Efficient Intrusion Detection System Research Articles

Artificial Intelligence based Intrusion Detection System – A Detailed Survey

The Internet and communications have rapidly expanded, leading to a significant rise in data generation and heterogeneity. Intrusion detection systems play a crucial role in ensuring the security and integrity of computer systems. These systems have been developed by researchers, academicians, and practitioners to effectively detect and mitigate network attacks. Intrusion detection systems are designed to analyze network traffic and compare it with a baseline of normal behavior, allowing them to identify any deviations or inconsistencies that may indicate an intrusion. Furthermore, the cooperative and distributed architecture of intrusion detection systems enables them to effectively detect attacks and protect the network from unauthorized access. Additionally, to enhance the performance of intrusion detection systems, techniques such as resampling the dataset and utilizing classifier ensemble are used to improve the classification accuracy. Moreover, intrusion detection systems have been integrated with intrusion response systems to ensure a timely and effective response to detected attacks. AI-based Intrusion Detection Systems have emerged as a crucial tool in ensuring network security and combating cyber threats. These systems utilize artificial intelligence algorithms to analyze network traffic, identify patterns of malicious activity, and detect potential cyber-attacks. They have proven to be highly effective in improving the detection accuracy, reducing false alarms, and even detecting previously unknown types of attacks. In summary, the development of accurate and efficient intrusion detection systems is crucial for ensuring network security. In today’s rapidly changing world, the significance of accurate intrusion detection systems cannot be overstated.

An Efficient Intrusion Detection System in Cloud Network Based on Deep Learning and Improved Marine Predators-Particle Swarm Optimization

An Efficient Intrusion Detection System in Cloud Network Based on Deep Learning and Improved Marine Predators-Particle Swarm Optimization

An Efficient Intrusion Detection and Prevention System for DDOS Attack in WSN Using SS-LSACNN and TCSLR

Sensor Nodes (SNs) are utilized by Wireless Sensor Networks (WSNs) to recognize their environment; in addition, the WSN delivers data from sensing nodes to the sink. The WSNs are exposed to several security threats owing to the broadcast performance of transmission along with the increase in the growth of application regions. Countermeasures like Intrusion Detection and Prevention Systems (IDPS) should be adopted to overcome the aforementioned attacks. By implementing these systems, several intrusions can be detected in WSN; also, WSN can be prevented from various security attacks. Therefore, identifying the general attack that influences the SNs mentioned as Distributed Denial of Service (DDoS) attack and recuperating the data utilizing Soft Swish (SS)-Linear Scaling-centered Adam Convolution Neural Network (SS-LSACNN) along with Two’s Compliment Shift Reverse (TCSLR) operation are the intentions of this work. Firstly, for extracting the vital features, the data gathered as of the dataset are utilized. After that, the extracted features are pre-processed. It is then utilized for attack detection. The null features and the redundant data are removed in preprocessing. By employing the Correlation Coefficient-centered Synthetic Minority Oversampling Technique (CC-SMOTE) methodology, data separation regarding classes and data balancing was performed to prevent the imbalance issue. Subsequently, to provide the preprocessed data for attack detection, the Numeralization and feature scaling are executed. After that, by utilizing Chebyshev Distance (CD)-centric K-Means Algorithm (KMA), the real-time SNs are initialized as well as clustered. The data gathered as of the SNs are utilized for attack detection following the clustering phase. Following the detection phase, the data being attacked are amassed in the log file; similarly, the non-attacked data are inputted into the prevention phase. Next, the experiential analysis is carried out for examining the proposed system’s efficacy. The outcomes revealed that the proposed model exhibits 98.15% accuracy, 97.59% sensitivity, 95.72% specificity, and 95.48% F-measure, which displays the proposed model’s efficacy.

