Existing Intrusion Detection Systems Research Articles

MULTI-BLOCK: A novel ML-based intrusion detection framework for SDN-enabled IoT networks using new pyramidal structure

The ever-expanding Internet of Things (IoT) landscape faces significant security challenges due to limitations in traffic monitoring, device heterogeneity, and weak security practices, leaving networks vulnerable to multi-target and coordinated attacks like large-scale botnets and Distributed Denial-of-Service (DDoS). Existing intrusion detection systems can be computationally expensive and resource-intensive. This can be problematic for resource-constrained IoT devices with limited processing power, memory, and battery life. This paper proposes MULTI-BLOCK, a novel, multi-module framework that leverages machine learning, stateful P4 processing, and a Software-Defined Networking (SDN)-based multi-controller architecture. MULTI-BLOCK tackles critical management tasks within IoT networks, including synchronized communication, traffic monitoring, intrusion detection, and attack mitigation. This comprehensive framework comprises four modules. The first, the proposed pyramidal conceptually decentralized multi-controller structure (PCDMCS), introduces Decentralized Control Interfaces (DCIs) for real-time threat identification through a Decentralized Warning Conduit (DWC). The second module provides comprehensive network monitoring using P4-enabled 24-state tables. The third module leverages 30 new P4-extracted/calculated features and the Enhanced Weighted Ensemble Algorithm (EWEA) for enhanced anomaly detection. The final module presents a novel mitigation approach with 22 steps distributed across multiple controllers for scalability. Extensive evaluation using established IoT datasets (X-IIoTID, TON_IoT, and Edge-IIoTset) and diverse test scenarios (including single-victim and multi-victim attacks) demonstrates MULTI-BLOCK's exceptional performance, achieving high accuracy (99.75 %), precision (99.32 %), F1-score (99.53 %), recall (99.67 %), specificity (99.60 %), low false positive rates (FPR) (0.40 %), and low Average Detection Time (ADT) (2.11 ms). By offering a robust and adaptable solution against evolving threats, MULTI-BLOCK represents a significant advancement in IoT network security.

A bizarre synthesized cascaded optimized predictor (BizSCOP) model for enhancing security in cloud systems

Due to growing network data dissemination in cloud, the elasticity, pay as you go options, globally accessible facilities, and security of networks have become increasingly important in today's world. Cloud service providers, including AWS, Azure, GCP, and others, facilitate worldwide expansion within minutes by offering decentralized communication network functions, hence providing security to cloud is still remains a challenging task. This paper aims to introduce and evaluate the Biz-SCOP model, a novel intrusion detection system developed for cloud security. The research addresses the pressing need for effective intrusion detection in cloud environments by combining hybrid optimization techniques and advanced deep learning methodologies. The study employs prominent intrusion datasets, including CSE-CIC-IDS 2018, CIC-IDS 2017, and a cloud intrusion dataset, to assess the proposed model's performance. The study's design involves implementing the Biz-SCOP model using Matlab 2019 software on a Windows 10 OS platform, utilizing 8 GB RAM and an Intel core i3 processor. The hybrid optimization approach, termed HyPSM, is employed for feature selection, enhancing the model's efficiency. Additionally, an intelligent deep learning model, C2AE, is introduced to discern friendly and hostile communication, contributing to accurate intrusion detection. Key findings indicate that the Biz-SCOP model outperforms existing intrusion detection systems, achieving notable accuracy (99.8%), precision (99.7%), F1-score (99.8%), and GEO (99.9%). The model excels in identifying various attack types, as demonstrated by robust ROC analysis. Interpretations and conclusions emphasize the significance of hybrid optimization and advanced deep learning techniques in enhancing intrusion detection system performance. The proposed model exhibits lower computational load, reduced false positives, ease of implementation, and improved accuracy, positioning it as a promising solution for cloud security.

