Cooperative Intrusion Detection System Research Articles

A Lightweight Cooperative Intrusion Detection System for RPL-based IoT

A Lightweight Cooperative Intrusion Detection System for RPL-based IoT

Analysis of Financial Data Risk and Network Information Security by Blockchain Technology and Edge Computing

To solve the problem of computer network security, this study creatively establishes a new information security (IS) strategy recommendation system and a cooperative intrusion detection system (CIDS) based on blockchain (BC) and edge computing (EC) technologies. The innovation lies in the proposal of the real-time CIDS method. First, the related technologies and theories of the Bayesian network, deep learning (DL), and neural network (NN) are analyzed. Second, a real-time IS strategy recommendation system is constructed using NNs and expert systems, and CIDS is built on BC and DL networks. Finally, experiments compare recurrent NN and long-short term memory (LSTM). The research results reveal that the accuracy of LSTM can reach about 93%. The comparison between the single intrusion detection system (SIDS) and CIDS denotes that CIDS is better than SIDS in detection accuracy, and the specific performance is 97.54% > 91%. The proposed model based on business continuity management can help enterprises better protect financial data and establish a complete protection system of network information security (NIS). In this study, a CIDS with good performance is obtained, which lays a foundation for the further development of the NIS.

Task offloading of cooperative intrusion detection system based on Deep Q Network in mobile edge computing

Due to the performance and resource limitations of wireless devices at the edge of the network, the intrusion detection system deployed on the mobile edge network will cause severe packet loss when faced with large traffic. Based on this, a collaborative intrusion detection system (CIDS) architecture applied to mobile edge computing is proposed, which can offload part of the detection tasks to an intrusion detection system with better performance and resources on the edge server. On this basis, a task offloading scheduling algorithm based on Deep Q Network (DQN) is proposed. First, the time delay, energy consumption, and offloading decision models are established. Then, the task scheduling process is described as a Markov decision process and the relevant space and value function are established. Finally, the problem of excessive state and action space in Q-learning is solved by the Deep Q Network. Experiments have shown that our proposed scheme enables the system to have advantages over the comparative algorithms in terms of response time, energy consumption, and packet loss rate, etc..

Oblivious stable sorting protocol and oblivious binary search protocol for secure multi-party computation

Multi-party computation (MPC) sorting and searching protocols are frequently used in different databases with varied applications, as in cooperative intrusion detection systems, private computation of set intersection and oblivious RAM. Ivan Damgard et al. have proposed two techniques i.e., bit-decomposition protocol and bit-wise less than protocol for MPC. These two protocols are used as building blocks and have proposed two oblivious MPC protocols. The proposed protocols are based on data-dependent algorithms such as insertion sort and binary search. The proposed multi-party sorting protocol takes the shares of the elements as input and outputs the shares of the elements in sorted order. The proposed protocol exhibits O ( 1 ) constant round complexity and O ( n log n ) communication complexity. The proposed multi-party binary search protocol takes two inputs. One is the shares of the elements in sorted order and the other one is the shares of the element to be searched. If the position of the search element exists, the protocol returns the corresponding shares, otherwise it returns shares of zero. The proposed multi-party binary search protocol exhibits O ( 1 ) round complexity and O ( n log n ) communication complexity. The proposed multi-party sorting protocol works better than the existing quicksort protocol when the input is in almost sorted order. The proposed multi-party searching protocol gives almost the same results, when compared to the general binary search algorithm.

Misbehavior-Aware On-Demand Collaborative Intrusion Detection System Using Distributed Ensemble Learning for VANET