An Effective Method for Detecting Unknown Types of Attacks Based on Log-Cosh Variational Autoencoder

The increasing prevalence of unknown-type attacks on the Internet highlights the importance of developing efficient intrusion detection systems. While machine learning-based techniques can detect unknown types of attacks, the need for innovative approaches becomes evident, as traditional methods may not be sufficient. In this research, we propose a deep learning-based solution called the log-cosh variational autoencoder (LVAE) to address this challenge. The LVAE inherits the strong modeling abilities of the variational autoencoder (VAE), enabling it to understand complex data distributions and generate reconstructed data. To better simulate discrete features of real attacks and generate unknown types of attacks, we introduce an effective reconstruction loss term utilizing the logarithmic hyperbolic cosine (log-cosh) function in the LVAE. Compared to conventional VAEs, the LVAE shows promising potential in generating data that closely resemble unknown attacks, which is a critical capability for improving the detection rate of unknown attacks. In order to classify the generated unknown data, we employed eight feature extraction and classification techniques. Numerous experiments were conducted using the latest CICIDS2017 dataset, training with varying amounts of real and unknown-type attacks. Our optimal experimental results surpassed several state-of-the-art techniques, achieving accuracy and average F1 scores of 99.89% and 99.83%, respectively. The suggested LVAE strategy also demonstrated outstanding performance in generating unknown attack data. Overall, our work establishes a solid foundation for accurately and efficiently identifying unknown types of attacks, contributing to the advancement of intrusion detection techniques.

An Adaptive Intrusion Detection System in the Internet of Medical Things Using Fuzzy-Based Learning.

The Internet of Medical Things (IoMT) is a growing trend within the rapidly expanding Internet of Things, enhancing healthcare operations and remote patient monitoring. However, these devices are vulnerable to cyber-attacks, posing risks to healthcare operations and patient safety. To detect and counteract attacks on the IoMT, methods such as intrusion detection systems, log monitoring, and threat intelligence are utilized. However, as attackers refine their methods, there is an increasing shift toward using machine learning and deep learning for more accurate and predictive attack detection. In this paper, we propose a fuzzy-based self-tuning Long Short-Term Memory (LSTM) intrusion detection system (IDS) for the IoMT. Our approach dynamically adjusts the number of epochs and utilizes early stopping to prevent overfitting and underfitting. We conducted extensive experiments to evaluate the performance of our proposed model, comparing it with existing IDS models for the IoMT. The results show that our model achieves high accuracy, low false positive rates, and high detection rates, indicating its effectiveness in identifying intrusions. We also discuss the challenges of using static epochs and batch sizes in deep learning models and highlight the importance of dynamic adjustment. The findings of this study contribute to the development of more efficient and accurate IDS models for IoMT scenarios.

Federated Continuous Learning Based on Stacked Broad Learning System Assisted by Digital Twin Networks: An Incremental Learning Approach for Intrusion Detection in UAV Networks

The edge of the Internet of Things (IoT), which consists of Unmanned Aerial Vehicles (UAVs), is vulnerable to network intrusion because software and wireless connections are used extensively in the IoT. Designing an efficient Intrusion Detection System (IDS) model is imperative. However, when creating IDS models with distributed data collected by UAVs, it is necessary to take precautions to protect the data’s security and privacy. Furthermore, most of the IDS models are focused on one-time learning but not on continuous learning. To this end, we propose a Federated Continuous learning framework with a Stacked Broad Learning System (FCL-SBLS) based on Digital Twin Network (DTN), which can learn and train the IDS model on new data quickly and continuously. In order to improve the efficiency and quality of the IDS model when training and aggregation, we employ an asynchronous federated learning architecture, and a Deep Deterministic Policy Gradient (DDPG)-based UAV selection scheme assisted by DTN is proposed to help the global IDS model aggregation. The presented algorithm is validated using the CIC-IDS2017 dataset, and the simulation results reveal that our algorithm achieves higher efficiency and accuracy than the existing FL scheme.

DTL-IDS: An optimized Intrusion Detection Framework using Deep Transfer Learning and Genetic Algorithm