Mitigating Missing Rate and Early Cyberattack Discrimination Using Optimal Statistical Approach with Machine Learning Techniques in a Smart Grid

In the Industry 4.0 era of smart grids, the real-world problem of blackouts and cascading failures due to cyberattacks is a significant concern and highly challenging because the existing Intrusion Detection System (IDS) falls behind in handling missing rates, response times, and detection accuracy. Addressing this problem with an early attack detection mechanism with a reduced missing rate and decreased response time is critical. The development of an Intelligent IDS is vital to the mission-critical infrastructure of a smart grid to prevent physical sabotage and processing downtime. This paper aims to develop a robust Anomaly-based IDS using a statistical approach with a machine learning classifier to discriminate cyberattacks from natural faults and man-made events to avoid blackouts and cascading failures. The novel mechanism of a statistical approach with a machine learning (SAML) classifier based on Neighborhood Component Analysis, ExtraTrees, and AdaBoost for feature extraction, bagging, and boosting, respectively, is proposed with optimal hyperparameter tuning for the early discrimination of cyberattacks from natural faults and man-made events. The proposed model is tested using the publicly available Industrial Control Systems Cyber Attack Power System (Triple Class) dataset with a three-bus/two-line transmission system from Mississippi State University and Oak Ridge National Laboratory. Furthermore, the proposed model is evaluated for scalability and generalization using the publicly accessible IEEE 14-bus and 57-bus system datasets of False Data Injection (FDI) attacks. The test results achieved higher detection accuracy, lower missing rates, decreased false alarm rates, and reduced response time compared to the existing approaches.

Enhanced Intrusion Detection Systems Performance with UNSW-NB15 Data Analysis

The rapid proliferation of new technologies such as Internet of Things (IoT), cloud computing, virtualization, and smart devices has led to a massive annual production of over 400 zettabytes of network traffic data. As a result, it is crucial for companies to implement robust cybersecurity measures to safeguard sensitive data from intrusion, which can lead to significant financial losses. Existing intrusion detection systems (IDS) require further enhancements to reduce false positives as well as enhance overall accuracy. To minimize security risks, data analytics and machine learning can be utilized to create data-driven recommendations and decisions based on the input data. This study focuses on developing machine learning models that can identify cyber-attacks and enhance IDS system performance. This paper employed logistic regression, support vector machine, decision tree, and random forest algorithms on the UNSW-NB15 network traffic dataset, utilizing in-depth exploratory data analysis, and feature selection using correlation analysis and random sampling to compare model accuracy and effectiveness. The performance and confusion matrix results indicate that the Random Forest model is the best option for identifying cyber-attacks, with a remarkable F1 score of 97.80%, accuracy of 98.63%, and low false alarm rate of 1.36%, and thus should be considered to improve IDS system security.

Hybrid wrapper feature selection method based on genetic algorithm and extreme learning machine for intrusion detection

Intrusion detection systems play a critical role in the mitigation of cyber-attacks on the Internet of Things (IoT) environment. Due to the integration of many devices within the IoT environment, a huge amount of data is generated. The generated data sets in most cases consist of irrelevant and redundant features that affect the performance of the existing intrusion detection systems (IDS). The selection of optimal features plays a critical role in the enhancement of intrusion detection systems. This study proposes a sequential feature selection approach using an optimized extreme learning machine (ELM) with an SVM (support vector machine) classifier. The main challenge of ELM is the selection of the input parameters, which affect its performance. In this study, the genetic algorithm (GA) is used to optimize the weights of ELM to boost its performance. After the optimization, the algorithm is applied as an estimator in the sequential forward selection (wrapper technique) to select key features. The final obtained feature subset is applied for classification using SVM. The IoT_ToN network and UNSWNB15 datasets were used to test the model's performance. The performance of the model was compared with other existing state-of-the-art classifiers such as k-nearest neighbors, gradient boosting, random forest, and decision tree. The model had the best quality of the selected feature subset. The results indicate that the proposed model had a better intrusion detection performance with 99%, and 86% accuracy for IoT_ToN network dataset and UNSWNB15 datasets, respectively. The model can be used as a promising tool for enhancing the classification performance of IDS datasets.

