Intrusion Detection Research Articles

Blockchain and Cybersecurity: A dual approach to securing financial transactions in Fintech

The rapid growth of the fintech industry has led to an increased reliance on digital financial transactions, which simultaneously presents significant cybersecurity risks. This abstract explores the potential of combining blockchain technology with advanced cybersecurity protocols to create a dual-layered approach to securing financial transactions and protecting customer data in fintech applications. Blockchain, with its decentralized and immutable nature, offers inherent security benefits, making it an ideal foundation for enhancing the integrity of financial transactions. Each transaction recorded on a blockchain is cryptographically secured, ensuring that data cannot be altered retroactively, thus preventing fraud and unauthorized access. However, while blockchain technology provides a robust mechanism for securing transaction data, it is not immune to all forms of cyber threats, particularly those targeting the endpoints or vulnerabilities in smart contracts. Advanced cybersecurity protocols, such as encryption, multi-factor authentication, and intrusion detection systems, complement blockchain’s capabilities by safeguarding the broader fintech ecosystem. These protocols can be used to secure access points, ensure data privacy, and enhance the detection of malicious activities that might bypass blockchain’s security features. The integration of blockchain with cybersecurity measures creates a multi-layered defense system that not only protects transaction integrity but also mitigates risks associated with data breaches, phishing attacks, and insider threats. For example, encryption techniques can ensure that sensitive customer data remains confidential, while blockchain ensures the immutability of transaction records. Furthermore, smart contract security protocols can prevent vulnerabilities in decentralized finance (DeFi) applications from being exploited by malicious actors. By combining these two technologies, fintech companies can significantly enhance the security of financial transactions, improve customer trust, and ensure compliance with regulatory standards. This dual approach strengthens the resilience of fintech platforms against evolving cyber threats and enhances the overall security posture of the industry. Keywords: Blockchain, Cybersecurity, Fintech, Financial Transactions, Data Integrity, Encryption, Smart Contracts, Decentralized Finance, Multi-Layered Security, Fraud Prevention.

Modified CNN Model for Network Intrusion Detection and Classification System Using Local Outlier Factor-based Recursive Feature Elimination

An intrusion detection system (IDS) is either a part of a software or hardware environment that monitors data and analyses it to identify any attacks made against a system or a network. Traditional IDS approaches make the system more complicated and less efficient, because the analytical properties process is difficult and time-consuming. This is because the procedure is complex. Therefore, this research work focuses on a network intrusion detection and classification (NIDCS) system using a modified convolutional neural network (MCNN) with recursive feature elimination (RFE). Initially, the dataset is balanced with the help of the local outlier factor (LOF), which finds anomalies and outliers by comparing the amount of deviation that a single data point has with the amount of deviation that its neighbors have. Then, a feature extraction selection approach named RFE is applied to eliminate the weakest features until the desired number of features is achieved. Finally, the optimal features are trained with the MCNN classifier, which classifies intrusions like probe, denial-of-service (DoS), remote-to-user (R2U), user-to-root (U2R), and identifies normal data. The proposed NIDCS system resulted in higher performance with 99.3% accuracy and a 3.02 false alarm rate (FAR) as equated to state-of-the-art NIDCS approaches such as deep neural networks (DNN), ResNet, and gravitational search algorithms (GSA).

IDOL: IoT based intrusion detection using Conv- BiLSTM

ABSTRACT Internet of Things (IoT) networks have produced copious amounts of data that can be used to identify intrusions. Network Intrusion Detection Systems are crucial for spotting attacks before they cause any damage as part of a layered defence strategy. In this paper, a novel Intrusion Detection using Optimized deep Learning (IDOL) has been proposed to detect the intrusions like DDoS attacks, Botnet attacks, Convergence attacks, and Ransomware attacks. Initially the IXIA PerfectStorm tool display data with malicious attack from the Network Environment and the data are converted in the data Pre-Processing method. Then the needed data are extracted in the feature extraction process by using BoW technique. From the Extracted data the Feature selection process will select the essential data using Ant Colony Optimization. Finally, the Conv-BiLSTM model will classify the attack into four classes namely DDoS attack, Botnet attack, Convergence attack, and Ransomware attack. The proposed IDOL method achieves the highest accuracy rate of 98.93%. Using the UNSW-NB15 and NSL-KDD datasets, the suggested model achieves an accuracy rate of 98.92% and 98.94% which is greater than the existing techniques such as ML-IMID, IDS-SLoEL, and POS-LightGRM respectively.

