Enhanced Intrusion Detection Research Articles

Coarse and fine feature selection for Network Intrusion Detection Systems (IDS) in IoT networks

AbstractNetwork Intrusion Detection Systems (NIDSs) are important in safeguarding networks from known and unknown attacks. Many research efforts have recently been made to create NIDS systems based on Machine Learning (ML) methods, addressing a significant challenge in designing standard NIDS the lack of standardized feature sets in the dataset. Given the recent development of the Internet of Things (IoT) in wireless communication, our proposed method introduces a novel solution to enhance intrusion detection systems. This proposed solution feature selection is carried out in two stages, coarse and fine selection. In the first stage of the coarse selection process, we conduct correlation analysis to identify relationships within the feature set. The second stage employs fine selection using the Whale Optimization Algorithm (WOA) with Genetic Algorithm hybridization (CFWOAGA). The fitness of each selected feature is assessed using the K‐Nearest Neighbors (KNN) algorithm. In our proposed work we integrate WOA with hybrid GA to extend the search space and avoid local optima problems via crossover and mutation operations. These selected features are critical for detecting any intrusion, we use an ML classifier to identify whether there is an attack or normal in the network and we evaluate the performance of each classifier. We evaluate the performance of our classifier using the BoT‐IoT 2020 standard dataset while limiting the selected features to 32 for reduced computational complexity, these selected 32 features are based upon considerations of system optimization and efficiency, making a balance between computational efficiency and model performance. The experimental findings show better model accuracy compared to the WOA technique and a significant drop in the False Alarm Rate (FAR). In conclusion, our proposed CFWOA method achieved an accuracy of 98.9%, while an updated version with the genetic algorithm demonstrated further improvement at 99.5%. Notably, there was a substantial improvement in FAR with our proposed method.

Securing SDN: Hybrid autoencoder-random forest for intrusion detection and attack mitigation

Software Defined Networking (SDN) has revolutionized network administration by providing centralized management through software, enabling traffic adjustment independent of the data plane. Despite the benefits, SDN networks are prone to security threats from external sources, thus necessitating the implementation of security measures. Unfortunately, most existing efforts have been just a simple mapping of earlier solutions into the SDN environments. This paper addresses the problem of SDN security based on deep learning in a purely native SDN environment, where a Deep Learning intrusion detection module is tailored to a native SDN environment. In particular, we propose a hybrid Deep AutoEncoder with a Random Forest classifier model (DAERF) to enhance intrusion detection performance in a native SDN environment. The proposed model is incorporated into a novel adaptive framework for attack mitigation in SDN environments. The proposed framework consists of a three-layer protection mechanism for detecting and preventing attacks. It is based on entropy-based detection, hybrid machine learning in the control layer and proactive services monitoring in the application layer. Experimental results have shown that our DEARF proposed autoencoder model achieved anomaly detection rates in excess of 98% in stand-alone mode as well as when incorporated within the framework, making it highly solution for next generation SDN networks.

Enhancing intrusion detection in wireless sensor networks through deep hybrid network empowered by SC-attention mechanism

Enhancing intrusion detection in wireless sensor networks through deep hybrid network empowered by SC-attention mechanism

Enhancing intrusion detection in IoT networks using machine learning-based feature selection and ensemble models

Internet of Things (IoT) technology has evolved significantly, transitioning from personal devices to powering smart cities and global deployments across diverse industries. However, security challenges arise due to diverse devices using various protocols and having limited computational capabilities, leading to vulnerabilities and potential intrusions in IoT networks. This paper addresses the challenge of intrusion detection in IoT by introducing a heterogeneous machine learning-based stack classifier model for IoT data. The model employs feature selection and ensemble modelling to investigate and enhance key classification metrics for intrusion detection of IoT data. This approach comprises two core components: the utilization of the K-Best algorithm for feature selection, extracting the top 15 critical features and the construction of an ensemble model incorporating various traditional machine learning models. The integration of these components harnesses information from selected features and leverages the collective strength of individual models to enhance classification performance. Using the ‘Ton IoT dataset,’ our experiments compare the ensemble model with individual ones. This research aims to improve key classification metrics for IoT intrusion detection, focusing on accuracy, precision, recall and F1 score. Through rigorous experimentation and comparisons, the proposed ensemble approach showcases exceptional performance, providing a robust solution to fortify IoT network security.