In the dynamic field of the Industrial Internet of Things (IIoT), the networks are increasingly vulnerable to a diverse range of cyberattacks. This vulnerability necessitates the development of advanced intrusion detection systems (IDSs). Addressing this need, our research contributes to the existing cybersecurity literature by introducing an optimized Intrusion Detection System based on Deep Transfer Learning (DTL), specifically tailored for heterogeneous IIoT networks. Our framework employs a tri-layer architectural approach that synergistically integrates Convolutional Neural Networks (CNNs), Genetic Algorithms (GA), and bootstrap aggregation ensemble techniques. The methodology is executed in three critical stages: First, we convert a state-of-the-art cybersecurity dataset, Edge_IIoTset, into image data, thereby facilitating CNN-based analytics. Second, GA is utilized to fine-tune the hyperparameters of each base learning model, enhancing the model’s adaptability and performance. Finally, the outputs of the top-performing models are amalgamated using ensemble techniques, bolstering the robustness of the IDS. Through rigorous evaluation protocols, our framework demonstrated exceptional performance, reliably achieving a 100% attack detection accuracy rate. This result establishes our framework as highly effective against 14 distinct types of cyberattacks. The findings bear significant implications for the ongoing development of secure, efficient, and adaptive IDS solutions in the complex landscape of IIoT networks.

An Effective and Efficient Intrusion Detection System of Network Attacks Using Stacked CNN and Voting Technique

IDS are crucial to network security because they can identify malicious activity and halt it in its tracks. Network intrusion data is often masked by a sea of benign data, making it difficult to train a model or perform a detection with a high FPR. This is because networks are inherently dynamic and change over time. In this research, we offer a ML & DL model-based method to ID, and we demonstrate how to deal with the issue of data imbalance by using a hybrid sampling technique. Conventional firewalls and data encryption technologies are unable to provide the level of security required by current networks. As a result, IDSs have been endorsed for use against network threats. Recent mainstream ID approaches have benefited from ML, but they have low detection rates & need a lot of feature engineering to be truly useful. Using layered CNN and Voting classifier (XGBoost and LGBM), this study introduces ML-DL-NIDS to address the issue of subpar detection precision. Using a publicly available NSL-KDD & UNSW-15 benchmark datasets for network intrusion detection, we find that this model outperforms competing methods according to accuracy and F1-score obtained from experimental evaluations.

Cyber-Attack Detection for Cloud-Based Intrusion Detection Systems

In this research, we delve into an exhaustive ex- amination of the usage of machine learning (ML) models for the identification of cyber threats within Cloud-Based Intrusion Detection Systems (IDS). With the escalating dependence on cloud services across various industries, the urgency to develop effective and resilient IDS to mitigate burgeoning cyber risks is paramount. Our study makes a significant contribution to this imperative field by analyzing the efficacy of diverse ML models in detecting cyber-attacks within a cloud context. We scrutinized an array of ML models, namely Decision Trees (DT), Random Forest (RF), XGBoost, and Support Vector Machines (SVM), utilizing key performance parameters such as accuracy, recall, precision, F1-s, and confusion matrix to understand their practical application in real-world IDS scenarios. XGBoost stood out as the most proficient model, showcasing not only an impressive accuracy but also a balanced performance in terms of precision and recall. This highlights the considerable potential of ensemble and gradient boosting techniques in optimizing cloud- based IDS detection capabilities. Our findings underscore the significant role of machine learning in fostering more dependable, robust, and efficient IDS in the cloud, thus significantly aiding in securing our digital ecosystems.

A Predictive Model Using Deep Learning Neural Network for Efficient Intrusion Detection

Abstract: Network intrusion detection system helps to detect exploitations and mitigate damages. A network intrusion detection system detects the network traffic that deviates from the normal behavioral pattern. Developing an efficient intrusion detection system has many challenges and the patterns associated with one type of intrusion differ from other intrusions. In such situations, understanding different patterns and differentiating intrusions becomes essential to detect anomalies and attacks in the network. Deep learning models offer more power and intelligence to the detection system and extend the ability to differentiate & understand the network feature characteristics, also machine learning models with feature selection showed high performance in intrusion detections. This paper evaluates the proposed deep learning neural network model and machine learning models using feature selection for efficient intrusion detection using real world dataset.

Mitigation of network security attacks in wireless multimedia sensors networks using intrusion detection system

<p>In this work, research propose a deep transfer learning-based Lecun network P-Lenet technique to move the knowledge contained in source domain data to the target domain and integrate to produce an efficient intrusion detection system (IDS) that would enhance the detection accuracy for any wireless multimedia sensors networks (WMSN) ecosystems. To prevent attacks on the software defined network (SDN) platform in real time, the proposed method placed a strong emphasis on anomaly detection as the primary mechanism. The Lecun network (LeNet) was investigated in this work, and a new variant of the network called the Lenet was proposed. In addition, research make use of techniques like as feature normalization to increase the accuracy of the algorithm predictions and to optimize the training process in such a way that it consumes the least amount of time and resources. The performance of the proposed model that was recommended was superior to that of existing network intrusion detection system (NIDS) algorithms.</p>

A Novel Feature-Selection Algorithm in IoT Networks for Intrusion Detection.

