Intrusion Detection Framework Research Articles

End-to-End Network Intrusion Detection Based on Contrastive Learning.

The network intrusion detection system (NIDS) plays a crucial role as a security measure in addressing the increasing number of network threats. The majority of current research relies on feature-ready datasets that heavily depend on feature engineering. Conversely, the increasing complexity of network traffic and the ongoing evolution of attack techniques lead to a diminishing distinction between benign and malicious network behaviors. In this paper, we propose a novel end-to-end intrusion detection framework based on a contrastive learning approach. We design a hierarchical Convolutional Neural Network (CNN) and Gated Recurrent Unit (GRU) model to facilitate the automated extraction of spatiotemporal features from raw traffic data. The integration of contrastive learning amplifies the distinction between benign and malicious network traffic in the representation space. The proposed method exhibits enhanced detection capabilities for unknown attacks in comparison to the approaches trained using the cross-entropy loss function. Experiments are carried out on the public datasets CIC-IDS2017 and CSE-CIC-IDS2018, demonstrating that our method can attain a detection accuracy of 99.9% for known attacks, thus achieving state-of-the-art performance. For unknown attacks, a weighted recall rate of 95% can be achieved.

Deep self-taught learning framework for intrusion detection in cloud computing environment

<p>Cloud has become a target-rich environment for malicious attacks by cyber intruders. Security is a major concern and remains an obstacle to the adoption of cloud computing. The intrusion detection system (IDS) is regarded as defense-in-depth. Unfortunately, most machine learning approaches designed for cloud intrusion detection require large amounts of labeled attack samples, but in real practice, they are limited. Therefore, the key impetus of this work is to introduce self-taught learning (STL) combining stacked sparse autoencoder (SSAE) with long short-term memory (LSTM) as a candidate solution to learn the robust feature representation and efficiently improve the performance of IDS with respect to false alarm rate (FAR) and detection rate (DR). Accordingly, the proposed approach as a first step employs SSAE to achieve dimensional reduction by learning the discriminative features from network traffic. The approach adopts LSTM to recognize the intrusion with the features encoded by SSAE. To evaluate the detective performance of our model, a comprehensive set of experiments are conducted on NSL-KDD. Also, ablation experiments are conducted to show the contribution of each component of our approach. Further, the comparative analysis shows the efficacy of our approach against the existing approaches with an accuracy of 86.31%.</p>

An adaptive RFID anti-collision algorithm for network intrusion detection

Radio frequency identification (RFID) provides real-time network monitoring capabilities for threat identification. However, accurate detection is impeded by tag interference. This paper presents an adaptive collision tree algorithm that selects optimal binary or octal splits based on collision counts to handle interference. Experiments demonstrate an integrated RFID intrusion detection framework that achieves 8.98% higher throughput and 99.82% detection accuracy compared to other protocols. The method enables efficient real-time threat identification as networks proliferate. However, there are limitations to the approach, such as assumptions of fixed tag populations rather than dynamic tags and a lack of field testing. To strengthen the approach, further research on fluctuating tags and validation in real-world network deployments is necessary. This work presents an adaptive method for leveraging RFID to achieve scalable and accurate network intrusion detection.

Intrusion Detection System for Autonomous Vehicles Using Non-Tree Based Machine Learning Algorithms

This research work highlights significant achievements in the domain of intrusion detection systems (IDSs) for autonomous vehicles, which are crucial in enhancing their safety, reliability, and cybersecurity. This study introduces an approach that leverages non-tree-based machine learning algorithms, such as K-nearest neighbors and ensemble learning, to develop an IDS tailored for autonomous vehicles. These algorithms were employed because of their ability to process complex and large datasets with less likeliness for overfitting, their scalability, and their ability to adapt to changing conditions in real time. These algorithms effectively handle imbalanced data, enhancing the detection accuracy of both normal and intrusive instances. The IDS’s performance was validated through the utilization of three real-world datasets, CAN intrusion, CICIDS2017, and NSL-KDD, where the proposed non-tree-based IDS (NTB-MTH-IDS) was measured with the standard measurement metrics: accuracy, precision, F1-score, and recall, including specificity and sensitivity. Notably, the results indicate that K-nearest neighbors and stacking, as part of NTB-MTH-IDS, has an accuracy of 99.00%, 98.57%, and 97.57%, and F1-scores of 99.00%, 98.79%, and 97.54% in the CICIDS2017, NSL-KDD, and CAN datasets, respectively. The results of this research can lead to establishing a robust intrusion detection framework, thereby ensuring the safety and reliability of autonomous vehicles. Through this achievement, road users, passengers, and pedestrians are safeguarded against the consequences of potential cyber threats.

