Deep Learning-based Intrusion Detection System Research Articles

Differential evolution-based convolutional neural networks: An automatic architecture design method for intrusion detection in industrial control systems

Industrial control systems (ICSs) are facing serious and evolving security threats because of a variety of malicious attacks. Deep learning-based intrusion detection systems (IDSs) have been widely considered as one of promising security solutions for ICSs, but these deep neural networks for IDSs in ICSs have been designed manually, which are extremely dependent on expert experience with numerous model parameters. This paper makes the first attempt to develop an automatic architecture design method of convolutional neural networks (CNNs) based on differential evolution (abbreviated as DE-CNN) for the intrusion detection issue in ICSs. The first phase of the proposed DE-CNN is the off-line architecture optimization of the CNNs constructed by three basic units such as ResNetBlockUnit, DenseNetBlockUnit, and PoolingUnit, including encoding the architecture parameters of a CNN as a population, evaluating the fitness of the population by the validation accuracy and the number of CNN model parameters, implementing the evolutionary process including mutation and crossover operations, and selecting the best individual from the population. Then, the optimal CNN model obtained by the off-line optimization of DE-CNN is deployed for the online IDSs. The experimental results on two intrusion detection datasets in ICSs including SWaT and WADI have demonstrated the superiority of the proposed DE-CNN to the state-of-the-art manually-designed and neuroevolution-based methods under both unsupervised and supervised learning in terms of Precision, Recall, F1-Score and the number of the CNN model parameters.

An Effective Deep Learning Based Multi-Class Classification of DoS and DDoS Attack Detection

In the past few years, cybersecurity is becoming very important due to the rise in internet users. The internet attacks such as Denial of service (DoS) and Distributed Denial of Service (DDoS) attacks severely harm a website or server and make them unavailable to other users. Network Monitoring and control systems have found it challenging to identify the many classes of DoS and DDoS attacks since each operates uniquely. Hence a powerful technique is required for attack detection. Traditional machine learning techniques are inefficient in handling extensive network data and cannot extract high-level features for attack detection. Therefore, an effective deep learning-based intrusion detection system is developed in this paper for DoS and DDoS attack classification. This model includes various phases and starts with the Deep Convolutional Generative Adversarial Networks (DCGAN) based technique to address the class imbalance issue in the dataset. Then a deep learning algorithm based on ResNet-50 extracts the critical features for each class in the dataset. After that, an optimized AlexNet-based classifier is implemented for detecting the attacks separately, and the essential parameters of the classifier are optimized using the Atom search optimization algorithm. The proposed approach was evaluated on benchmark datasets, CCIDS2019 and UNSW-NB15, using key classification metrics and achieved 99.37% accuracy for the UNSW-NB15 dataset and 99.33% for the CICIDS2019 dataset. The investigational results demonstrate that the suggested approach performs superior to other competitive techniques in identifying DoS and DDoS attacks.

Blockchain-Assisted Hybrid Harris Hawks Optimization Based Deep DDoS Attack Detection in the IoT Environment

The Internet of Things (IoT) is developing as a novel phenomenon that is applied in the growth of several crucial applications. However, these applications continue to function on a centralized storage structure, which leads to several major problems, such as security, privacy, and a single point of failure. In recent years, blockchain (BC) technology has become a pillar for the progression of IoT-based applications. The BC technique is utilized to resolve the security, privacy, and single point of failure (third-part dependency) issues encountered in IoT applications. Conversely, the distributed denial of service (DDoS) attacks on mining pools revealed the existence of vital fault lines amongst the BC-assisted IoT networks. Therefore, the current study designs a hybrid Harris Hawks with sine cosine and a deep learning-based intrusion detection system (H3SC-DLIDS) for a BC-supported IoT environment. The aim of the presented H3SC-DLIDS approach is to recognize the presence of DDoS attacks in the BC-assisted IoT environment. To enable secure communication in the IoT networks, BC technology is used. The proposed H3SC-DLIDS technique designs a H3SC technique by integrating the concepts of Harris Hawks optimization (HHO) and sine cosine algorithm (SCA) for feature selection. For the intrusion detection process, a long short-term memory auto-encoder (LSTM-AE) model is utilized in this study. Finally, the arithmetic optimization algorithm (AOA) is implemented for hyperparameter tuning of the LSTM-AE technique. The proposed H3SC-DLIDS method was experimentally validated using the BoT-IoT database, and the results indicate the superior performance of the proposed H3SC-DLIDS technique over other existing methods, with a maximum accuracy of 99.05%.