A hybrid machine learning model for intrusion detection in wireless sensor networks leveraging data balancing and dimensionality reduction

Intrusion detection systems are essential for securing wireless sensor networks (WSNs) and Internet of Things (IoT) environments against various threats. This study presents a novel hybrid machine learning (ML) model that integrates KMeans-SMOTE (KMS) for data balancing and principal component analysis (PCA) for dimensionality reduction, evaluated using the WSN-DS and TON-IoT datasets. The model employs classifiers such as Decision Tree Classifier, Random Forest Classifier (RFC), and gradient boosting techniques like XGBoost (XGBC) to enhance detection accuracy and efficiency. The proposed hybrid (KMS + PCA + RFC) approach achieves remarkable performance, with an accuracy of 99.94% and an f1-score of 99.94% on the WSN-DS dataset. For the TON-IoT dataset, it achieves 99.97% accuracy and an f1-score of 99.97%, outperforming traditional SMOTE TomekLink and Generative Adversarial Network-based data balancing techniques. This hybrid approach addresses class imbalance and high-dimensionality challenges, providing scalable and robust intrusion detection. Complexity analysis reveals that the proposed model reduces training and prediction times, making it suitable for real-time applications.

A deep learning framework for Intrusion Detection System in smart grids using Graph Convolutional Network

A deep learning framework for Intrusion Detection System in smart grids using Graph Convolutional Network

Real-Time Farm Surveillance Using IoT and YOLOv8 for Animal Intrusion Detection

This research proposes a ground-breaking technique for protecting agricultural fields against animal invasion, addressing a key challenge in the agriculture industry. The suggested system guarantees real-time intrusion detection and quick reactions by combining cutting-edge sensor technologies, image processing capabilities, and the Internet of Things (IoT), successfully safeguarding crops and reducing agricultural losses. This study involves a thorough examination of five models—Inception, Xception, VGG16, AlexNet, and YoloV8—against three different datasets. The YoloV8 model emerged as the most promising, with exceptional accuracy and precision, exceeding 99% in both categories. Following that, the YoloV8 model’s performance was compared to previous study findings, confirming its excellent capabilities in terms of intrusion detection in agricultural settings. Using the capabilities of the YoloV8 model, an IoT device was designed to provide real-time intrusion alarms on farms. The ESP32cam module was used to build this gadget, which smoothly integrated this cutting-edge model to enable efficient farm security measures. The incorporation of this technology has the potential to transform farm monitoring by providing farmers with timely, actionable knowledge to prevent possible threats and protect agricultural production.

AccFIT-IDS: accuracy-based feature inclusion technique for intrusion detection system

In today’s digital landscape, maintaining security has become increasingly difficult. Many organizations implement security mechanisms to protect their valuable resources from potential threats. One such mechanism is the Intrusion Detection System (IDS), which examines network traffic to identify and prevent attack. However, the vast amount of network data requires an efficient processing approach. Among various studies from existing literature, Machine Learning (ML) algorithms provide a viable solution to detecting intrusion in voluminous data. ML based IDS still faces challenges, particularly due to high-dimensional data complexity, which affects the performance. To address this, the study proposed AccFIT (Accuracy-based Feature Inclusion Technique) for IDS, combining two-stage Feature Selection Algorithms (FSA). In stage 1, various filter-based feature selection methods are applied extract features from intial dataset. The derived features are concatenated and redundant features are excluded to produce an intermediary feature subset (Fintemediary). In stage 2, the Fintemediary is fed to a wrapper-based selection algorithm to derive an optimal subset Foptimal. Features are included or excluded based on their impact on model accuracy. The proposed AccFIT-IDS achieves 99.86% accuracy, with precision, recall and F1-score of 99.81%, 99.92% and 99.86%, respectively, and a false alarm rate of 0.0021, demonstrating its effectiveness.