An integrated intrusion detection framework based on subspace clustering and ensemble learning

In the rapidly evolving landscape of the Internet of Things (IoT), ensuring robust intrusion detection is paramount for device and data security. This paper proposes a novel method for intrusion detection in IoT networks that leverages a unique blend of subspace clustering and ensemble learning. Our framework integrates three innovative strategies: Clustering Results as Features (CRF), Two-Level Decision Making (TDM), and Iterative Feedback Loop (IFL). These strategies synergize to enhance detection performance and model robustness. We employ mutual information for feature selection and utilize four subspace clustering algorithms – CLIQUE, PROCLUS, SUBCLU, and LOF – to create additional feature sets. Three base learners – NB, LGBM, and XGB – are used in conjunction with a Logistic Regression (LR) meta-learner. To fine-tune our model, we apply Particle Swarm Optimization (PSO) for hyperparameter optimization. We evaluate our framework on the UNSW-NB15 dataset, which contains realistic and diverse IoT network traffic data. The results show that our framework outperforms the state-of-the-art methods in terms of accuracy (97.05%), precision (96.33%), recall (96.55%), F1-score (96.45%), and false positive rate (0.029). Our framework can effectively detect both known and unknown attacks in IoT networks and achieve high accuracy and low false positive rate. The paper contributes both practical implications for network security and theoretical advancements in intrusion detection research.

Detection of Data imbalance in MANET network based on ADSY-AEAMBi-LSTM with DBO Feature selection

<p>A Mobile Ad Hoc Network (MANET) is a temporary wireless network formed by mobile nodes. These nodes cooperate to relay information in a multi-hop fashion, but some malicious nodes can disrupt the network by providing false routing information. Traditional firewalls and encryption methods can’t keep up with the increasing diversity of network threats. To address these issues, Intrusion Detection Systems (IDS) have been developed. In this paper, a new intrusion detection framework named ADSY-AEAMBi-LSTM is introduced. This acronym stands for a bidirectional Long Short-Term Memory (LSTM) model and an adaptive synthetic auto-encoder attention mechanism. The Dung Beetle Optimizer is used to identify optimal features after data preprocessing, followed by classification using ADSY-AEAMBi-LSTM. The study evaluates this model using three datasets: CIC-IDS 2017, UNSW-NB15, and WSN-DS.</p>

A novel IoT intrusion detection framework using Decisive Red Fox optimization and descriptive back propagated radial basis function models

The Internet of Things (IoT) is extensively used in modern-day life, such as in smart homes, intelligent transportation, etc. However, the present security measures cannot fully protect the IoT due to its vulnerability to malicious assaults. Intrusion detection can protect IoT devices from the most harmful attacks as a security tool. Nevertheless, the time and detection efficiencies of conventional intrusion detection methods need to be more accurate. The main contribution of this paper is to develop a simple as well as intelligent security framework for protecting IoT from cyber-attacks. For this purpose, a combination of Decisive Red Fox (DRF) Optimization and Descriptive Back Propagated Radial Basis Function (DBRF) classification are developed in the proposed work. The novelty of this work is, a recently developed DRF optimization methodology incorporated with the machine learning algorithm is utilized for maximizing the security level of IoT systems. First, the data preprocessing and normalization operations are performed to generate the balanced IoT dataset for improving the detection accuracy of classification. Then, the DRF optimization algorithm is applied to optimally tune the features required for accurate intrusion detection and classification. It also supports increasing the training speed and reducing the error rate of the classifier. Moreover, the DBRF classification model is deployed to categorize the normal and attacking data flows using optimized features. Here, the proposed DRF-DBRF security model's performance is validated and tested using five different and popular IoT benchmarking datasets. Finally, the results are compared with the previous anomaly detection approaches by using various evaluation parameters.

Securing Cyber-Physical Systems: A Decentralized Framework for Collaborative Intrusion Detection with Privacy Preservation

Securing Cyber-Physical Systems: A Decentralized Framework for Collaborative Intrusion Detection with Privacy Preservation

A Traffic Analysis and Node Categorization- Aware Machine Learning-Integrated Framework for Cybersecurity Intrusion Detection and Prevention of WSNs in Smart Grids

A Traffic Analysis and Node Categorization- Aware Machine Learning-Integrated Framework for Cybersecurity Intrusion Detection and Prevention of WSNs in Smart Grids

Securing Cyber-Physical Systems: A Decentralized Framework for Collaborative Intrusion Detection with Privacy Preservation

