Distributed Intrusion Detection System Research Articles

Dynamic hierarchical intrusion detection task offloading in IoT edge networks

AbstractThe Internet of Things (IoT) has gained widespread importance in recent time. However, the related issues of security and privacy persist in such IoT networks. Owing to device limitations in terms of computational power and storage, standard protection approaches cannot be deployed. In this article, we propose a lightweight distributed intrusion detection system (IDS) framework, called FCAFE‐BNET (Fog based Context Aware Feature Extraction using BranchyNET). The proposed FCAFE‐BNET approach considers versatile network conditions, such as varying bandwidths and data loads, while allocating inference tasks to cloud/edge resources. FCAFE‐BNET is able to adjust to dynamic network conditions. This can be advantageous for applications with particular quality of service requirements, such as video streaming or real‐time communication, ensuring a steady and reliable performance. Early exit deep neural networks (DNNs) have been employed for faster inference generation at the edge. Often, the weights that the model learns in the initial layer may be sufficiently qualified to perform the required classification tasks. Instead of using subsequent layers of DNNs for generating the inference, we have employed the early‐exit mechanism in the DNNs. Such DNNs help to predict a wide range of testing samples through these early‐exit branches, upon crossing a threshold. This method maintains the confidence values corresponding to the inference. Employing this approach, we achieved a faster inference, with significantly high accuracy. Comparative studies exploit manual feature extraction techniques, that can potentially overlook certain valuable patterns, thus degrading classification performance. The proposed framework converts textual/tabular data into 2‐D images, allowing the DNN model to autonomously learns its own features. This conversion scheme facilitated the identification of various intrusion types, ranging from 5 to 14 different categories. FCAFE‐BNET works for both network‐based and host‐based IDS: NIDS and HIDS. Our experiments demonstrate that, in comparison with recent approaches, FCAFE‐BNET achieves a 39.12%–50.23% reduction in the total inference time on benchmark real‐world datasets, such as: NSL‐KDD, UNSW‐NB 15, ToN_IoT, and ADFA_LD.

Exhaustive distributed intrusion detection system for UAVs attacks detection and security enforcement (E-DIDS)

Distributed intrusion detection systems (DIDS) are a specialized subset of conventional IDSs designed for implementation in distributed environments. Each IDS is integrated into distinct entities within a monitored network, potentially distributed across various locations. These participating IDSs can be configured to detect either a particular or multiple attack types. Although DIDS has found extensive application in diverse IoT systems, its utilization in unmanned aerial vehicles (UAVs) still needs to be explored. Consequently, it is imperative to devise a comprehensive framework tailored explicitly for UAVs. It combines multiple detection units to enhance security. Based on the insights gained from previous studies, we propose an exhaustive DIDS for UAVs security enforcement in this paper. Our proposed solution offers a robust and scalable security approach. Through distributing the workload across interconnected IDSs deployed on the UAV, our solution was optimized for UAVs attacks detection to achieve high detection performance while reducing the complexity. To the best of our insight, there is no recorded DIDS for UAVs security, and attack detection has been proposed and evaluated. Furthermore, our paper provides a detailed analysis, outlining the development basis and the achieved results. We performed multiple experiments over different cases using different datasets. The achieved experimental results demonstrate that the proposed IDS has significantly high accuracy detection and low loss rates. Our proposed E-DIDS efficiently detects multiple attacks on different UAVs subsets with good global accuracy that reached 98.6% and low resource consumption.