Optimization of Intrusion Detection System with Machine Learning for Detecting Distributed Attacks on Server

This study develops an intrusion detection system optimized with machine learning techniques for efficient and effective detection of Distributed Denial-of-Service (DDoS) attacks. Using the Decision Tree algorithm, the system is designed to maximise accuracy in the identification and classification of DDoS attacks. The CIC-DDoS2019 dataset, which consists of various comprehensive simulated attack scenarios, is used as the basis for training and validation, providing the model with robust capabilities in recognizing DDoS attacks with high accuracy. This IDS successfully achieved a 100% detection rate, which is a significant result in the network security environment. The system is integrated into the existing network infrastructure, monitoring data flows in real-time and performing predictive analysis to detect early indications of attacks. Each attack detection immediately triggers a notification sent via a Telegram bot, ensuring that the security team can react quickly to isolate and address the attack. These notifications include details such as the source, type of attack, detection time, and involved protocol information, enabling more informed and strategic response actions. The use of Telegram bots for real-time communication not only enhances the speed of response to threats but also supports system scalability by facilitating adjustments and integration across various operational scenarios. The system's quick detection and response is a big step forward for machine learning-based intrusion detection systems (IDS). It provides opportunities for further research and practical applications that can adapt to various digital security scenarios.

A Comparative Study of Machine Learning and Deep Learning Approaches for Enhancing Intrusion Detection in IOT Environments

With the increasing deployment of IOT and Edge Cloud environments, ensuring the security of these systems against cyber-attacks bas become a critical challenge. Traditional intrusion detection systems (IDS) often fall short in addressing the complexity and scale of attacks in such heterogeneous environments. This paper aims to explore machine learning (ML) and deep learning (DL) techniques for efficient attack detection in IOT environments, with a focus on evaluating the performance of various models. The objective was to analyses the effectiveness of model, i.e., XGBoost (XGB) in identifying attacks using the TON-IoT dataset. The findings showed that XGB achieved an accuracy of 95.04%. The paper concludes that advanced ML and DL models, especially ensemble methods, offer significant improvements in intrusion detection. The novelty of this work lies in comparing various state-of-the-art approaches on a insights for enhancing security in Edge Cloud environments.

An Intelligent Intrusion Detection System for VANETs Using Adaptive Fusion Models

Vehicular Ad Hoc Networks (VANETs) play a vital role in the development of Cyber-Physical Systems (CPS) to enable real-time communication for improving road safety and traffic efficiency. Due to the VANETs' decentralized and dynamic nature, they are prone to various types of cyber-attacks, including intrusion, spoofing, and denial-of-service (DoS) attacks. This article presents an Adaptive Fusion Intrusion Detection Model (AFIDM), a multi-level framework that uses machine learning techniques, such as Random Forest, XGBoost, Decision Trees, and K-Nearest Neighbor (KNN), to deal with such vulnerabilities. AFIDM also employs a dynamic weight adjusting mechanism and an adaptive feedback loop to adapt to the evolving threats and achieve better detection accuracy. AFIDM achieved 98.7% accuracy, 96.5% precision, and recall of 95.8% on the VeReMi dataset used for training and validation and outperformed other baseline models. With low latency and scalability, the proposed model presents a robust solution for real-time intrusion detection in VANETs for the secure and efficient operation of intelligent transportation systems

An Enhanced LSTM Approach for Detecting IoT-Based DDoS Attacks Using Honeypot Data

One of the widening perils in network security is the Distributed Denial of Service (DDoS) attacks on the Internet of Things (IoT) ecosystem. This paper presents an enhanced Intrusion Detection System (IDS) through the proposal of an enhanced version of the long short-term memory (LSTM) model to detect DDoS attacks using honeypot-generated data. The proposed model aggregates the Conv1D, Bidirectional Long Short-Term Memory (Bi-LSTM), Bidirectional Gated Recurrent Unit (Bi-GRU), and dropout layers to extract temporal and spatial features from IoT traffic effectively. We tested the efficacy of the proposed system on a real-world IoT-DH dataset, which showed a remarkable accuracy of 99.41%, with an AUC score of 0.9999. A comparative analysis with other baseline models, such as LSTM, Bidirectional LSTM (Bi-LSTM), Gated Recurrent Unit (GRU), Recurrent Neural Network (RNN), Feedforward Neural Network (FNN), and Temporal Convolutional Network (TCN), proved that enhanced LSTM outperformed the other models. This indicates the robustness of the proposed model in correctly detecting DDoS attacks with high generalization capability for unseen traffic data. The contribution of this paper will be an addition to the deep learning techniques applied for the solution of intrusion detection systems (IDS), which will also allow the building and implementation of more efficient security mechanisms in IoT environments.