Securing Cyber-Physical Systems: A Decentralized Framework for Collaborative Intrusion Detection with Privacy Preservation

DFSat: Deep Federated Learning for Identifying Cyber Threats in IoT-based Satellite Networks

The integration of satellite systems with smart computing and networking technologies, such as the Internet of Things (IoT), has intensely augmented sophisticated cyberattacks against satellite environments. Resisting cyber threats to complex and large-scale satellite configurations has been enormously challenging, owing to the deficiency of high-quality samples of attack data collected from distributed satellite networks. This study proposes a novel federated learning-based deep learning framework for intrusion detection, named DFSat, to identify cyberattacks from IoT-integrated satellite networks. We develop a distributed deep learning-enabled attack detection method using a recurrent neural network. We then build a federated learning architecture which, utilizes several IoT-integrated satellite networks to preserve the privacy and security of DFSat's parameters throughout the learning process. Extensive experiments have been conducted using communication rounds on an IoT-based network dataset to validate the efficiency of DFSat. The results revealed that the proposed framework significantly distinguishes complex cyberattacks, outperforming recent state-of-the-art intrusion detection techniques, validating its usefulness as a viable deployment framework in IoT-integrated satellite networks.

BR-HIDF: An Anti-Sparsity and Effective Host Intrusion Detection Framework Based on Multi-Granularity Feature Extraction

BR-HIDF: An Anti-Sparsity and Effective Host Intrusion Detection Framework Based on Multi-Granularity Feature Extraction

Binarized Spiking Neural Network with blockchain based intrusion detection framework for enhancing privacy and security in cloud computing environment

Cloud computing (CC) is prone to attacks, which upsurges complication and erudition. By this, its origins provocative implications can enterprise data veracity, concealment, and accessibility. To overwhelm these issues, a Binarized Spiking Neural Network with block chain based deputized proof of stake consensus (DPoS) algorithm fostered intrusion detection scheme is proposed in this manuscript to enhance the privacy and the security on the cloud computing Environment (EP-DPoSBC-ES-BS4NN-IDS-CC). The data is amassed from NSL-KDD benchmark dataset. The first-level privacy process is carried with block chain based deputized proof of stake consensus (DPoS) algorithm. The secondary level privacy process is carried out by utilizing the pre-processing and the feature selection process. For, pre-processing, proposed Basic interlude gradient filtering (BIGF) are utilized to eradicate the unsolicited content and filtering pertinent data. The pre-processing outcome is supplied to the feature selection phase. Here, the ideal features are taken with the help of Weightiness espoused feature assortment approaches (WEFA). The data is classified as normal or abnormal based on Binarized Spiking Neural Network. Subsequently, the proposed EP-DPoSBC-ES-BS4NN-IDS-CC is examined under some performance metrics. The proposed technique attains 12.94 %, 17.68 %, 17.99 % and 13.96 % improved accuracy; 59.9 %, 50 %, 31.45 % and 48.17 % lower Computation Time and 3.19 %, 0.83 %, 2.1 % and 5.43 % higher AUC than the existing methods. Customers and cloud service providers may find this framework useful as a decision-support tool in helping them move their data in a safe, timely, and reliable manner. In future work, a prototype of the approach will develop in real-world scenario, capably inside a tight network of connected computers. It allows evaluate effectively in real-world utility.

CANShield: Deep-Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal Level

CANShield: Deep-Learning-Based Intrusion Detection Framework for Controller Area Networks at the Signal Level

A Cryptographic based I2ADO-DNN Security Framework for Intrusion Detection in Cloud Systems

Cloud computing's popularity and success are directly related to improvements in the use of Information and Communication Technologies (ICT). The adoption of cloud implementation and services has become crucial due to security and privacy concerns raised by outsourcing data and business applications to the cloud or a third party. To protect the confidentiality and security of cloud networks, a variety of Intrusion Detection System (IDS) frameworks have been developed in the conventional works. However, the main issues with the current works are their lengthy nature, difficulty in intrusion detection, over-fitting, high error rate, and false alarm rates. As a result, the proposed study attempts to create a compact IDS architecture based on cryptography for cloud security. Here, the balanced and normalized dataset is produced using the z-score preprocessing procedure. The best attributes for enhancing intrusion detection accuracy are then selected using an Intelligent Adorn Dragonfly Optimization (IADO). In addition, the trained features are used to classify the normal and attacking data using an Intermittent Deep Neural Network (IDNN) classification model. Finally, the Searchable Encryption (SE) mechanism is applied to ensure the security of cloud data against intruders. In this study, a thorough analysis has been conducted utilizing various parameters to validate the intrusion detection performance of the proposed I2ADO-DNN model.