Vehicular ad hoc networks (VANETs) play an important role as enabling technology for future cooperative intelligent transportation systems (CITSs). Vehicles in VANETs share real-time information about their movement state, traffic situation, and road conditions. However, VANETs are susceptible to the cyberattacks that create life threatening situations and/or cause road congestion. Intrusion detection systems (IDSs) that rely on the cooperation between vehicles to detect intruders, were the most suggested security solutions for VANET. Unfortunately, existing cooperative IDSs (CIDSs) are vulnerable to the legitimate yet compromised collaborators that share misleading and manipulated information and disrupt the IDSs’ normal operation. As such, this paper proposes a misbehavior-aware on-demand collaborative intrusion detection system (MA-CIDS) based on the concept of distributed ensemble learning. That is, vehicles individually use the random forest algorithm to train local IDS classifiers and share their locally trained classifiers on-demand with the vehicles in their vicinity, which reduces the communication overhead. Once received, the performance of the classifiers is evaluated using the local testing dataset in the receiving vehicle. The evaluation values are used as a trustworthiness factor and used to rank the received classifiers. The classifiers that deviate much from the box-and-whisker plot lower boundary are excluded from the set of the collaborators. Then, each vehicle constructs an ensemble of weighted random forest-based classifiers that encompasses the locally and remotely trained classifiers. The outputs of the classifiers are aggregated using a robust weighted voting scheme. Extensive simulations were conducted utilizing the network security laboratory-knowledge discovery data mining (NSL-KDD) dataset to evaluate the performance of the proposed MA-CIDS model. The obtained results show that MA-CIDS performs better than the other existing models in terms of effectiveness and efficiency for VANET.

Penalty Based Reliable Cooperative Intrusion Detection System for Mobile Adhoc Network Environment

Intrusion detection is the process of finding the malicious behaviour happening in the network to enhance the network performance. This is the most focused research by various researchers to ensure the secured network to the users for increasing their satisfaction level. This is achieved in the previous work by introducing the method namely Cooperative intrusion detection system (CIDS). However this research method doesn’t focus on selfish node presence which might affect the overall intrusion detection process. There is a chance of that monitoring node also can act as selfish node. This is resolved in the proposed work by introducing the method namely Penalty based Reliable Cooperative Intrusion Detection System (PR-CIDS). In this work, initially monitoring nodes are selected optimally by using modified artificial bee colony algorithm through which intrusion detection will be performed. Here intrusion detection is performed based on variation in the forwarded traffic. In order to avoid the selfish node presence, in this work unique secret keys are generated for each monitoring node by using which intrusion decision will be encrypted and then send to the third party node. Here third party node will authenticate the node and then will utilize the intrusion information to make the final decision. Third party node plays more important role in making the intrusion decision. Thus the most suitable third party node is selected by using Hybrid Ant colony with Genetic method. Based on this decision, penalty will be assigned to the selfish monitoring nodes. The overall evaluation of the research work is done in the NS2 simulation environment to prove their performance improvement.

Multi-cloud cooperative intrusion detection system: trust and fairness assurance

The sophistication of the recent cloud computing systems has made them more vulnerable to intelligent cyber attacks. Moreover, it is becoming very difficult for a single intrusion detection system (IDS) to detect all existing attacks, due to limited knowledge about such attacks’ patterns and implications. Recent works in cloud security have shown that cooperation among cloud-based IDSs can enhance their accuracy. However, there are two main challenges associated with the existing cooperative IDSs, which are related to trust and fairness assurance. To tackle these challenges, we propose in this paper a cooperative cloud-based IDS framework that (1) enables IDSs to distributively form trustworthy IDSs communities by advancing a trust-based hedonic coalitional game, which allows IDSs to increase their individual detection accuracy in the presence of untrusted IDSs and (2) formulates a fairness assurance mechanism as a Stackelberg game between the well-behaving IDSs and the selfish ones that frequently send consultation requests to other IDSs, and at the same do not answer other IDSs’ consultation requests. Experimental results show the effectiveness of the proposed approach in terms of enhancing the accuracy of detection and achieving the fairness among IDSs in terms of benefits obtained through cooperation.

Modeling an Intrusion Detection System Based on Adaptive Immunology

Network security has always has been an area of priority and extensive research. Recent years have seen a considerable growth in experimenting with biologically inspired techniques. This is a consequence of the authors increased understanding of living systems and the application of that understanding to machines and software. The mounting complexity of telecommunications networks and the need for increasing levels of security have been the driving factors. The human body can act as a great role model for its unique abilities in protecting itself from external entities owing to its diverse complexities. Many abnormalities in the human body are similar to that of the attacks in wireless sensor networks (WSN). This article presents the basic ideas that can help modelling a system to counter the attacks on a WSN by monitoring parameters such as energy, frequency of data transfer, data sent and received. This is implemented by exploiting an immune concept called danger theory, which aggregates the anomalies based on the weights of the anomalous parameters. The objective is to design a cooperative intrusion detection system (IDS) based on danger theory.