Development of Hybrid Intrusion Detection System Leveraging Ensemble Stacked Feature Selectors and Learning Classifiers to Mitigate the DoS Attacks

Development of Hybrid Intrusion Detection System Leveraging Ensemble Stacked Feature Selectors and Learning Classifiers to Mitigate the DoS Attacks

Securing fog computing in healthcare with a zero-trust approach and blockchain

As healthcare systems increasingly adopt fog computing to improve responsiveness and real-time data processing at the edge, significant security challenges emerge due to the decentralized architecture. The traditional perimeter-based security models are inadequate for addressing the dynamic and distributed nature of fog networks, leaving them vulnerable to unauthorized access, data tampering, and latency issues. Therefore, this paper proposes a novel security framework that integrates blockchain (BC) and software-defined network (SDN) technologies, underpinned by zero-trust (ZT) principles, to address these challenges in latency-sensitive healthcare environments. The proposed framework enhances security by combining BC’s immutable transaction logs for data integrity and traceability with SDN’s dynamic network reconfiguration for real-time access control and anomaly detection. The integration of BC and SDN supports continuous authentication and monitoring using cryptographic protocols (SHA-256A and RSA-2048) to secure data transmission. Additionally, tasks are dynamically allocated to fog nodes based on a multi-metric scheduling mechanism that considers fog node capacity, proximity, and compliance with predefined security protocols. The framework was evaluated using iFogSim, simulating a healthcare environment with 50 IoT devices, 10 fog nodes, and varying workloads (100–1000 tasks/min). The key evaluation performance metrics include intrusion detection rate (IDR), data integrity (DI), task completion rate (TCR), average task response time (ART), and average block time. The implementation results demonstrate satisfactory improvements compared to existing models: a 40% increase in IDR, a 30% enhancement in DI, a 15.29% rise in TCR, and a 39.66% reduction in ART. Moreover, the baseline IDR (85%) and DI (70%) were drawn from ZT-1, while TCR (85%) and ART (300 ms) were measured using ZT-2 as benchmarks. These findings illustrate the feasibility of integrating BC, SDN, and ZT principles to mitigate threats such as unauthorized access, data tampering, and delays in latency-sensitive tasks.

Optimized DenseNet Architecture for Efficient Classification of Encrypted Internet Traffic

The increasing reliance on Internet-based services has rendered secure and efficient network traffic classification critical. Conventional methods for categorising traffic, such as port and payload methods, often struggle with the challenges posed by encrypted traffic. Deep learning techniques have emerged as a predominant method for traffic classification given their success in domains such as image recognition, document analysis, and genomics. This research proposes an enhanced DenseNet architecture that leverages deep learning to accurately classify encrypted Internet traffic categories. This approach introduces a compression layer into the DenseNet architecture to address the co-adaptation problem as a result of the information flow and optimise the accuracy of the CNN. An Intrusion detection dataset from the Canadian Institute of Cybersecurity was used to evaluate the architecture. The optimised DenseNet architecture was evaluated using metrics such as precision, recall, accuracy, F1-Score, False Positive Rate and Area under the ROC Curve. Experimental results show that the approach can distinguish various encrypted Internet traffic categories.