Deep Learning-Based Intrusion Detection System for Internet of Vehicles

The growth of the Internet of Things (IoT) has resulted in several revolutionary applications, such as smart cities, cyber-physical systems, and the Internet of vehicles (IoV). Within the IoV infrastructure, vehicles are comprised of various electronic intelligent sensors or devices used to obtain data and communicate the necessary information with their surroundings. One of the major concerns about the implementation of these sensors or devices is data vulnerability; thus, it is necessary to present a solution that provides security, trust, and privacy to communicating entities and to secure vehicle data from malicious entities. In modern vehicles, the controller area network (CAN) is a fundamental scheme for controlling the interaction among different in-vehicle network sensors. However, not enough security features are present that support data encryption, authorization, and authentication mechanisms to secure the network from cyber or malicious intrusions such as denial of service and fuzzy attacks. An intrusion detection system is presented in this work based on the deep learning architecture to protect the CAN bus in vehicles. The VGG architecture is used and trained for different network intrusion patterns in order to detect malicious attacks. The experiments are performed using the CAN-intrusion-dataset. The experimental findings demonstrate that the presented deep learning system significantly reduces the false positive rate (FPR) compared to the conventional machine learning techniques. The overall accuracy of the system is 96% with FPR of 0.6%.

A hybrid deep learning-based intrusion detection system for IoT networks.

The Internet of Things (IoT) is a rapidly evolving technology with a wide range of potential applications, but the security of IoT networks remains a major concern. The existing system needs improvement in detecting intrusions in IoT networks. Several researchers have focused on intrusion detection systems (IDS) that address only one layer of the three-layered IoT architecture, which limits their effectiveness in detecting attacks across the entire network. To address these limitations, this paper proposes an intelligent IDS for IoT networks based on deep learning algorithms. The proposed model consists of a recurrent neural network and gated recurrent units (RNN-GRU), which can classify attacks across the physical, network, and application layers. The proposed model is trained and tested using the ToN-IoT dataset, specifically collected for a three-layered IoT system, and includes new types of attacks compared to other publicly available datasets. The performance analysis of the proposed model was carried out by a number of evaluation metrics such as accuracy, precision, recall, and F1-measure. Two optimization techniques, Adam and Adamax, were applied in the evaluation process of the model, and the Adam performance was found to be optimal. Moreover, the proposed model was compared with various advanced deep learning (DL) and traditional machine learning (ML) techniques. The results show that the proposed system achieves an accuracy of 99% for network flow datasets and 98% for application layer datasets, demonstrating its superiority over previous IDS models.

Anomaly-Based Intrusion Detection System using One-Dimensional Convolutional Neural Network

As technologies in information and virtualization evolve, the volume of security threats attempting to cause damage to systems grows and becomes more powerful, which highlights the importance of Intrusion Detection Systems (IDS) to have an essential role in network security and help in detecting malicious attacks from network traffic. The most widely used network anomaly detection systems are based on Machine Learning (ML) techniques such as Decision Tree (DT), Support Vector Machine (SVM), and K-nearest Neighbors (KNN). Although IDSs based on ML techniques have achieved promising results and high detection rates, however, it is considered a type of shallow learning that depends mainly on feature engineering and requires large-scale data pre-processing as the size of the dataset grows. To overcome these problems, Deep learning-based IDSs are proposed because they have a better ability to extract features from huge amounts of data. In this research, an IDS model based on one-dimensional Convolution Neutron Network (CNN1D) is proposed that is able to detect anomalies with accuracy of 93.2% and F1-score of 93.1%. Entire NSL-KDD benchmark dataset was used to train this model. Achieved results are then compared to Deep Learning (DL) methods like CNN, LSTM, Recurrent Neural Network (RNN), and others to prove the proposed model's superiority over existing models in literature.

