the FRF model adapts to different types of IoT devices, ensuring its effectiveness in diverse environments. The findings aim to offer valuable insights and practical solutions in the evolving field of collaborative intrusion detection in IoT, using the CIC IoT Dataset 2023. Based on the experiment result, the proposed model achieves an outstanding ± 99.68% accuracy, precision, recall, and F1-Score, indicating remarkable correctness and balance in its predictions for intrusions. This exceptional performance underscores the model's reliability and effectiveness across all evaluation metrics.

CVMIDS: Cloud–Vehicle Collaborative Intrusion Detection System for Internet of Vehicles

CVMIDS: Cloud–Vehicle Collaborative Intrusion Detection System for Internet of Vehicles

A Federated-ANFIS for Collaborative Intrusion Detection in Securing Decentralized Autonomous Organizations

A Federated-ANFIS for Collaborative Intrusion Detection in Securing Decentralized Autonomous Organizations

Securing Cyber-Physical Systems: A Decentralized Framework for Collaborative Intrusion Detection With Privacy Preservation

Securing Cyber-Physical Systems: A Decentralized Framework for Collaborative Intrusion Detection With Privacy Preservation

Review of routing protocol for low power and lossy network in the internet of things

The growth of internet of things (IoT) devices and apps has caused disruptions in key sectors such as smart environment, healthcare, and mission-critical tool. Security of IoT devices, networks, and infrastructure is the biggest challenge. RPL, a routing protocol optimised for low-power and lossy networks, is applied by the IoT to offer seamless information transfer among the myriad of interconnected entities. So, the paper delves into the nuts and bolts of RPL, covering its protocol settings, trickle timer, and objective function, as well as the IoT’s architecture and applications. This article also provides a framework for categorising past research on the effects of RPL-IoT on energy consumption, transportation, service quality, traffic congestion, and safety. The future of energy efficiency, congestion, objective function, mobility, stability, security, collaborative intrusion detection systems, active learning, and Key Management are all considered in this analysis.

Collaborative Intrusion Detection System for SDVN: A Fairness Federated Deep Learning Approach

Collaborative Intrusion Detection System for SDVN: A Fairness Federated Deep Learning Approach

A blockchain-assisted security management framework for collaborative intrusion detection in smart cities

Aiming to safeguard a decentralized setup such as smart cities, collaborative intrusion detection system (CIDS) has become a mainstream security mechanism to protect different types of computer networks, especially decentralized computing platforms such as Internet of Things (IoT). The main benefit of CIDS relies on the information sharing process among devices, nodes, software and hardware entities. However, traditional CIDS often requires a trusted third partner, e.g., a centralized computing server, to help build up a trusted communication channel among various entities. Such requirement is not practical in real-world implementation, making the integrity of shared information compromised easily. With the wide adoption, blockchain technology has given a solution to protect the distributed/collaborative detection system. In the current market, blockchain technology has been extensively researched across many detection scenarios, but there is a need to explore how such technology can overall contribute to CIDS and a general distributed detection system. In this work, we introduce a blockchain-assisted security management framework for CIDS, which summarizes and provides an integrated protection given by blockchain. In the case study, we evaluate our proposed framework in both a simulated and a real CIDS setup with challenge-based mechanism. The results demonstrate the promising benefits provided by blockchain in CIDS.

A Q-Learning-Based Two-Layer Cooperative Intrusion Detection for Internet of Drones System

The integration of unmanned aerial vehicles (UAVs) and the Internet of Things (IoT) has opened up new possibilities in various industries. However, with the increasing number of Internet of Drones (IoD) networks, the risk of network attacks is also rising, making it increasingly difficult to identify malicious attacks on IoD systems. To improve the accuracy of intrusion detection for IoD and reduce the probability of false positives and false negatives, this paper proposes a Q-learning-based two-layer cooperative intrusion detection algorithm (Q-TCID). Specifically, Q-TCID employs an intelligent dynamic voting algorithm that optimizes multi-node collaborative intrusion detection strategies at the host level, effectively reducing the probability of false positives and false negatives in intrusion detection. Additionally, to further reduce energy consumption, an intelligent auditing algorithm is proposed to carry out system-level auditing of the host-level detections. Both algorithms employ Q-learning optimization strategies and interact with the external environment in their respective Markov decision processes, leading to close-to-optimal intrusion detection strategies. Simulation results demonstrate that the proposed Q-TCID algorithm optimizes the defense strategies of the IoD system, effectively prolongs the mean time to failure (MTTF) of the system, and significantly reduces the energy consumption of intrusion detection.