A deep learning approach for proactive multi-cloud cooperative intrusion detection system

Abstract The last few years have witnessed the ability of cooperative cloud-based Intrusion Detection Systems (IDS) in detecting sophisticated and unknown attacks associated with the complex architecture of the Cloud. In a cooperative setting, an IDS can consult other IDSs about suspicious intrusions and make a decision using an aggregation algorithm. However, undesired delays arise from applying aggregation algorithms and also from waiting to receive feedback from consulted IDSs. These limitations render the decisions generated by existing cooperative IDS approaches ineffective in real-time, hence making them unsustainable. To face these challenges, we propose a machine learning-based cooperative IDS that efficiently exploits the historical feedback data to provide the ability of proactive decision making. Specifically, the proposed model is based on a Denoising Autoencoder (DA), which is used as a building block to construct a deep neural network. The power of DA lies in its ability to learn how to reconstruct IDSs’ feedback from partial feedback. This allows us to proactively make decisions about suspicious intrusions even in the absence of complete feedback from the IDSs. The proposed model was implemented in GPU-enabled TensorFlow and evaluated using a real-life dataset. Experimental results show that our model can achieve detection accuracy up to 95%.

Real Medical Data Processing and Prediction of Early Disease Using Sensors, Internet of Things (IoT) and R Programming Techniques

With the recognition of wearable devices, along with the development of clouds and cloudlet technology, there has been increasing got to give higher treatment. The process chain of medical knowledge chiefly includes knowledge assortment, data storage and knowledge sharing, etc. ancient tending system often needs the delivery of medical knowledge to the cloud, which involves users sensitive info and causes communication energy consumption much, medical knowledge sharing could be a vital and difficult issue therefore during this paper, we tend to build up a completely unique healthcare system by utilizing the exibility of cloudlet. The functions of cloudlet embody privacy protection, knowledge sharing and intrusion detection within the stage of information assortment, we RST utilize range Theory analysis Unit (NTRU) methodology to encrypt users body knowledge collected by wearable devices. Firstly, those data are going to be transmitted to close cloudlet in AN energy efficient fashion. Secondly, we tend to gift a replacement trust model to assist users to select trustable partners UN agency need to share hold on knowledge in the cloudlet. The trust model conjointly helps similar patients to communicate with one another concerning their diseases. Thirdly, we divide users medical knowledge hold on in remote cloud of hospital into 3 elements, and provides them correct protection. Finally, in order to guard the tending system from malicious attacks, we develop a completely unique cooperative intrusion detection system (IDS) method supported cloudlet mesh, which may effectively forestall the remote tending massive knowledge cloud from attacks. Our experiments demonstrate the effectiveness of the projected theme. Index terms privacy protection, knowledge sharing, cooperative intrusion detection system (IDS), healthcare.

Towards Secure & Green Advanced Metering Infrastructure (AMI)

ABSTRACT This paper deals with the design issues of a secure and green Advanced Metering Infrastructure (AMI). The first part of the paper suggests enhancing the reliability of AMI system using wireless ad hoc Network technology. The suggested Advanced Metering Infrastructure consists of various types of wireless nodes we called Green Wireless Router (GWR). Here, we propose that GWRs can harvest the energy needed for its work from the surrounding environment, especially solar energy. Such suggestion permits to install GWRs in any place without considering the power supply availability and hence, extensive area is covered by the AMI. The different network traffic patterns generated from running a customized AMI simulation model were used in an experimental network based mainly on UBICOM IP2022 network processor platform (as the implementation of the intended GWR)with the aim of measuring its power consumption under different realistic circumstances. In order to decrease the power consumption of the suggested GWR and to extend the life time of the batteries, a two power management schemes we called Controlled Duty Cycling(CDC) and Event Driven Duty Cycling were suggested and implemented. The second part of the paper suggests a GWR security model to protect it against different internal and external threats. The suggested GWR security model must respond to many objectives, it should ensure that the administrative information exchanged is correct and undiscoverable (information authenticity and privacy), the source is who he claims to be (message integrity and source authentication) and the system is robust and available (using Cooperative Intrusion Detection System).