A risk-aware and recommender distributed intrusion detection system for home robots

The increasing adoption of home robots, driven by technological advancements and realistic goals, underscores the critical importance of ensuring their security, safety, and privacy. An Intrusion Detection System (IDS) is vital in safeguarding home robots by identifying and responding to potential security threats. However, home robot controllers’ limited computational and energy resources pose challenges. To enhance a home robot’s performance, especially its IDS, one potential solution is to connect it to a home network with a more robust computing infrastructure. Our proposed IDS comprises two components: one resides on a remote PC equipped with substantial computing power, and the other operates directly within the robot controller. By leveraging the remote PC, we achieve enhanced intrusion detection performance and gain valuable recommendations for fine-tuning the intrusion detection component situated in the controller. Simultaneously, it becomes imperative to swiftly identify security threats and prioritize high-risk attacks within the robot controller In this study, we employed machine learning techniques within the IDS. The dataset was generated by simulating robot actions within a home network. Based on our evaluation results, adopting a deep learning model for detecting intrusions in a remote PC and with its recommendations for fine-tuning the intrusion detector in the controller would significantly enhance intrusion detection performance. Additionally, leveraging ensemble learning to identify intrusions in the robot controller component while carefully considering potential risks promises satisfactory outcomes in terms of intrusion detection.

An adaptive distributed intrusion detection system in local network: Hybrid classification methods

In the realm of cybersecurity, the incessant evolution of network attacks necessitates advanced and robust intrusion detection systems (IDS). The major issues with these systems are numerous: false positivenegative alarms, delayed response and detection time, size of processed data, adaptability to future threats, scalability of the system, difficulty in detecting distributed attacks, and downtime (fault tolerance). We propose a system that introduces a distributed framework aimed at enhancing network security by effectively identifying subtle deviations from normal network behavior. This is achieved through transfer learning based on artificial neural networks, and support vector machine (SVM), capitalizing on their complementary strengths in recognizing complex patterns and addressing high-dimensional datasets. To validate the efficacy of the proposed approach, the NSL-KDD dataset is utilized within a distributed IDS architecture. It consists of several intrusion detection nodes representing subnetworks. A node consists of two agents that work collaboratively. A way is proposed to avoid interference between analysis agents: the network agents manager monitors the functioning of the nodes and displays the results of each vulnerability-detecting node in each subnet separately. Such communication between agents should reduce FPAS (false positive alarms) significantly. The Detection engine extracts relevant features of network attacks to solve the problem of SVM in processing huge sizes of data and detect adaptive future threats to detect famous distributed denial of services (DDOS) attacks in real-time. The system is highly scalable by increasing the number of intrusion detection system nodes if necessary. Central processing is avoided to circumvent a system failure situation, where processing and decision-making take place at the detection node level within each subnet.

Fog-Driven Approach for Distributed Intrusion Detection System in Auditing the Data Dased on Blockchain-Cloud Systems

Intrusion detection is a familiar phrase in the information and network security domain. An Intrusion Detection System (IDS) is a device or software that will keep track of the networks, for unlawful movements, and policy breaches that arise within the network. There are different forms of IDS, Host Intrusion Detection System (HIDS) helps in identifying unauthorized activities on the host, Network Intrusion Detection System (NIDS) helps in identifying attacks in the network, whereas Distributed Intrusion Detection System (DIDS) consists of multiple IDS over a large area of network where individual IDS communicates with each other or with the central the authorized central server. The proposed work has a three-layered architecture for DIDS for securing data sharing among different IDS. The bottom layer uses multiple IDS, the fog layer is supported with Blockchain functionality, and the cloud service at the upper layer stores required data permanently for future analysis. The fog computing-based architecture for DIDS tries to implement the application in a scalable and trustless environment using distributed ledger technology. The evaluation of the proposed work is carried out for fog, cloud, and integrated fog-cloud with the Blockchain functionality and without Blockchain functionality in measuring performance metrics related to throughput, service latency, response time, block creation time, and block execution time.

A distributed SDN-based intrusion detection system for IoT using optimized forests.