Evaluating modern intrusion detection methods in the face of Gen V multi-vector attacks with fuzzy AHP-TOPSIS.

The persistent evolution of cyber threats has given rise to Gen V Multi-Vector Attacks, complex and sophisticated strategies that challenge traditional security measures. This research provides a complete investigation of recent intrusion detection systems designed to mitigate the consequences of Gen V Multi-Vector Attacks. Using the Fuzzy Analytic Hierarchy Process (AHP) and the Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS), we evaluate the efficacy of several different intrusion detection techniques in adjusting to the dynamic nature of sophisticated cyber threats. The study offers an integrated analysis, taking into account criteria such as detection accuracy, adaptability, scalability, resource effect, response time, and automation. Fuzzy AHP is employed to establish priority weights for each factor, reflecting the nuanced nature of security assessments. Subsequently, TOPSIS is employed to rank the intrusion detection methods based on their overall performance. Our findings highlight the importance of behavioral analysis, threat intelligence integration, and dynamic threat modeling in enhancing detection accuracy and adaptability. Furthermore, considerations of resource impact, scalability, and efficient response mechanisms are crucial for sustaining effective defense against Gen V Multi-Vector Attacks. The integrated approach of Fuzzy AHP and TOPSIS presents a strong and adaptable strategy for decision-makers to manage the difficulties of evaluating intrusion detection techniques. This study adds to the ongoing discussion about cybersecurity by providing insights on the positive and negative aspects of existing intrusion detection systems in the context of developing cyber threats. The findings help organizations choose and execute intrusion detection technologies that are not only effective against existing attacks, but also adaptive to future concerns provided by Gen V Multi-Vector Attacks.

Clustering based Intrusion Detection System for effective Detection of known and Zero-day Attacks

Developing effective security measures is the most challenging task now a days and hence calls for the development of intelligent intrusion detection systems. Most of the existing intrusion detection systems perform best at detecting known attacks but fail to detect zero-day attacks due to the lack of labeled examples. Authors in this paper, comes with a clustering-based IDS framework that can effectively detect both known and zero-day attacks by following unsupervised machine learning techniques. This research uses NSL-KDD dataset for the motive of experimentation and the experimental results exhibit best performance with an accuracy of 78%.

Unsupervised GAN-Based Intrusion Detection System Using Temporal Convolutional Networks and Self-Attention

Fifth-generation (5G) networks provide connectivity to a massive number of devices and boost a plethora of applications in several different domains. However, the large adoption of connected devices increases attack surfaces and introduces several security threats that can severely damage physical objects and risk people’s lives. Despite existing intrusion detection systems (IDSs), there are still several challenges to be addressed in the detection of cyber-attacks. For instance, while unsupervised IDSs are required to detect zero-day attacks, they usually present high false positive rates. Moreover, most existing IDSs rely on long short-term memory (LSTM) networks to consider time-dependencies among data. However, LSTM networks have recently been shown to present several drawbacks and limitations, which put into question their performance on sequence modeling tasks. Thus, in this paper, we investigate generative adversarial networks (GANs), a promising unsupervised approach to detecting attacks by implicitly modeling systems, and alternatives to LSTM networks to consider temporal dependencies among data. We propose a novel unsupervised GAN-based IDS that uses temporal convolutional networks (TCNs) and self-attention to detect cyber-attacks. The proposed IDS leverages edge computing and is proposed for edge servers, which bring computation resources closer to end nodes. Experiment results show that our proposed IDS can be configured to satisfy different detection rate and detection time requirements. Moreover, they show that our IDS is more accurate and at least 3.8 times faster than two state-of-the-art GAN-based IDSs that are used as baselines.