Multilayer Intrusion Detection in MANET

Intrusion detection system plays a major role in Mobile Adhoc Network (MANET). There are lots of attacks in MANET due to its vulnerabilities. Many Intrusion Detection System (IDS) like standalone IDS, Hierarchical IDS, Distributed IDS, Cooperative IDS are available in MANET but still suffers due to multilayer attacks such as (Denial of Service) DOS attack. In this paper we have proposed a Multilayer Intrusion detection to detect intrusions in MANET. We have used fixed clustering algorithm for detecting the intrusions. We have done experiments on multiple layer ids and single layer ids and found multiple layer ids can detect intrusions better than single layer ids. General Terms Security, Fixed Clustering Algorithm

On the optimality of cooperative intrusion detection for resource constrained wireless networks

The problem of cooperative intrusion detection in battery-powered wireless mesh and sensor networks is challenging, primarily because of the limited resources available to participating nodes. Although the problem has received some attention from the research community, little is known about the tradeoffs among different objectives, such as high network performance, low power consumption, low delay in information collection and high security effectiveness. This article proposes, to the best of our knowledge for the first time, cooperative intrusion detection functions that take into account multiple objectives simultaneously. We formulate the problem of identifying the type of intrusion detection function each node runs, as a multi-objective optimization problem, and propose solutions based on genetic algorithms. Through extensive simulations we demonstrate that our solutions are scalable to large networks, and are characterized by a small variance in the normalized fitness value of individual/single objectives and by a small attack detection/reporting delay. In a real implementation/evaluation we demonstrate that our cooperative intrusion detection system achieves a higher detection rate (93%) than state of art solutions.

Co-operative IDS Architectures for MANETs - A Survey

are many IDSs (Intrusion Detection System) which are working on wired networks, but for MANETs we do not find any single application that can be applied directly. Different characteristics of MANET make the conventional IDSs ineffective and inefficient for the wireless environment. MANET is a combination of nodes with limited power, bandwidth and processing capability. In MANETs, an intrusion detection task performed by a single node reduces power level drastically in no time. Because of power constraints, we have to distribute the task among several nodes so that we can uphold the power level of legitimated nodes. In this paper we evaluate different performance parameters of distributed and cooperative IDSs and we also try to figure out which parameters are detracting, such as accuracy ratio, false positive and false negative detection ratio, node mobility, type of threat model and the complexity of the algorithm etc.

Co-operative Wireless Intrusion Detection System Using MIBs From SNMP

In emerging technology of Internet, security issues are becoming more challenging. In case of wired LAN it is somewhat in control, but in case of wireless networks due to exponential growth in attacks, it has made difficult to detect such security loopholes. Wireless network security is being addressed using firewalls, encryption techniques and wired IDS (Intrusion Detection System) methods. But the approaches which were used in wired network were not successful in producing effective results for wireless networks. It is so because of features of wireless network such as open medium, dynamic changing topology, cooperative algorithms, lack of centralized monitoring and management point, and lack of a clear line of defense etc. So, there is need for new approach which will efficiently detect intrusion in wireless network. Efficiency can be achieved by implementing distributive, co-operative based, multi-agent IDS. The proposed system supports all these three features. It includes mobile agents for intrusion detection which uses SNMP (Simple network Management Protocol) and MIB (Management Information Base) variables for mobile wireless networks.