The Internet of Things (IoT) and network-enabled smart devices are crucial to the digitally interconnected society of the present day. However, the increased reliance on IoT devices increases their susceptibility to malicious activities within network traffic, posing significant challenges to cybersecurity. As a result, both system administrators and end users are negatively affected by these malevolent behaviours. Intrusion-detection systems (IDSs) are commonly deployed as a cyber attack defence mechanism to mitigate such risks. IDS plays a crucial role in identifying and preventing cyber hazards within IoT networks. However, the development of an efficient and rapid IDS system for the detection of cyber attacks remains a challenging area of research. Moreover, IDS datasets contain multiple features, so the implementation of feature selection (FS) is required to design an effective and timely IDS. The FS procedure seeks to eliminate irrelevant and redundant features from large IDS datasets, thereby improving the intrusion-detection system's overall performance. In this paper, we propose a hybrid wrapper-based feature-selection algorithm that is based on the concepts of the Cellular Automata (CA) engine and Tabu Search (TS)-based aspiration criteria. We used a Random Forest (RF) ensemble learning classifier to evaluate the fitness of the selected features. The proposed algorithm, CAT-S, was tested on the TON_IoT dataset. The simulation results demonstrate that the proposed algorithm, CAT-S, enhances classification accuracy while simultaneously reducing the number of features and the false positive rate.

Enhancing IoT network security through deep learning-powered Intrusion Detection System

The rapid growth of the Internet of Things (IoT) has brought about a global concern for the security of interconnected devices and networks. This necessitates the use of efficient Intrusion Detection System (IDS) to mitigate cyber threats. Deep learning (DL) techniques provides a promising approach to effectively detect irregularities in network traffic, enhancing IoT network security and reducing cyber threats. In this paper, DL-based IDS is proposed using Feed Forward Neural Networks (FFNN), Long Short-Term Memory (LSTM), and Random Neural Networks (RandNN) to protect IoT networks from cyberattacks. Each DL model has its potential benefit as reported in this paper. For example, the FFNN can handle complex IoT network traffic patterns, while the LSTM is good in capturing long-term dependencies present in the network traffic. With its random connections and flexible dynamics, the RandNN model uses its data learning ability to adapt and learn from network data. These algorithms boost cybersecurity by enabling defense mechanisms against challenging cyber threats and ensuring the security of sensitive data as IoT networks expand. The proposed technique exhibits superior performance when compared with the current state-of-the-art DL-IDS using the CIC-IoT22 dataset. An accuracy of 99.93 % is achieved for the FFNN model, 99.85 % for the LSTM model, and 96.42 % for the RandNN model in detecting intrusion. Moreover, the models have the potential to enhance intrusion detection in IoT networks by generating swift responses to security problems in IoT networks.

Ensemble Model Based on Hybrid Deep Learning for Intrusion Detection in Smart Grid Networks.

The Smart Grid aims to enhance the electric grid's reliability, safety, and efficiency by utilizing digital information and control technologies. Real-time analysis and state estimation methods are crucial for ensuring proper control implementation. However, the reliance of Smart Grid systems on communication networks makes them vulnerable to cyberattacks, posing a significant risk to grid reliability. To mitigate such threats, efficient intrusion detection and prevention systems are essential. This paper proposes a hybrid deep-learning approach to detect distributed denial-of-service attacks on the Smart Grid's communication infrastructure. Our method combines the convolutional neural network and recurrent gated unit algorithms. Two datasets were employed: The Intrusion Detection System dataset from the Canadian Institute for Cybersecurity and a custom dataset generated using the Omnet++ simulator. We also developed a real-time monitoring Kafka-based dashboard to facilitate attack surveillance and resilience. Experimental and simulation results demonstrate that our proposed approach achieves a high accuracy rate of 99.86%.