Enhancing Intrusion Detection Systems through Distributed Ledger Technology for Secure Logging

Nodes in Mobile Ad Hoc Networks (MANETs) are limited battery powered. That’s why energy efficient routing has become an important optimization criterion in MANETs. The conventional routing protocols do not consider energy of the nodes while selecting routes which leads to early exhaustion of nodes and partitioning of the network. This paper attempts to provide an energy aware routing algorithm. The proposed algorithm finds the transmission energy between the nodes relative to the distance and the performance of the algorithm is analyzed between two metrics Total Transmission energy of a route and Maximum Number of Hops. The proposed algorithm shows efficient energy utilization and increased network lifetime with total transmission energy metric.

Leveraging Artificial Neural Networks and LightGBM for Enhanced Intrusion Detection in Automotive Systems

Leveraging Artificial Neural Networks and LightGBM for Enhanced Intrusion Detection in Automotive Systems

Crook node identification system in VANET using CRF based feature selection and data mining classification techniques

Intelligent Transportation Systems have become integral to daily life, with VANETs (vehicular ad-hoc networks) playing the pivotal role. VANETs, the subsets of MANETs, employ vehicles as nodes to establish intelligent transport systems. However, due to critical applications such as military use, these networks are susceptible to attacks. With features like high mobility, dynamic network topology, and coverage issues, security breaches are a concern. This necessitates a secure routing algorithm to mitigate attacks and ensure message delivery. In our study, we utilize the UNSW-NB15 intrusion detection dataset to develop training and testing models. Our proposed novel intrusion detection system employs a feature selection algorithm that prioritizes significant arriving traffic attributes. This algorithm enhances abnormal activity detection while minimizing associated features. To achieve this, we modify the Conditional Random Field algorithm with fuzzy-based rules, resulting in a more efficient selection of influential and contributing features for detecting attacks such as DoS, Worms, Fuzzers, and Shellcode. Through appropriate feature selection using the modified Conditional Random Field and Support Vector Machine classification system in our experiments, we demonstrate a notable increase in security by reducing the false positive rate. Additionally, our approach excels in detecting accuracy of Fuzzers (98.86%), DoS (98.80%), Worms (34.45%), and Shellcode (89.308%), ultimately enhancing network performance. These findings underscore the effectiveness of our proposed method in enhancing intrusion detection and overall network efficiency.

Enhanced Intrusion Detection Systems Performance with UNSW-NB15 Data Analysis

The rapid proliferation of new technologies such as Internet of Things (IoT), cloud computing, virtualization, and smart devices has led to a massive annual production of over 400 zettabytes of network traffic data. As a result, it is crucial for companies to implement robust cybersecurity measures to safeguard sensitive data from intrusion, which can lead to significant financial losses. Existing intrusion detection systems (IDS) require further enhancements to reduce false positives as well as enhance overall accuracy. To minimize security risks, data analytics and machine learning can be utilized to create data-driven recommendations and decisions based on the input data. This study focuses on developing machine learning models that can identify cyber-attacks and enhance IDS system performance. This paper employed logistic regression, support vector machine, decision tree, and random forest algorithms on the UNSW-NB15 network traffic dataset, utilizing in-depth exploratory data analysis, and feature selection using correlation analysis and random sampling to compare model accuracy and effectiveness. The performance and confusion matrix results indicate that the Random Forest model is the best option for identifying cyber-attacks, with a remarkable F1 score of 97.80%, accuracy of 98.63%, and low false alarm rate of 1.36%, and thus should be considered to improve IDS system security.

DeepLG SecNet: utilizing deep LSTM and GRU with secure network for enhanced intrusion detection in IoT environments

DeepLG SecNet: utilizing deep LSTM and GRU with secure network for enhanced intrusion detection in IoT environments

Intrusion Detection Systems Using Machine Learning.

The utilization of machine learning to enhance Intrusion Detection Systems (IDS). It encompasses an exploration of diverse IDS categories, fundamental evaluation metrics, and the dynamic landscape of machine learning methodologies. Recent trends underscore a shift towards the adoption of deep learning techniques for improving attack detection capabilities. Challenges arise from heightened model complexity and increased resource requirements. The paper also suggests future directions that encompass the development of updated datasets and the efficient management of resources through cloud integration. Throughout, this study emphasizes the continuous demand for research and innovation in the field of cybersecurity.