Along with the expansion of Internet of Things (IoT), the importance of security and intrusion detection in this network also increases, and the need for new and architecture-specific intrusion detection systems (IDS) is felt. In this article, a distributed intrusion detection system based on a software defined networking (SDN) is presented. In this method, the network structure is divided into a set of sub-networks using the SDN architecture, and intrusion detection is performed in each sub-network using a controller node. In order to detect intrusion in each sub-network, a decision tree optimized by black hole optimization (BHO) algorithm is used. Thus, the decision tree deployed in each sub-network is pruned by BHO, and the split points in its decision nodes are also determined in such a way that the accuracy of each tree in detecting sub-network attacks is maximized. The performance of the proposed method is evaluated in a simulated environment and its performance in detecting attacks using the NSLKDD and NSW-NB15 databases is examined. The results show that the proposed method can identify attacks in the NSLKDD and NSW-NB15 databases with an accuracy of 99.2% and 97.2%, respectively, which indicates an increase compared to previous methods.

A self-adaptation-based approach to resilience improvement of complex internets of utility systems

Resilience improvement of complex internets of utility systems is still an open issue for the current research. Proposed solutions fail to implement an integrated approach to detection, mitigation, and reaction which is able to face both well-known and new, previously unknown cyber-attacks (in particular distributed ones, which constitute one of the most serious and still unresolved threat scenarios affecting networked systems). In this work, we present the conceptual architecture of a novel multi-layer distributed Intrusion Detection and Reaction System based on the Autonomic Communication paradigm. The architecture relies on a self-organizing cooperative overlay network of complementary components that are dynamically and autonomously adapted to face distributed cyberattacks against Industrial Control Systems. The proposed architecture aims at being a guideline for experts and practitioners to address the well-known problem of distributed nature of new types of cyber-attacks, by implementing mechanisms to orchestrate available resources for effective detection and remediation dynamically. A distributed flow monitoring system provides input data to cooperative intrusion detection agents, which allow correlating information from heterogeneous feeds to improve the identification of attacks originating from both the inside and the outside of the monitored network and to support customizable remediation mechanisms.

Autonomous Federated Learning for Distributed Intrusion Detection Systems in Public Networks

Autonomous Federated Learning for Distributed Intrusion Detection Systems in Public Networks

Организация мониторинга сетевых вторжений на основе свободно распространяемого программного обеспечения

This paper presents the results of preparing a virtual bench for modeling and detecting network attacks using a freely distributed intrusion detection system (IDS). The relevance of the work is related to the growing demand for IDS as sources of information security events for security information and event management (SIEM) systems. A comparative analysis of the most popular freely distributed open-source network IDSs was carried out and the choice of the Zeek system for its use in the project was substantiated. The work uses Zeek network logs, which contain important and structured information about the analyzed network traffic. The laboratory bench was built on the basis of a Linux virtual machine and a Mininet network simulator. A graphical representation of the developed virtual stand is proposed. An experimental study of the effectiveness of an intrusion detection system is demonstrated by simulating a network denial of service attack and further analyzing the received network traffic using IDS tools.

Design and Protection Strategy of Distributed Intrusion Detection System in Big Data Environment.

One of the important research topics is protecting the host from threats by developing a reliable and accurate intrusion detection system. However, since the amount of data has grown fast due to the emergence of big data, the performance of traditional systems designed to identify breaches has suffered several flaws. One of them, for example, is known as single-point failure; low adaptability and a high false alarm rate are also typical. Hadoop is used to detect intrusions to tackle these difficulties. The Java system is used to create a framework with a significant data flow that detects intrusions when a distributed system is built. The proposed solution employs a distributed operating system for data collection, storage, and analysis. The results indicate that external distributed denial of service (DDoS) attacks are recognized quickly. The single-point failure issue is overcome, alleviating the bottleneck problem of data processing ability.