FD‐DBN: Flow directed deep belief network for accurate anomaly detection in cloud computing

SummarySecurity becomes the key concern in a cloud environment, as the servers are distributed throughout the globe and involve the circulation of highly sensitive data. Intrusions in the cloud are common because of the huge network traffic that paves the way for intruders to breach traditional security systems with sophisticated software. To avoid such problems, intrusion detection systems (IDSs) have been introduced by various researchers. Each IDS was developed to achieve a particular objective, that is, providing security by detecting intrusions. Most of the available IDS are inefficient and are unable to provide accurate classification. Also, some of them are computationally expensive to be implemented in practical scenarios. This article proposes a new and efficient IDS framework that can accurately classify the intrusion type through effective training to address the existing drawbacks. The proposed framework, named flow directed deep belief network (FD‐DBN), involves three main phases: pre‐processing, clustering, and classification. In pre‐processing, certain data mining operations are carried out to clean the data. The clustering phase is carried out using the game‐based k‐means (GBKM) clustering algorithm. The clustered data is then provided as input to the FD‐DBN classification framework, where the training process is carried out. The deep belief network (DBN) training is performed with dataset features, and the flow direction algorithm is adopted for tuning the weight parameters of DBN. Through tuning, the model yielded accurate classification outcomes. The simulations are done in Python 3.6, and the results proved that the proposed framework is much more effective than the existing IDS frameworks.

An improved long short term memory network for intrusion detection.

Over the years, intrusion detection system has played a crucial role in network security by discovering attacks from network traffics and generating an alarm signal to be sent to the security team. Machine learning methods, e.g., Support Vector Machine, K Nearest Neighbour, have been used in building intrusion detection systems but such systems still suffer from low accuracy and high false alarm rate. Deep learning models (e.g., Long Short-Term Memory, LSTM) have been employed in designing intrusion detection systems to address this issue. However, LSTM needs a high number of iterations to achieve high performance. In this paper, a novel, and improved version of the Long Short-Term Memory (ILSTM) algorithm was proposed. The ILSTM is based on the novel integration of the chaotic butterfly optimization algorithm (CBOA) and particle swarm optimization (PSO) to improve the accuracy of the LSTM algorithm. The ILSTM was then used to build an efficient intrusion detection system for binary and multi-class classification cases. The proposed algorithm has two phases: phase one involves training a conventional LSTM network to get initial weights, and phase two involves using the hybrid swarm algorithms, CBOA and PSO, to optimize the weights of LSTM to improve the accuracy. The performance of ILSTM and the intrusion detection system were evaluated using two public datasets (NSL-KDD dataset and LITNET-2020) under nine performance metrics. The results showed that the proposed ILSTM algorithm outperformed the original LSTM and other related deep-learning algorithms regarding accuracy and precision. The ILSTM achieved an accuracy of 93.09% and a precision of 96.86% while LSTM gave an accuracy of 82.74% and a precision of 76.49%. Also, the ILSTM performed better than LSTM in both datasets. In addition, the statistical analysis showed that ILSTM is more statistically significant than LSTM. Further, the proposed ISTLM gave better results of multiclassification of intrusion types such as DoS, Prob, and U2R attacks.

Deep-learning-based Intrusion Detection for Software-defined Networking Space Systems

This paper briefly reviews the application of the Software-defined Networking (SDN) architecture to satellite networks. It highlights the prominent cyber threats that SDN-based satellite networks are vulnerable to and proposes relevant defence mechanisms. SDN transforms traditional networking architectures by separating the control plane from the forwarding (data) plane. This separation enhances scalability and centralises management. In comparison, in traditional networks, the control plane and the data plane are usually combined, resulting in complex network management and reduced scalability. Satellite networks can take advantage of these benefits offered by SDN and this supports them as key enablers of critical services, including weather prediction, global broadband Internet coverage, and Internet of Things (IoT) services. Ease of configuration and flexibility are essential for satellites providing critical services to instantly adapt to network changes. These desirable attributes can be realised by applying SDN to satellite networks. Although SDN offers significant benefits to satellite networks, it is vulnerable to cyber-attacks and particularly due to its centralised architecture. A common attack on SDN is the Distributed Denial of Service (DDoS) attack which could render the entire SDN unavailable. To mitigate such threats, an efficient Intrusion Detection System (IDS) is required to monitor the network and detect any suspicious traffic. However, traditional IDSs produce too many false positives and often fail to detect advanced attacks. For their ability to learn feature hierarchies in network traffic data automatically, whether, for network traffic classification or anomaly detection, deep learning (DL) plays an increasingly important role in IDSs. In this paper, we present a brief review of recent developments in cyber security for SDN-based space systems, and we identify vulnerabilities and threats to an SDN-based satellite network. We further discuss the potential of a DL-based IDS for the detection of cyber threats. Finally, we identify further research gaps in the recent literature and propose future research directions.