A Co-Operative Intrusion Detection System in Mobile Ad-Hoc Network

ad-hoc networking has become an exciting and important technology in recent year because of the rapid proliferation of wireless devices. The security of data becomes more important with the increased use of commercial application over wireless network environments; there were several problems of security in wireless networks due to different types of attack and intruders. There were better methods an intruding handling procedure available for fixed networks. But it was difficult to analyze attacks in the mobile ad-hoc environments. The reason is that there is no central point to control all the activities in the network and dynamically changing network topology and behavior and limited power level of mobile devices. Attacks by intruders cause unauthorized use of wireless network so that the whole network will be suffered from packet loses. We are introducing three types of internal attack named as Node isolation, route disruption, Resource consumption; we presented an approach to handle such type of internal attacks for wireless network. We report our progress in developing intrusion detection capabilities for MANET. The proposed work can be performed by modifying ad-hoc on demand distance vector routing protocol. The simulation experiments are conducted on NS-2 environment in Linux platform.

Distributed and cooperative multi-agent based intrusion detection system

One of the primary challenges in intrusion detection is modeling typical application behavior, so that we can recognize attacks by their atypical effects without raising too many false alarms. IDS implemented using mobile agents is one of the new paradigms for intrusion detection. In this paper, we have proposed an effective intrusion detection system in which local agent collects data from its own system and it classifies anomaly behaviors using SVM classifier. Each local agent is capable of removing the host system from the network on successful detection of attacks. The mobile agent gathers information from the local agent before it allows the system to send data. Our system identifies successful attacks from the anomaly behaviors. Experimental results show that the proposed system has high detection rate and low false alarm rate which encourages the proposed system.

Intrusion detection and tolerance: A global scheme

AbstractProtecting implemented security mechanisms and trusting their output (e.g. log files) when the host, under which they are deployed, is compromised, is among the major challenges that have to be faced. To fulfil this need, recent advances in security have considered the design of storage‐based intrusion detection system, which detect intrusions by looking at the low‐level disk requests patterns. However, these systems neither tolerate intrusions, nor do they distinguish whether the disk requests are generated by legitimate or malicious processes; and consequently, they generate a lot of false negative and positive alerts. In this paper, we present a Cooperative Intrusion Detection and Tolerance System, called CIDTS, which takes advantage of the information that are available at the network, host operating system, and storage level to better detect intrusion attempts in their early stages, even when the host is compromised. To allow cooperation, the disk communication interface that transports requests between the storage level and the host level is extended to forward information about the processes that generate the request. The paper also provides intrusion tolerance capabilities and provides techniques to support investigation activities. Copyright © 2007 John Wiley & Sons, Ltd.

Balancing cooperation and risk in intrusion detection

Early systems for networked intrusion detection (or, more generally, intrusion or misuse management) required either a centralized architecture or a centralized decision-making point, even when the data gathering was distributed. More recently, researchers have developed far more decentralized intrusion detection systems using a variety of techniques. Such systems often rely upon data sharing between sites which do not have a common administrator and therefore cooperation will be required in order to detect and respond to security incidents. It has therefore become important to address cooperation and data sharing in a formal manner. In this paper, we discuss the detection of distributed attacks across cooperating enterprises. We begin by defining relationships between cooperative hosts, then use the take-grant model to identify both when a host could identify a widespread attack and when that host is at increased risk due to data sharing. We further refine our definition of potential identification using access, integrity, and cooperation policies which limit sharing. Finally, we include a brief description of both a simple Prolog model encorporating data sharing policies and a prototype cooperative intrusion detection system.

A large scale distributed intrusion detection framework based on attack strategy analysis

This paper describes a large-scale distributed intrusion detection (ID) architecture based on intrusion detection system (IDS) agents and collaborative attack strategy analysis. This architecture couples distributed IDS agents performing local event analysis with cooperative global ID. Other agent-based approaches have highlighted several advantages over monolithic architectures. This approach specifically focuses on cooperative IDS agents working together by analyzing the intruder’s attack strategy and separating local event processing from global analysis. We believe that focusing on the intruder's intent (attack strategy) provides a theme that will help distributed IDS to work together. Furthermore, strategy analysis creates an opportunity for IDS agents to pro-actively look ahead for data most pertinent to current case development. This look ahead adaptive auditing behavior focuses limited system resources on collecting and auditing those events which are most likely to reveal intrusions.