BSLnO: Multi‐agent based distributed intrusion detection system using Bat Sea Lion Optimization‐based hybrid deep learning approach

SummaryIntrusion detection system (IDS) is a robust model that plays an essential role in dealing with intrusion detection, especially in detecting abnormal anomalies and unknown attacks. The major challenges faced by IDS are the computation time required for analysis, and the exchange of a huge amount of data from one division of the network to another. For the sake of tackling such limitations, this probe proposes a multi‐agent enabled IDS for detecting intrusions using the Bat Sea Lion Optimization (BSLnO) algorithm. The proposed strategy consists of five phases, namely pre‐processor agent, reducer agent, augmentation agent, classifier agent, and decision agent. Initially, input data is subjected to pre‐processor agent, where pre‐processing is carried out using data normalization and missing value imputation. Thereafter, the pre‐processed result is fed up to the reducer agent, where dimension reduction is carried out using mutual information. The third step is data augmentation in which the dimensionality of data is enhanced. After that, the augmented result is subjected to classifier agent to classify intrusions or malicious activities present in the network based on hybrid deep learning strategies, namely deep maxout network and deep residual network. A developed BSLnO is implemented by incorporating Bat Algorithm (BA) and Sea Lion Optimization (SLnO) algorithm to train the hybrid classifier. The proposed scheme has acquired a higher precision of 0.936, recall of 0.904, and F‐measure of 0.920.

A New Distributed Intrusion Detection System Based on Multi-Agent System for Cloud Environment

Cloud computing, like any distributed computing system, is continually exposed to many threats and attacks of various origins. Thus, cloud security is now a very important concern for both providers and users. Intrusion detection systems (IDSs) are used to detect attacks in this environment. The goal of security administrators (for both customers and providers) is to prevent and detect attacks while avoiding disruption of the smooth operation of the cloud. Making IDSs efficient is not an easy task in a distributed environment such as the cloud. This problem remains open, and to our knowledge, there are no satisfactory solutions for the automated evaluation and analysis of cloud security. The features of the multi-agent system paradigm, such as adaptability, collaboration, and distribution, make it possible to handle this evolution of cloud computing in an efficient and controlled manner. As a result, multi-agent systems are well suited to the effective management of cloud security. In this paper, we propose an efficient, reliable and secure distributed IDS (DIDS) based on a multi-agent approach to identify and prevent new and complex malicious attacks in this environment. Moreover, some experiments were conducted to evaluate the performance of our model.

Development and application of biological intelligence technology in computer

To study the development and application of biological intelligence technology in computers and realize high-precision network anomaly detection, a distributed intrusion detection system based on agent biological intelligence technology is proposed. The intrusion detection model is implemented based on commonly used traditional machine learning methods. According to the detection index data, the detection effect of each algorithm is analyzed. With the support of the overall structure of the system, analyze the control center, network host, partition control center, and Agent library; adopt corresponding response strategies according to the response rules in the response library, and use the communication module to timely judge whether the intrusion behavior is abnormal, using S5720S-28P-SI -AC24-port full-gigabit three-layer network management enterprise-level network core switch for data exchange; select AD2032 type alarm responder, which can monitor foreign intrusion; through V1.2 green computer information detector, system memory and drive disk All-round evaluation; analyze the realization mode, communication message format and communication protocol of the subject communication, design the data movement process based on the agent; realize the intrusion detection model with the help of the commonly used traditional machine learning method. According to the detection index data, the detection effect of each algorithm is analyzed. The experimental results show that, for the IDA system, when the first five clients suffer intrusion behavior, its detection function can check the abnormal situation in time. When the detection time is in the 40s, the detection accuracy is 70%. When the last five clients suffered intrusion behavior, their detection function was not perfect. When the detection time was 25s, the accuracy no longer increased, and the detection accuracy remained at 40% until 40s. When the first five clients of the Agent-based system suffer from intrusion, the detection accuracy is always high, up to 99%. When the last five clients suffer from intrusion, the detection accuracy can reach 95%. Therefore, the detection accuracy of this system is high. It is proved that the system has obvious advantages in terms of accuracy, which successfully proves that it can effectively solve the problem of network anomaly detection