Agnostic CH-DT Technique for SCADA Network High-Dimensional Data-Aware Intrusion Detection System

The pervasiveness in the industrial internet of things (IIoT) due to the application of supervisory control and data acquisition (SCADA) has led to the growth of heterogeneous sensor data, thereby increasing the risk of intrusions and attacks. The existence and effect of intruders and their innovative attack techniques are on the rise. Existing intrusion detection systems (IDS) tend to be computationally expensive with this form of data due to the presence of noise. In real-time domains, available methods lag, necessitating additional research into effective feature extraction schemes, which is fundamental in machine learning (ML) for time exigency. This study, in a comparative analysis of some feature selection techniques (FS), proposes a combination of an efficient ML classifier and an agnostic feature selection (FS) scheme for attack detection and classification in a real-time SCADA network. The flexibility and interoperability of the proposed approach resolve the computational complexity of vulnerability detection schemes while reducing false alarm rates (FAR) and overall model execution time. With the view of an online preprocessing, the proposed technique is phased thus: (i) data preparatory consisting of data cleansing and normalization followed by (ii) the combination of a pre-pruned decision tree (DT) algorithm and an agnostic Chi-square FS approach built to obtain an optimal subset of data features for efficient IDS. (iii) Evaluation of proposed agnostic DT-CH and other FS candidates for anomaly detection.

Advancing Intrusion Detection in Fog Computing: Unveiling the Power of Support Vector Machines for Robust Protection of Fog Nodes against XSS and SQL Injection Attacks

Fog computing, characterized as a cloud infrastructure in close proximity to end devices, faces substantial security challenges that necessitate robust intrusion detection mechanisms for fog nodes. The resource-constrained nature of fog nodes renders them particularly susceptible to attacks, making the development of efficient intrusion detection systems imperative. In this study, we propose a comprehensive approach to protect fog nodes, taking into account their limited resources. Leveraging the power of Support Vector Machines (SVMs), a widely adopted machine learning technique in IoT security, our method overcomes challenges associated with local optima, overfitting, and high-dimensional data. A thorough literature review underscores the prevalent use of SVMs in IoT security research. Specifically, we focus on addressing two prevalent web attacks: Cross-Site Scripting (XSS) and SQL injection attacks, based on global statistical data. To evaluate our approach, we employ the CSE-CIC-IDS2018 dataset and a pseudo-real dataset. Precision, recall, and accuracy are employed as evaluation metrics, along with the Mean Average Precision (MAP). Our evaluation results demonstrate an exceptional level of accuracy, achieving an impressive 98.28% accuracy in terms of average performance when compared to existing methods. Comparative analysis with state-of-the-art approaches further validates the superior efficacy and efficiency of our proposed method.

Statistical methods for feature selection: unlocking the key to improved accuracy

The ever-growing amount of data generated by modern networks poses significant challenges for intrusion detection systems (IDS) in effectively analyzing and classifying security risks. Therefore, it is crucial to identify the most biased characteristics for building efficient and effective IDS algorithms. However, not all features are equally informative or relevant for intrusion detection. In response to these problems, this study proposes a Hybrid approach that uses traditional and advanced statistical techniques. The proposed method effectively validates the features generated from the hybrid model and set-operation theorem to provide the best optimal subset of features for IDS. Various machine learning methods are used to test the proposed model on three popular IDS datasets: NSL-KDD, UNSW NB15, and CIC-DDoS2019. The experimental findings show that the suggested hybrid technique improves IDS performance effectively and efficiently, providing a viable answer to the issues that intrusion detection systems confront.