Secure and privacy-preserving intrusion detection in wireless sensor networks: Federated learning with SCNN-Bi-LSTM for enhanced reliability

As the digital landscape expands rapidly due to technological advancements, cybersecurity concerns have become more prevalent. Intrusion Detection Systems (IDSs), which are crucial for identifying unusual network traffic indicative of malicious activity, have become a necessity. These systems can be either hardware or software-based. However, traditional IDS models often fail to adequately protect data privacy and detect complex, unique breaches, particularly within Wireless Sensor Networks (WSNs). To address these limitations, this paper proposes a novel Stacked Convolutional Neural Network and Bidirectional Long Short Term Memory (SCNN-Bi-LSTM) model for intrusion detection in WSNs. This model leverages Federated Learning (FL) to enhance intrusion detection performance and safeguard privacy. The FL-based SCNN-Bi-LSTM model is unique in its approach, allowing multiple sensor nodes to collaboratively train a central global model without revealing private data, thereby alleviating privacy concerns. The deep learning methodology of the SCNN-Bi-LSTM model effectively identifies sophisticated and previously unknown cyber threats by meticulously examining both local and temporal linkages in network patterns. The model has been specifically designed to detect and categorize different types of Denial of Service (DoS) attacks using specialized WSN-DS and CIC-IDS-2017 datasets. Compared to traditional Artificial Deep Neural Network (ADNN) models, our proposed FL-SCNN-Bi-LSTM model demonstrated superior detection rates for complex and unknown attacks, significantly improving IDS performance. The model achieved a notable classification accuracy of approximately 99.9% precision and recall on both datasets, substantially reducing false positives and negatives. Our research underscores the potential of federated learning and deep learning in enhancing the security and privacy of WSNs. The proposed FL-SCNN-Bi-LSTM architecture not only facilitates the identification of complex cyber threats but also exemplifies how deep learning techniques can be employed to bolster intrusion detection systems while preserving user data privacy.

Enhanced Intrusion Detection with LSTM-Based Model, Feature Selection, and SMOTE for Imbalanced Data

This study introduces a sophisticated intrusion detection system (IDS) that has been specifically developed for internet of things (IoT) networks. By utilizing the capabilities of long short-term memory (LSTM), a deep learning model renowned for its proficiency in modeling sequential data, our intrusion detection system (IDS) effectively discerns between regular network traffic and potential malicious attacks. In order to tackle the issue of imbalanced data, which is a prevalent concern in the development of intrusion detection systems (IDSs), we have integrated the synthetic minority over-sampling technique (SMOTE) into our approach. This incorporation allows our model to accurately identify infrequent incursion patterns. The rebalancing of the dataset is accomplished by SMOTE through the generation of synthetic samples belonging to the minority class. Various strategies, such as the utilization of generative adversarial networks (GANs), have been put forth in order to tackle the issue of data imbalance. However, SMOTE (synthetic minority over-sampling technique) presents some distinct advantages when applied to intrusion detection. The SMOTE is characterized by its simplicity and proven efficacy across diverse areas, including in intrusion detection. The implementation of this approach is straightforward and does not necessitate intricate adversarial training techniques such as generative adversarial networks (GANs). The interpretability of SMOTE lies in its ability to generate synthetic samples that are aligned with the properties of the original data, rendering it well suited for security applications that prioritize transparency. The utilization of SMOTE has been widely embraced in the field of intrusion detection research, demonstrating its effectiveness in augmenting the detection capacities of intrusion detection systems (IDSs) in internet of things (IoT) networks and reducing the consequences of class imbalance. This study conducted a thorough assessment of three commonly utilized public datasets, namely, CICIDS2017, NSL-KDD, and UNSW-NB15. The findings indicate that our LSTM-based intrusion detection system (IDS), in conjunction with the implementation of SMOTE to address data imbalance, outperforms existing methodologies in accurately detecting network intrusions. The findings of this study provide significant contributions to the domain of internet of things (IoT) security, presenting a proactive and adaptable approach to safeguarding against advanced cyberattacks. Through the utilization of LSTM-based deep learning techniques and the mitigation of data imbalance using SMOTE, our AI-driven intrusion detection system (IDS) enhances the security of internet of things (IoT) networks, hence facilitating the wider implementation of IoT technologies across many industries.