A distributed intrusion detection system to detect DDoS attacks in blockchain-enabled IoT network

The Internet of Things (IoT) is emerging as a new technology for the development of various critical applications. However, these applications are still working on centralized storage architecture and have various key challenges like privacy, security, and single point of failure. Recently, the blockchain technology has emerged as a backbone for the IoT-based application development. The blockchain can be leveraged to solve privacy, security, and single point of failure (third-part dependency) issues of IoT applications. The integration of blockchain with IoT can benefit both individual and society. However, 2017 Distributed Denial of Service (DDoS) attack on mining pool exposed the critical fault-lines among blockchain-enabled IoT network. Moreover, this application generates huge amount of data. Machine Learning (ML) gives complete autonomy in big data analysis, capabilities of decision making and therefore is used as an analytical tool. Thus, in order to address above challenges, this paper proposes a novel distributed Intrusion Detection System (IDS) using fog computing to detect DDoS attacks against mining pool in blockchain-enabled IoT Network. The performance is evaluated by training Random Forest (RF) and an optimized gradient tree boosting system (XGBoost) on distributed fog nodes. The proposed model effectiveness is assessed using an actual IoT-based dataset i.e., BoT-IoT, which includes most recent attacks found in blockchain-enabled IoT network. The results indicate, for binary attack-detection XGBoost outperforms whereas for multi-attack detection Random Forest outperforms. Overall on distributed fog nodes RF takes less time for training and testing compared to XGBoost.

A Distributed Intrusion Detection System using Machine Learning for IoT based on ToN-IoT Dataset

A Distributed Intrusion Detection System using Machine Learning for IoT based on ToN-IoT Dataset

Blockchain: Secured Solution for Signature Transfer in Distributed Intrusion Detection System

Exchange of data in networks necessitates provision of security and confidentiality. Most networks compromised by intruders are those where the exchange of data is at high risk. The main objective of this paper is to present a solution for secure exchange of attack signatures between the nodes of a distributed network. Malicious activities are monitored and detected by the Intrusion Detection System (IDS) that operates with nodes connected to a distributed network. The IDS operates in two phases, where the first phase consists of detection of anomaly attacks using an ensemble of classifiers such as Random forest, Convolutional neural network, and XGBoost along with genetic algorithm to improve the performance of IDS. The novel attacks detected in this phase are converted into signatures and exchanged further through the network using the blockchain framework in the second phase. This phase uses the cryptosystem as part of the blockchain to store data and secure it at a higher level. The blockchain is implemented using the Hyperledger Fabric v1.0 and v2.0, to create a prototype for secure signature transfer. It exchanges signatures in a much more secured manner using the blockchain architecture when implemented with version 2.0 of Hyperledger Fabric. The performance of the proposed blockchain system is evaluated on UNSW NB15 dataset. Blockchain performance has been evaluated in terms of execution time, average latency, throughput and transaction processing time. Experimental evidence of the proposed IDS system demonstrates improved performance with accuracy, detection rate and false alarm rate (FAR) as key parameters used. Accuracy and detection rate increase by 2% and 3% respectively whereas FAR reduces by 1.7%.

Deep Learning Based Distributed Intrusion Detection in Secure Cyber Physical Systems