A deep learning-based intrusion detection system for in-vehicle networks

Modern vehicles are increasingly getting connected within the vehicles, with other systems, leading to more concerns about security. Controller area network (CAN) has become a de-facto standard for connecting internal vehicles’ components. However, it lacks security features. Conventional security mechanisms fail to protect in-vehicle networks from attacks, requiring the development of an effective intrusion detection system (IDS). This work develops an IDS for in-vehicle networks called IDS-IVN based on a compact representation of location invariant and time-variant traffic features using deep learning. The IDS-IVN uses convolutional neural and long–short-term memory networks as encoder/decoder functions of autoencoder networks to extract features from raw data and classify them using latent space representation into intrusive and non-intrusive classes. A benchmark real-time ROAD dataset is used to demonstrate the IDS-IVN’s performance compared to the existing methods. IDS-IVN reports 99% accuracy with a 0.32% low false-positive rate for detecting intrusions.

NovelADS: A Novel Anomaly Detection System for Intra-Vehicular Networks

Modern vehicular electronics is a complex system of multiple Electronic Control Units (ECUs) communicating to provide efficient vehicle functioning. These ECUs communicate using the well-known Controller Area Network (CAN) protocol. The increasing amount of research in the Intelligent Transportation System (ITS) domain has demonstrated that this protocol is vulnerable to various types of security attacks, compromising the safety of passengers and pedestrians on the roads. Hence, there is a need to develop novel anomaly detection systems to address this problem. This work presents a novel deep learning-based Intrusion Detection System incorporating thresholding and error reconstruction approaches. We train and explore multiple neural network architectures and compare their performance. The proposed anomaly detection system is tested on four kinds of attacks - Denial of Service (DoS), Fuzzy, RPM Spoofing and Gear Spoofing using evaluation metrics such as Precision, Recall and F1-Score. We also present reconstruction-error distribution plots to give a qualitative intuition about the proposed system’s ability to distinguish between genuine and anomalous sequences.

Combined Ensemble Intrusion Detection Model using Deep learning with Feature Selection for Fog Computing Environments

Decentralized architecture known as fog computing is situated between the cloud and data-producing devices. It acts as a conduit between cloud services and IoT devices. In order to reduce latency, fog computing can handle a significant amount of computation for time-sensitive IoT applications. The Fog layer is simultaneously vulnerable to numerous assaults. To defend the fog nodes from attacks, fog computing paradigms may be suited for deep learning-based intrusion detection systems (IDS). In this paper, a combined Ensemble Intrusion Detection Model using Deep learning with Efficient Feature Selection using Random forests is proposed for Fog Computing Environments by using two deep learning models of traditional CNN and IDS-AlexNet model called Ensemble CNN-IDS with Random Forest and showed this model gives high accuracy of attack detection. The respective model implementations demonstrated on the UNSW-NB15 dataset that consists of 9 classes of attacks namely Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcodes and Worms. The proposed combined Ensemble Intrusion Detection Model using Deep learning with Efficient Feature Selection for intrusions detection is shown to be accurate and efficient by using different classifiers. Our proposed model provides high the accuracy in attack detection of about 97.5% that it outperformed various other traditional and recent models.