Securing smart home against sinkhole attack using weight‐based IDS placement strategy

AbstractExtensive use of the Internet of Things (IoT) in smart homes makes users' lives easy and comfortable. Yet, these resource‐constrained devices are prone to manifold security attacks. The sinkhole attack is one of the most destructive attacks that disrupt smart home operations, causing user dissatisfaction. Existing intrusion detection systems (IDS) cannot handle sinkhole attacks competently as they (i) do not consider the node capacity for being an IDS agent, leading to a low attack detection ratio, (ii) do not examine the sinkhole node's role when mitigating attacks, causing remaining network disconnection with the root node and (iii) do not consider replacing energy‐exhausted IDS nodes, causing connectivity loss of partial network with the root. This paper addresses these shortcomings and adequately presents a mechanism to handle sinkhole attacks. A formulation for assigning weights to network nodes based on their resources is proposed here. An IDS placement strategy is introduced to place IDS agents on particular resourceful nodes that extend network lifetime and enhance attack detection capability. We present a novel attack detection and mitigation strategy by ensuring network connectivity. The proposed mechanism achieves 95% attack detection accuracy and reduces false negative rates by 25% and energy consumption reasonably compared to the state‐of‐the‐art.

FL-CTIF: A federated learning based CTI framework based on information fusion for secure IIoT

Industrial Internet of Things (IIoT) are evolving and transitioning into virtual entities supported by digital twin technology to optimize existing processes further and improve their efficiency. The virtual representation of the several IIoT departments, such as manufacturing process, packaging, warehousing, and logistics enables predictive maintenance for optimizing local material resources for manufacturing and packaging, improved warehouse space allocation, and delivery schedule optimization. The high volume of data generated from IoT devices are exposed to cyber-attacks using modern attack vectors and thus threaten both physical IIoT environment and its digital twins. Existing intrusion detection systems focus on identifying anomalous traffic using obsolete knowledge of cyber-attack patterns for several attacks, such as ARP poisoning man-in-the-middle attacks, SSL-based attacks using encrypted traffic, and DNS flood-based DDoS traffic. A lack of focus on security using updated and comprehensive Cyber Threat Intelligence (CTI) threatens the security of the IIoT environment. In this paper, we present a Federated Learning based CTI framework based on Information Fusion (FL-CTIF) for securing IIoT environments. We design a comprehensive cyberattack dataset with updated feature selection using Information Fusion to improve the accuracy in identifying cyber-attacks. A federated learning-based ANN model is designed to reduce the model training rounds based on satisfaction level and measure the absence of improvement in each attack vector's average accuracy. The model is evaluated based on model aggregation performance and demonstrates an improved F1 score based on reduced training rounds and reduced CPU consumption. The federated learning model improves accuracy and reduces the false positive rate using the newly merged dataset compared to existing research.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The industrial internet of things (IIoT) is an evolutionary extension of the traditional Internet of Things (IoT) into processes and machines for applications in the industrial sector. The IIoT systems generate a large amount of private and sensitive data i.e., stored and processed somewhere on the cloud-edge continuum. The IIoT devices, and the IIoT networks are subject to security mechanisms such as intelligent Intrusion Detection and Prevention Systems (IDS/IPS) systems, that can detect and respond unseen malicious network attacks. The adoption of centralized machine learning methods for IDS has become impractical due to the high computational cost and privacy concerns associated with storing large amounts of data on a single server along the cloud-edge continuum. The combination of federated learning and Blockchain has emerged as a promising advancement in addressing the challenge. Federated learning distributes learning to individual IIoT devices without compromising data privacy, while Blockchain enhances privacy and security. Many academic and industrial efforts outline IDS mechanisms using machine learning, deep learning, federated learning, and Blockchain technologies. The utilization of federated learning-based IDS has become increasingly popular and is now being applied to various tasks including IDS/IPS systems. However, existing intrusion detection systems (IDSs) survey are limited to the scope of classical machine learning and deep learning. To address this limitation, we analyze the IIoT literature that integrates Blockchain and federated learning to enhance IDSs and improve its threat detection capabilities. This survey explores the role of Blockchain and federated learning in addressing security and privacy issues, particularly those associated with IDS/IPS in IIoT networks. Insights on the possibilities of machine learning, federated learning, and Blockchain in supporting IDS to monitor IIoT network traffic for anomaly detection are discussed in detail through state of the art. Furthermore, we provide a set of recommendation based on our literature for the effective implementation of a Blockchain and federated learning-based network intrusion detection system. Finally, we summarize the study and highlight challenges as future research directions for Blockchain and Federated Learning-based technologies for cybersecurity and intrusion detection in IIoT.

