Effectiveness Of Intrusion Detection System Research Articles

A methodology for evaluating the effectiveness of intrusion detection system based on federated learning

The article investigates the problem of applying federated learning for building intrusion detection systems. Federated learning is a way of organizing distributed learning, in which data are not transferred to a single cloud storage, and the training of models is performed locally, the formation of a common global model is performed based on the parameters of local models. The article proposes a methodology for evaluating the performance of federated trained models, including the evaluation of the training throughput. The training throughput depends on the federated learning settings, the computational resources of the interacting devices and the network bandwidth, and obviously, the use of federated learning can significantly affect the performance of the device itself. This article presents a description of the experimental setup, and the results of a series of experiments that characterize the federated learning process with different settings.

Optimizing the Effectiveness of Intrusion Detection System by using Pearson Correlation and Tune Model Hyper Parameter on Microsoft Azure Platform

Optimizing the Effectiveness of Intrusion Detection System by using Pearson Correlation and Tune Model Hyper Parameter on Microsoft Azure Platform

Enhancing network intrusion detection classifiers using supervised adversarial training

The performance of classifiers has a direct impact on the effectiveness of intrusion detection system. Thus, most researchers aim to improve the detection performance of classifiers. However, classifiers can only get limited useful information from the limited number of labeled training samples, which usually affects the generalization of classifiers. In order to enhance the network intrusion detection classifiers, we resort to adversarial training, and a novel supervised learning framework using generative adversarial network for improving the performance of the classifier is proposed in this paper. The generative model in our framework is utilized to continuously generate other complementary labeled samples for adversarial training and assist the classifier for classification, while the classifier in our framework is used to identify different categories. Meanwhile, the loss function is deduced again, and several empirical training strategies are proposed to improve the stabilization of the supervised learning framework. Experimental results prove that the classifier via adversarial training improves the performance indicators of intrusion detection. The proposed framework provides a feasible method to enhance the performance and generalization of the classifier.

Evaluation of the performance of ID systems in a switched and distributed environment: the RealSecure case study

With the phenomenal increase of unwarranted Internet traffic into corporate networks the need for the development and effective use of currently available intrusion detection (ID) systems has acquired great importance. Compounding this is the constantly evolving techniques by professional hackers to defeat any and every counter measure designed to stem or at least contain their acts. In this paper, we present the results of tests conducted to assess the effectiveness of intrusion detection system in a switched and distributed network environment. The results reveal that the performance of ID systems is a function of various factors including network topology, deployment techniques, and network throughput, bandwidth and network traffic conditions. Within the limits of our studies, the findings can be summarized as: 1. The detection capability of the ID system diminishes with increase in bandwidth utilization with the obvious implication that better performance could be achieved with the use of multiple sensors. 2. Deployment at network or domain entry points i.e. outside decoy provides better performance results by up to 11%. 3. Deployment with packet loss limiting devices produces a better result than deployment with the port mirroring technique by up to 27%.