ML-DDoSnet: IoT Intrusion Detection Based on Denial-of-Service Attacks Using Machine Learning Methods and NSL-KDD

The Internet of Things (IoT) is a complicated security feature in which datagrams are protected by integrity, confidentiality, and authentication services. The network is protected from external interruptions and intrusions. Because IoT devices run with a range of heterogeneous technologies and process data over time, standard solutions may not be practical. It is necessary to develop intelligent procedures that can be used for multiple levels of data flow in the system. This study examines metainnovations using deep learning-based IDS. Per the findings of the earlier tests, BiLSTMs are better for binary (regular/attacker) classification; however, sequential models (LSTM or BiLSTM) are better for detecting some brutal attacks in multiclass classifiers. According to experts, deep learning-based intrusion detection systems can now recognize and select the best structure for each category. However, specific difficulties will need to be solved in the future. Two topics should be studied further in future attempts. One of the researchers’ concerns is the impact of various data processing techniques, such as artificial intelligence or metamethods, on IDS. The BiLSTM approach has chosen the safest instances with the highest accuracy among the models. According to the findings, the most reliable and suitable solution for evaluating DDoS attacks in IoT is the BiLSTM design.

Ensemble Deep Learning Intrusion Detection Model for Fog Computing Environments

Fog computing is decentralized architecture located between the cloud and devices that produce data. It acts as an intermediate layer between IoT devices and Cloud. Fog computing can perform substantial processing for the time sensitive IoT applications to reduce the latency. At the same time the Fog layer is exposed to various kinds of attacks. Deep learning-based intrusion detection system (IDS) can be suitable for fog computing paradigms for protecting the fog nodes from attacks. In this paper we have proposed a novel ensemble deep learning intrusion detection architecture for fog computing by combining two deep learning models such as traditional CNN and IDS-AlexNet model and showed this model gives high accuracy of attack detection. The respective model implementations were applied on the UNSW-NB15 datasets. By taking full advantage of different classifiers, the proposed deep learning-based multi-model ensemble method is shown to be accurate and effective for intrusion detection. Our proposed model shows that it outperformed various other traditional and recent models.

Adversarial Robust and Explainable Network Intrusion Detection Systems Based on Deep Learning

The ever-evolving cybersecurity environment has given rise to sophisticated adversaries who constantly explore new ways to attack cyberinfrastructure. Recently, the use of deep learning-based intrusion detection systems has been on the rise. This rise is due to deep neural networks (DNN) complexity and efficiency in making anomaly detection activities more accurate. However, the complexity of these models makes them black-box models, as they lack explainability and interpretability. Not only is the DNN perceived as a black-box model, but recent research evidence has also shown that they are vulnerable to adversarial attacks. This paper developed an adversarial robust and explainable network intrusion detection system based on deep learning by applying adversarial training and implementing explainable AI techniques. In our experiments with the NSL-KDD dataset, the PGD adversarial-trained model was a more robust model than DeepFool adversarial-trained and FGSM adversarial-trained models, with a ROC-AUC of 0.87. The FGSM attack did not affect the PGD adversarial-trained model’s ROC-AUC, while the DeepFool attack caused a minimal 9.20% reduction in PGD adversarial-trained model’s ROC-AUC. PGD attack caused a 15.12% reduction in the DeepFool adversarial-trained model’s ROC-AUC and a 12.79% reduction in FGSM trained model’s ROC-AUC.

Towards an effective deep learning-based intrusion detection system in the internet of things

Distributed Sensor Networks play a vital role in the day-to-day world of computing applications, from the cloud to the Internet of Things (IoT). These computing applications devices are normally attached with the microcontrollers like Sensors, actuators, and Adriano network connectivity. Defensive network with an Intrusion Detection System thus serves as the need of modern networks. Despite decades of inevitable development, the Intrusion Detection System is still a challenging research area as the existing Intrusion Detection System operates using signature-based techniques rather than anomaly detection. The existing Intrusion Detection System are thus facing challenges for improvement in Intrusion Detection, Handling heterogeneous data sources is hard for discovering zero-day attacks in IoT networks. This paper presents Filtered Deep Learning Model for Intrusion Detection with a Data Communication approach. The proposed model is composed of five phases: Initialization of Sensor Networks, Cluster Formation in addition to Cluster Head Selection, Connectivity, Attack Detection, and Data Broker. The proposed Model for Intrusion Detection was found to outperform the existing Deep Learning Neural Network and Artificial Neural Network. Experimental results showed a better result of 96.12% accuracy than the dominant algorithms.