An artificial immunity based intrusion detection system for unknown cyberattacks

The evolving unknown cyberattacks have rapidly expanded the cyber threat landscape. Identifying unknown cyberattacks, therefore, remains a challenging issue, compounded by the widespread implementation of emerging technologies, such as 5G, digital twin, etc. However, most existing intrusion detection systems (IDSs) are effective in detecting only known cyberattacks. In this paper, inspired by artificial immunity (AIm), we propose a hierarchical differential evolution based IDS, coined HiDE-IDS, to identify unknown cyberattacks. Specifically, we first map the multidimensional normal and abnormal network samples to self antigens and nonself antigens, respectively, in a multidimensional geometrical space. Second, a hierarchical differential evolution algorithm for self antigens is designed, to create newly-evolved antigens possibly used for generating cyberattack detectors. Third, a novel filtering mechanism is developed to eliminate invalid new antigens falling into the coverage of either known self or nonself antigens. Last, the remaining new antigens are employed to generate new detectors and further identify known and unknown cyberattacks. Extensive experiments demonstrate that the training efficiency of the proposed HiDE-IDS is significantly improved than recent IDSs. More importantly, while showing a favorable false positive rate of normal data, the HiDE-IDS achieves outperformed effectiveness in recognizing unknown cyberattacks (as well as known cyberattacks) compared to the state-of-the-art studies.

Hourly Network Anomaly Detection on HTTP Using Exponential Random Graph Models and Autoregressive Moving Average

Network anomaly detection solutions can analyze a network’s data volume by protocol over time and can detect many kinds of cyberattacks such as exfiltration. We use exponential random graph models (ERGMs) in order to flatten hourly network topological characteristics into a time series, and Autoregressive Moving Average (ARMA) to analyze that time series and to detect potential attacks. In particular, we extend our previous method in not only demonstrating detection over hourly data but also through labeling of nodes and over the HTTP protocol. We demonstrate the effectiveness of our method using real-world data for creating exfiltration scenarios. We highlight how our method has the potential to provide a useful description of what is happening in the network structure and how this can assist cybersecurity analysts in making better decisions in conjunction with existing intrusion detection systems. Finally, we describe some strengths of our method, its accuracy based on the right selection of parameters, as well as its low computational requirements.

Agnostic CH-DT Technique for SCADA Network High-Dimensional Data-Aware Intrusion Detection System

The pervasiveness in the industrial internet of things (IIoT) due to the application of supervisory control and data acquisition (SCADA) has led to the growth of heterogeneous sensor data, thereby increasing the risk of intrusions and attacks. The existence and effect of intruders and their innovative attack techniques are on the rise. Existing intrusion detection systems (IDS) tend to be computationally expensive with this form of data due to the presence of noise. In real-time domains, available methods lag, necessitating additional research into effective feature extraction schemes, which is fundamental in machine learning (ML) for time exigency. This study, in a comparative analysis of some feature selection techniques (FS), proposes a combination of an efficient ML classifier and an agnostic feature selection (FS) scheme for attack detection and classification in a real-time SCADA network. The flexibility and interoperability of the proposed approach resolve the computational complexity of vulnerability detection schemes while reducing false alarm rates (FAR) and overall model execution time. With the view of an online preprocessing, the proposed technique is phased thus: (i) data preparatory consisting of data cleansing and normalization followed by (ii) the combination of a pre-pruned decision tree (DT) algorithm and an agnostic Chi-square FS approach built to obtain an optimal subset of data features for efficient IDS. (iii) Evaluation of proposed agnostic DT-CH and other FS candidates for anomaly detection.