Firefly algorithm based WSN-IoT security enhancement with machine learning for intrusion detection

A Wireless Sensor Network (WSN) aided by the Internet of Things (IoT) is a collaborative system of WSN systems and IoT networks are work to exchange, gather, and handle data. The primary objective of this collaboration is to enhance data analysis and automation to facilitate improved decision-making. Securing IoT with the assistance of WSN necessitates the implementation of protective measures to confirm the safety and reliability of the interconnected WSN and IoT components. This research significantly advances the current state of the art in IoT and WSN security by synergistically harnessing the potential of machine learning and the Firefly Algorithm. The contributions of this work are twofold: firstly, the proposed FA-ML technique exhibits an exceptional capability to enhance intrusion detection accuracy within the WSN-IoT landscape. Secondly, the amalgamation of the Firefly Algorithm and machine learning introduces a novel dimension to the domain of security-oriented optimization techniques. The implications of this research resonate across various sectors, ranging from critical infrastructure protection to industrial automation and beyond, where safeguarding the integrity of interconnected systems are of paramount importance. The amalgamation of cutting-edge machine learning and bio-inspired algorithms marks a pivotal step forward in crafting robust and intelligent security measures for the evolving landscape of IoT-driven technologies. For intrusion detection in the WSN-IoT, the FA-ML method employs a support vector machine (SVM) machine model for classification with parameter tuning accomplished using a Grey Wolf Optimizer (GWO) algorithm. The experimental evaluation is simulated using NSL-KDD Dataset, revealing the remarkable enhancement of the FA-ML technique, achieving a maximum accuracy of 99.34%. In comparison, the KNN-PSO and XGBoost models achieved lower accuracies of 96.42% and 95.36%, respectively. The findings validate the potential of the FA-ML technique as an active security solution for WSN-IoT systems, harnessing the power of machine learning and the Firefly Algorithm to bolster intrusion detection capabilities.

Enhancing Intrusion Detection Using Binary Arithmetic Optimization with Sparse Auto Encoder for Fog-Assisted Wireless Sensor Networks

Enhancing Intrusion Detection Using Binary Arithmetic Optimization with Sparse Auto Encoder for Fog-Assisted Wireless Sensor Networks

Enhanced Intrusion Detection in In-Vehicle Networks Using Advanced Feature Fusion and Stacking-Enriched Learning

Enhanced Intrusion Detection in In-Vehicle Networks Using Advanced Feature Fusion and Stacking-Enriched Learning

Enhancing Intrusion Detection Through Federated Learning With Enhanced Ghost_BiNet and Homomorphic Encryption

Enhancing Intrusion Detection Through Federated Learning With Enhanced Ghost_BiNet and Homomorphic Encryption

Enhancing Intrusion Detection in IoT Networks Through Federated Learning

Enhancing Intrusion Detection in IoT Networks Through Federated Learning

Enhancing intrusion detection performance using explainable ensemble deep learning.

Given the exponential growth of available data in large networks, the need for an accurate and explainable intrusion detection system has become of high necessity to effectively discover attacks in such networks. To deal with this challenge, we propose a two-phase Explainable Ensemble deep learning-based method (EED) for intrusion detection. In the first phase, a new ensemble intrusion detection model using three one-dimensional long short-term memory networks (LSTM) is designed for an accurate attack identification. The outputs of three classifiers are aggregated using a meta-learner algorithm resulting in refined and improved results. In the second phase, interpretability and explainability of EED outputs are enhanced by leveraging the capabilities of SHape Additive exPplanations (SHAP). Factors contributing to the identification and classification of attacks are highlighted which allows security experts to understand and interpret the attack behavior and then implement effective response strategies to improve the network security. Experiments conducted on real datasets have shown the effectiveness of EED compared to conventional intrusion detection methods in terms of both accuracy and explainability. The EED method exhibits high accuracy in accurately identifying and classifying attacks while providing transparency and interpretability.

A GAN-based Hybrid Deep Learning Approach for Enhancing Intrusion Detection in IoT Networks

A GAN-based Hybrid Deep Learning Approach for Enhancing Intrusion Detection in IoT Networks

A Comprehensive Blockchain and ML-Based Model for Enhanced Intrusion Detection

A Comprehensive Blockchain and ML-Based Model for Enhanced Intrusion Detection