A hybrid deep learning based intrusion detection system using spatial-temporal representation of in-vehicle network traffic

A significant increase in the use of electronics control units (ECUs) in modern vehicles has made controller area network (CAN) a de facto standard in the automotive industry. CAN standard has been designed as a reliable and straightforward broadcast-based protocol for providing serial communication between ECUs without considering security aspects like authentication and encryption. Cyber attackers have exploited these vulnerabilities to mount a variety of attacks against CAN-based in-vehicle network. In this work, we proposed a hybrid deep learning-based intrusion detection system (HyDL-IDS) based upon spatial-temporal representation for characterizing in-vehicle network traffic accurately. For this purpose, we use convolutional neural network (CNN) and long short term memory (LSTM) in sequence for extracting spatial and temporal features automatically from in-vehicle network traffic. The proposed HyDL-IDS have been validated using a benchmark car-hacking data set. The reported results demonstrate approximately 100% detection accuracy with a low false alarm rate for different cyber-attacks, including denial-of-service (DoS) attacks, fuzzy attacks and spoofing (Gear and revolutions per minute (RPM)) attacks based on the identified dataset. The HyDL-IDS have significantly improved detection accuracy and false alarm rate for detecting intrusions in-vehicle network compared to other methods, namely Naive Bayes, Decision tree, Multi-layer perceptron, CNN, and LSTM based on spatial-temporal representation of in-vehicle network traffic.

On the Performance of Machine Learning Models for Anomaly-Based Intelligent Intrusion Detection Systems for the Internet of Things

Anomaly-based machine learning-enabled intrusion detection systems (AML-IDSs) show low performance and prediction accuracy while detecting intrusions in the Internet of Things (IoT) than that of deep learning-based intrusion detection systems (DL-IDSs). In particular, AML-IDS that employ low complexity models for IoT, such as the principal component machine (PCA) method and the one-class support vector machine (1-SVM) method, are inefficient in detecting intrusions when compared to DL-IDS with the two-class neural network (2-NN) method. PCA and 1-SVM AML-IDS suffer from low detection rates compared to DL-IDS. The size of the data set and the number of features or variants in the data set may influence how well PCA and 1-SVM AML-IDS perform compared to DL-IDS. We attribute the low performance and prediction accuracy of the AML-IDS model to an imbalanced data set, a low similarity index between the training data and testing data, and the use of a single-learner model. The intrinsic limitations of the single-learner model have a direct impact on the accuracy of an intelligent IDS. Also, the dissimilarity between testing data and training data leads to an increasingly high rate of false positives (FPs) in AML-IDS than DL-IDS, which have low false alarms and high predictability. In this article, we examine the use of optimization techniques to enhance the performance of single-learner AML-IDS, such as PCA and 1-SVM AML-IDS models for building efficient, scalable, and distributed intelligent IDS for detecting intrusions in IoT. We evaluate these AML-IDS models by tuning hyperparameters and ensemble learning optimization techniques using the Microsoft Azure ML Studio (AMLS) platform and two data sets containing malicious and benign IoT and industrial IoT (IIoT) network traffic. Furthermore, we present a comparative analysis of AML-IDS models for IoT regarding their performance and predictability.

Investigation on Intrusion Detection Systems (IDSs) in IoT

In smart environments, comfort and efficiency are important goals in terms of the quality of human life. Recent developments in Internet of Things (IoT) technology have made it possible to design smart environments. IoT-based smart environments are concerned with security and privacy as key issues. Systems based on the IoT pose a security threat to smart environments. In order to prevent IoT-related security attacks which take advantage of some of these security vulnerabilities, intrusion detection systems (IDSs) designed for IoT environments are crucial. Data generated by connected objects in the age of the IoT provides the basis for big data analytics, which could be employed to identify patterns and identifies anomalies in data. In order to detect intrusions, most cyber security systems employ IDSs, which are used by a variety of techniques and architectures. As opposed to signature-based IDS, anomaly-based IDS learns the normal pattern of system behavior and alerts on abnormal events that occur, as opposed to monitoring monitored events against a database of known intrusion experiences. This paper focuses on the IDS implementation on the IoT network. The use of sensor devices to collect data from smart grid environments has led to smart grids becoming the preferred intrusion target due to the IoTs using advanced information technology. Clouds are data storage systems that provide a variety of smart infrastructure services, such as smart homes and smart buildings, over the internet. A deep learning-based intrusion detection system for the Internet of Things requires consideration of key design principles presented in this paper.