IDSoft: A federated and softwarized intrusion detection framework for massive internet of things in 6G network

With the rollout of sixth generation (6G)–enabled massive internet of things (IoT) networks, the amount of data generated by IoT devices is expected to grow tremendously. Therefore, existing intrusion detection system (IDS) technology may not be sufficient to meet the scale and accuracy requirements for securing massive IoT. To overcome this shortcoming, edge intelligence–empowered next-generation (NextGen) IDSs utilize federated learning (FL) architectures. Nonetheless, to explore the full potential of federated IDSs, convergence and intercommunication overhead require some attention. One solution is softwarization and virtualization, which can increase network scalability and provide innovative security infrastructure for NextGen IDSs, offering holistic coverage and visibility to the entire network. In this line, we propose IDSoft, a novel softwarized solution that resides across the network infrastructure and leverages 6G enabling technologies, such as network function virtualization, mobile edge computing, and software-defined networking, to support FL-based IDSs. IDSoft is a scalable solution aimed at providing rapid and accurate detection combined with adaptive mitigation of large-scale cyberattacks while optimizing network resources. In this work, we analyze existing anomaly-based IDS approaches in IoT networks and focus on designing a hierarchical FL (HFL) framework for intrusion detection in IDSoft with synchronous and asynchronous aggregation and an additional offloading mechanism to enhance its performance. The numerical results demonstrate that the proposed HFL solution significantly reduces communication overhead, accelerates convergence, and promises greater scalability. Finally, future research trends are discussed.

Enhancing the Efficiency of Attack Detection System Using Feature selection and Feature Discretization Methods

Intrusion detection technologies have grown in popularity in recent years using machine learning. The variety of new security attacks are increasing, necessitating the development of effective and intelligent countermeasures. The existing intrusion detection system (IDS) uses Signature or Anomaly based detection systems with machine learning algorithms to detect malicious activities. The Signature-based detection rely only on signatures that have been pre-programmed into the systems, detect known attacks and cannot detect any new or unusual activity. The Anomaly based detection using supervised machine learning algorithm detects only known threats. To address this issue, the proposed model employs an unsupervised machine learning approach for detecting attacks. This approach combines the Sub Space Clustering and One Class Support Vector Machine algorithms and utilizes feature selection methods such as Chi-square, as well as Feature Discretization Methods like Equal Width Discretization to identify both known and undiscovered assaults. The results of the experiments using proposed model outperforms several of the existing system in terms of detection rate and accuracy and decrease in the computational time.

Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks

Internet of things (IoT) has become an emerging technology transforming everyday physical objects to be smarter by using underlying technologies such as sensor networks. The routing protocol for low-power and lossy networks (RPL) is considered one of the promising protocols designed for the IoT networks. However, due to the constrained nature of the IoT devices in terms of memory, processing power, and network capabilities, they are exposed to many security attacks. Unfortunately, the existing Intrusion Detection System (IDS) approaches using machine learning that have been proposed to detect and mitigate security attacks in internet networks are not suitable for analyzing IoT traffics. This paper proposed an IDS system using the hybridization of supervised and semi-supervised deep learning for network traffic classification for known and unknown abnormal behaviors in the IoT environment. In addition, we have developed a new IoT specialized dataset named IoTR-DS, using the RPL protocol. IoTR-DS is used as a use case to classify three known security attacks (DIS, Rank, and Wormhole). The proposed Hybrid DL-Based IDS is evaluated and compared to some existing ones, and the results are promising. The evaluation results show an accuracy detection rate of 98% and 92% in f1-score for multi-class attacks when using pre-trained attacks (known traffic) and an average accuracy of 95% and 87% in f1-score when predicting untrained attacks for two attack behaviors (unknown traffic).