Cyber Physical Systems (CPSs) are network systems containing cyber (computation, communication) and physical (sensors, actuators) components that interact with each other through feedback loop with the help of human intervention. The dynamic and disseminated characteristics of CPS environment makes it vulnerable to threats that exist in virtualization process. Due to this, several security issues are presented in CPS. In order to address the challenges, there is a need exists to extend the conventional security solutions such as Intrusion Detection Systems (IDS) to handle high speed network data traffic and adaptive network pattern in cloud. Additionally, the identification of feasible network traffic characteristics is the main issue in precise detection of attacks in the network. With this motivation, the current research paper presents an Optimal Deep Belief Network-based distributed Intrusion Detection System (ODBN-IDS) for secure CPS environment. The proposed model pre-process the cloud network traffic data to improve its quality to next level. Here, a Binary Flower Pollination Algorithm (BFPA) is employed for feature selection process. The attained characteristics are used in optimal Deep Belief Networks (DBN) to detect the presence of intrusion in cloud data and produce alarms, in case of presence of intrusions. Equilibrium Optimizer Algorithm (EOA) is used to fine tune the hyperparameters in DBN model. A detailed set of simulations was conducted on benchmark datasets and the analysis results were compared. A detailed comparison was conducted for various models to satisfy the security requirements of cloud network and the results established the supremacy of the proposed ODBN-IDS model.

Distributed Intrusion Detection Systems in Big Data: A Survey

We live in a time where data stream by the second, which makes intrusion detection a more difficult and tiresome task, and in turn intrusion detection systems require an efficient and improved detection mechanism to detect the intrusive activities. Moreover, handling the size, complexity, and availability of big data requires techniques that can create beneficial knowledge from huge streams of the information, which imposes the challenges on the process of both designing and management of both Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) in terms of performance, sustainability, security, reliability, privacy, energy consumption, fault tolerance, scalability, and flexibility. IDSs and IPSs utilize various methodologies to guarantee security, accessibility and reliability of enterprise computer networks. This paper presents a comprehensive study of the Distributed Intrusion Detection Systems in Big Data, and presents intrusion detection and prevention techniques that utilize machine learning, big data analytics techniques in distributed systems of the intrusion detection.

Research on lightweight anomaly detection of multimedia traffic in edge computing

With the rapid development of the multimedia Internet of Things, a large amount of multimedia data is generated at the edge of the network. These multimedia data occupies most of the network traffic, and they have higher real-time transmission requirements, so they bring higher detection requirements to network security equipment. However, due to the limited processing capabilities of edge nodes, the high-performance distributed intrusion detection system (DIDS) in cloud computing cannot be used directly at the edge of the network. To solve this problem, a DIDS identification and detection method for multimedia traffic in an edge computing (EC) environment is proposed. Firstly, according to the characteristics of multimedia sensors, a multimedia traffic identification scheme combining protocol analysis and session analysis is established. Then, the improved and pruned C4.5 decision tree algorithm is used to identify the traffic which is not easily identified by the previous method. Finally, a special rule base and rule linked list are established in DIDS for targeted detection of multimedia traffic to achieve the goal of low calculation and high accuracy of the system. In addition, a DIDS multimedia detection optimization algorithm based on the M/M/n/m model is also proposed, which enables DIDS to automatically adjust the detection intensity of multimedia packets according to the length of the waiting queue. Firstly, the state flow diagram is established according to the Markov chain and birth-death process. Then, the multimedia detection method is improved by establishing the service dependent model. Finally, the operating cost is minimized by calculating the optimal number of detection engines in the DIDS. Experimental results show that the proposed scheme can help DIDS to identify and pertinently detect multimedia traffic with the lowest operating cost in a resource-constrained edge computing environment, while the safety of DIDS has not been reduced.

Low load DIDS task scheduling based on Q-learning in edge computing environment

Edge computing, as a new computing model, is facing new challenges in network security while developing rapidly. Due to the limited performance of edge nodes, the distributed intrusion detection system (DIDS), which relies on high-performance devices in cloud computing, needs to be improved to low load to detect packets nearby the network edge. This paper proposes a low load DIDS task scheduling method based on Q-Learning algorithm in reinforcement learning, which can dynamically adjust scheduling strategies according to network changes in the edge computing environment to keep the overall load of DIDS at a low level, while maintaining a balance between the two contradictory indicators of low load and packet loss rate. Simulation experiments show that the proposed method has better low-load performance than other scheduling methods, and indicators such as malicious feature detection rate are not significantly reduced.