LDA-ID: An LDA-based framework for real-time network intrusion detection

Network intrusion poses a severe threat to the Internet. However, existing intrusion detection models cannot effectively distinguish different intrusions with high-degree feature overlap. In addition, efficient real-time detection is an urgent problem. To address the two above problems, we propose a Latent Dirichlet Allocation topic model-based framework for real-time network Intrusion Detection (LDA-ID), consisting of static and online LDA-ID. The problem of feature overlap is transformed into static LDA-ID topic number optimization and topic selection. Thus, the detection is based on the latent topic features. To achieve efficient real-time detection, we design an online computing mode for static LDA-ID, in which a parameter iteration method based on momentum is proposed to balance the contribution of prior knowledge and new information. Furthermore, we design two matching mechanisms to accommodate the static and online LDA-ID, respectively. Experimental results on the public NSL-KDD and UNSW-NB15 datasets show that our framework gets higher accuracy than the others.

Retracted: An AI-Driven Hybrid Framework for Intrusion Detection in IoT-Enabled E-Health

Retracted: An AI-Driven Hybrid Framework for Intrusion Detection in IoT-Enabled E-Health

Intrusion detection system for cyberattacks in the Internet of Vehicles environment

This paper presents a novel framework for intrusion detection specially designed for cyberattacks, such as Denial-of-Service, Distributed Denial-of-Service, Distributed Reflection Denial-of-Service, Brute Force, Botnets, and Sniffing, on vehicles that are situated in the Internet of Vehicles environment. We propose an intrusion detection system based on machine learning that is capable of detecting abnormal behavior by examining network traffic to find unusual data flows. In this paper, we have presented a strategy for intrusion detection through a careful evaluation and selection of the most effective techniques for the following steps of the machine learning process: (i) data preprocessing by using Z-score normalization that preserves the data distribution for the proposed method and handles outliers; (ii) feature selection by using a regression model that simplifies the model complexity and reduces the execution time; and (iii) model selection and training – Random Forest, Extreme Gradient Boosting, Categorical Boosting, Light Gradient Boosting Machine – with hyperparameter optimization to control the behavior in the training phase and to prevent overfitting. The effectiveness of the proposed solution is demonstrated by extensive numerical experiments carried out using the well-known standard datasets CIC-IDS-2017, CSE-CIC-IDS-2018, and CIC-DDoS-2019, both separately and merged. We achieved a high accuracy above 99.8% within a running time of 46.9 s and 0.24 s detection time for the three combined intrusion detection system datasets, thereby showing that the proposed intrusion detection system outperforms the previous methods introduced in the literature.

Learning autoencoder ensembles for detecting malware hidden communications in IoT ecosystems

AbstractModern IoT ecosystems are the preferred target of threat actors wanting to incorporate resource-constrained devices within a botnet or leak sensitive information. A major research effort is then devoted to create countermeasures for mitigating attacks, for instance, hardware-level verification mechanisms or effective network intrusion detection frameworks. Unfortunately, advanced malware is often endowed with the ability of cloaking communications within network traffic, e.g., to orchestrate compromised IoT nodes or exfiltrate data without being noticed. Therefore, this paper showcases how different autoencoder-based architectures can spot the presence of malicious communications hidden in conversations, especially in the TTL of IPv4 traffic. To conduct tests, this work considers IoT traffic traces gathered in a real setting and the presence of an attacker deploying two hiding schemes (i.e., naive and “elusive” approaches). Collected results showcase the effectiveness of our method as well as the feasibility of deploying autoencoders in production-quality IoT settings.

A Hybrid Classification Framework for Network Intrusion Detection with High Accuracy and Low Latency

Network intrusion detection (NIDS) is a crucial task aimed at safeguarding computer networks against malicious attacks. Traditional NIDS methods can be categorized as either misuse-based or anomaly-based, each having its unique set of limitations. Misuse-based approaches excel in identifying known attacks but fall short when dealing with new or unidentified attack patterns. On the other hand, anomaly-based methods are more adept at identifying novel attacks but tend to produce a substantial number of false positives. To enhance the overall performance of NIDS systems, hybrid classification techniques are employed, leveraging the strengths of both misuse-based and anomaly-based methods. In this research, we present a novel hybrid classification approach for NIDS that excels in both speed and accuracy. Our approach integrates a blend of machine learning algorithms, including decision trees, support vector machines, and deep neural networks. We conducted comprehensive evaluations of our approach using various network intrusion datasets, achieving state-of-the-art results in terms of accuracy and prediction speed.