A Deep Learning Method for Lightweight and Cross-Device IoT Botnet Detection

Ensuring security of Internet of Things (IoT) devices in the face of threats and attacks is a primary concern. IoT plays an increasingly key role in cyber–physical systems. Many existing intrusion detection systems (IDS) proposals for the IoT leverage complex machine learning architectures, which often provide one separate model per device or per attack. These solutions are not suited to the scale and dynamism of modern IoT networks. This paper proposes a novel IoT-driven cross-device method, which allows learning a single IDS model instead of many separate models atop the traffic of different IoT devices. A semi-supervised approach is adopted due to its wider applicability for unanticipated attacks. The solution is based on an all-in-one deep autoencoder, which consists of training a single deep neural network with the normal traffic from different IoT devices. Extensive experimentation performed with a widely used benchmarking dataset indicates that the all-in-one approach achieves within 0.9994–0.9997 recall, 0.9999–1.0 precision, 0.0–0.0071 false positive rate and 0.9996–0.9998 F1 score, depending on the device. The results obtained demonstrate the validity of the proposal, which represents a lightweight and device-independent solution with considerable advantages in terms of transferability and adaptability.

Central Aggregator Intrusion Detection System for Denial of Service Attacks

Vehicle-to-grid technology is an emerging field that allows unused power from Electric Vehicles (EVs) to be used by the smart grid through the central aggregator. Since the central aggregator is connected to the smart grid through a wireless network, it is prone to cyber-attacks that can be detected and mitigated using an intrusion detection system. However, existing intrusion detection systems cannot be used in the vehicle-to-grid network because of the special requirements and characteristics of the vehicle-to-grid network. In this paper, the effect of denial-of-service attacks of malicious electric vehicles on the central aggregator of the vehicle-to-grid network is investigated and an intrusion detection system for the vehicle-to-grid network is proposed. The proposed system, central aggregator–intrusion detection system (CA-IDS), works as a security gateway for EVs to analyze and monitor incoming traffic for possible DoS attacks. EVs are registered with a Central Aggregator (CAG) to exchange authenticated messages, and malicious EVs are added to a blacklist for violating a set of predefined policies to limit their interaction with the CAG. A denial of service (DoS) attack is simulated at CAG in a vehicle-to-grid (V2G) network manipulating various network parameters such as transmission overhead, receiving capacity of destination, average packet size, and channel availability. The proposed system is compared with existing intrusion detection systems using different parameters such as throughput, jitter, and accuracy. The analysis shows that the proposed system has a higher throughput, lower jitter, and higher accuracy as compared to the existing schemes.

EEFED: Personalized Federated Learning of Execution&Evaluation Dual Network for CPS Intrusion Detection

In the modern interconnected world, intelligent networks and computing technologies are increasingly being incorporated in industrial systems. However, this adoption of advanced technology has resulted in increased cyber threats to cyber-physical systems. Existing intrusion detection systems are continually challenged by constantly evolving cyber threats. Machine learning algorithms have been applied for intrusion detection. In these techniques, a classification model is trained by learning cyber behavior patterns. However, these models typically require considerable high-quality datasets. Limited attack samples are available because of the unpredictability and constant evolution of cyber threats. To address these problems, we propose a novel federated Execution & Evaluation dual network framework (EEFED), which allows multiple federal participants to personalize their local detection models undermining the original purpose of Federated Learning. Thus, a general global detection model was developed for collaboratively improving the performance of a single local model against cyberattacks. The proposed personalized update algorithm and the optimizing backtracking parameters replacement policy effectively reduced the negative influence of federated learning in imbalanced and non-i.i.d distribution of data. The proposed method improved model stability. Furthermore, extensive experiments conducted on a network dataset in various cyber scenarios revealed that the proposed method outperformed single model and state-of-the-art methods.