Game Model Based Intrusion Detection Method for Probability Distribution Attacks

Game Model Based Intrusion Detection Method for Probability Distribution Attacks

Intelligent network intrusion detection system using optimized deep CNN-LSTM with UNSW-NB15

Intelligent network intrusion detection system using optimized deep CNN-LSTM with UNSW-NB15

Ensemble of feature augmented convolutional neural network and deep autoencoder for efficient detection of network attacks

Network traffic must be monitored and analyzed for any abnormal activity in order to detect intrusions and to notify administrators of any attacks. A novel ensemble of deep learning technique is proposed to enhance the efficiency of Packet Flow Classification in Network Intrusion Detection System (NIDS). The proposed work consists of three phases: (i) Feature Augmented Convolutional Neural Network (FA-CNN) (ii) Deep Autoencoder (iii) Ensemble of FA-CNN and Deep Autoencoder. In FA-CNN, CNN is trained with augmented features selected using Mutual Information. The FA-CNN is ensembled with Deep Autoencoder to design the ensemble of the classifier. To assess the stated ensemble model, numerous experiments are conducted on benchmark datasets like NSL-KDD and CICDS2017. The result findings are compared with the recent methodologies to assess the performance of the stated work. The results indicate that the suggested work performs better than the existing works with the overall accuracy of 97% for NSLKDD and 95% for CICIDS2017 dataset. Also, the proposed method improved the detection rate of minority attack classes like U2R in NSLKDD and Hearbleed in CICIDS2017.

A Review of Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance

In the rapid development of the Internet of Things (IoT) and large-scale distributed networks, Intrusion Detection Systems (IDS) face significant challenges in handling complex spatiotemporal features and addressing data imbalance issues. This article systematically reviews recent advancements in applying deep learning techniques in IDS, focusing on the core challenges of spatiotemporal feature extraction and data imbalance. First, this article analyzes the spatiotemporal dependencies of Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN) in network traffic feature extraction and examines the main methods these models use to solve this problem. Next, the impact of data imbalance on IDS performance is explored, and the effectiveness of various data augmentation and handling techniques, including Generative Adversarial Networks (GANs) and resampling methods, in improving the detection of minority class attacks is assessed. Finally, the paper highlights the current research gaps and proposes future research directions to optimize deep learning models further to enhance the detection capabilities and robustness of IDS in complex network environments. This review provides researchers with a comprehensive perspective, helping them identify the challenges in the current field and laying a foundation for future research efforts.

Enhancing Cloud Data Center Security through Deep Learning: A Comparative Analysis of RNN, CNN, and LSTM Models for Anomaly and Intrusion Detection

Cloud data centers form the backbone of modern digital ecosystems, enabling critical operations for businesses, governments, and individuals around the world. However, their high connectivity and complexity make them prime targets for cyberattacks, leading to service disruptions and data breaches. This paper investigates the use of deep learning techniques, namely Recurrent Neural Networks (RNNs), Convolutional Neural Networks (CNNs), and Long Short-Term Memory (LSTM) networks, to enhance cloud data center security. By employing these models for anomaly detection and intrusion prevention, the study performs a comparative analysis. The results indicate that the LSTMs achieved the highest ROC AUC score (0.90), demonstrating better detection of persistent threats. These findings highlight the potential of deep learning to revolutionize cloud security by providing scalable, accurate, and proactive measures against evolving cyber threats.

DTXG-RF-based Intrusion Detection System for Artificial IoT Cyber Attacks

The swift advancement of networking technology and the rising incidence of cyber-attacks have made effective cybersecurity a critical priority. The primary concern with IoT networks is their susceptibility to vulnerabilities. IoT security necessitates the substantial involvement of artificial intelligence as a security technology to mitigate these challenges. Cyberattacks are evolving in sophistication, consequently posing greater obstacles in the precise detection of intrusions. An Intrusion Detection System (IDS) is a device or software application that monitors the activities of network systems for malicious actions or policy breaches and produces reports. The primary objective of an IDS is to efficiently identify attacks. Moreover, it is imperative to identify attacks at an early stage to mitigate their effects. Machine learning models have become increasingly popular in IDSs due to their capacity to process substantial data volumes and identify patterns in real time. Machine learning involves building an algorithm to identify consistent patterns within a dataset. This study aimed to build an IDS using an ensemble machine learning (DTXG-RF) model and compare it with DT, XGBoost, KNN, RF, NB, and CatBoost on the CIC-IoT-2023 and a Ransomware dataset. The results showed that the proposed DTXG-RF outperformed other machine learning models with accuracy reaching 95.06%.