FDeep: A Fog-based Intrusion Detection System for Smart Home using Deep Learning

Smart Home is an application of the Internet of Things (IoT) that connects smart appliances and the Internet. The emergence of Smart Home has caused many security and privacy risks that can lead to fatal damages to the user and his property. Unfortunately, Intrusion detection systems designed for conventional networks have shown their inefficiency when deployed in Smart Home environments for many reasons that rely basically on the resources-constrained devices and their inherent intermittent connectivity. So, an intrusion detection system designed for IoT and particularly Smart Home is mandatory. On the other hand, Deep learning shows its potential in enhancing the performance of Intrusion Detection Systems. According to recent studies, Deep learning-based intrusion detection systems are deployed either on the devices or in the Cloud. However, Deep learning models are greedy in terms of resources which makes it challenging to deploy them on Smart Home devices. Besides, in the IoT architecture, the IoT layer is far from the Cloud layer which may cause additional latency and jitter. To overcome these challenges, a new intrusion detection system for Smart Home deployed in the Fog Layer is proposed, it is called FDeep. FDeep will inspect the traffic using a Deep Learning model. To select the most accurate model, three Deep Learning models are trained using an IoT dataset named TON/IIOT, also the proposed models are compared to an existing one. The obtained results show that the long short-term memory model combined with the convolutional neural networks outperforms the other three models. It has the best detection accuracy compared to other Deep Learning models.

Flexible and Robust Real-Time Intrusion Detection Systems to Network Dynamics

Deep learning-based intrusion detection systems have advanced due to their technological innovations such as high accuracy, automation, and scalability, to develop an effective network intrusion detection system (NIDS). However, most of the previous research has focused on model generation through intensive analysis of feature engineering instead of considering real environments. They have limitations to applying the previous methods for a real network environment to detect real-time network attacks. In this paper, we propose a new flexible and robust NIDS based on Recurrent Neural Network (RNN) with a multi-classifier to general a detection model in real-time. The proposed system adaptively and intelligently adjusts the generated model with given system parameters that can be used as security parameters to defend against the attacker’s obfuscation techniques in real-time. In the experimental results, the proposed system demonstrated that the proposed system detects network attacks with a high accuracy and high-speed model upgrade in real-time while showing robustness under an attack.

Towards an Effective Deep Learning-Based Intrusion Detection System in the Internet of Things

Towards an Effective Deep Learning-Based Intrusion Detection System in the Internet of Things

Accelerating the update of a DL-based IDS for IoT using deep transfer learning

<p>Deep learning (DL) models are nowadays broadly applied and have shown outstanding performance in a variety of fields, including our focus topic of "IoTcybersecurity". Deep learning-based intrusion detection system (DL-IDS) models are more fixated and depended on the trained dataset. This poses a problem for these DL-IDS, especially with the known mutation and behavior changes of attacks, which can render them undetected. As a result, the DL-IDShas become outdated. In this work, we present a solution for updating DL-ID Semploying a transfer learning technique that allows us to retrain and fine-tune pre-trained models on small datasets with new attack behaviors. In our experiments, we built CNN-based IDS on the Bot-IoT dataset and updated it on small data from a new dataset named TON-IoT. We obtained promising results in multiple metrics regarding the detection rate and the training between the initial training for the original model and the updated one, in the matter of detecting new attacks behaviors and improving the detection rate for some classes by overcoming the lack of their labeled data.</p>