Intrusion Detection Framework Research Articles

Discover botnets in IoT sensor networks: A lightweight deep learning framework with hybrid self-organizing maps

In recent years, we have witnessed a massive growth of intrusion attacks targeted at Internet of things (IoT) devices. Due to inherent security vulnerabilities, it has become an easy target for hackers to target these devices. Recent studies have focused on deploying intrusion detection systems at the network's edge within IoT devices to localize threat mitigation and avoid computational expenses. Intrusion detection systems based on machine learning and deep learning algorithm has demonstrated the potential to detect zero-day attacks where traditional signature-based detection falls short. Thus, the purpose of the paper is to present a lightweight and robust deep learning framework for intrusion detection that has computational potential to be efficiently scaled down and deployed as a localized threat detection within IoT devices. The paper's methodology to demonstrate the scalability and threat detection performance is to train and test intrusion datasets such as NSL-KDD (Network Security Laboratory - Knowledge Discovery in Databases) and N-BaIoT (Network-Based Anomaly Internet of Things) to assess anomaly detection performance. In addition, the proposed Hybrid model is compared against a benchmark Artificial Neural Network model. The evaluation metrics are training time, precision, recall, accuracy, and f1-score, along with their macro and weighted averages. Significant findings show a 948% decrease in model training time and a 41.87% increase in f1-score when comparing the proposed Hybrid Self Organizing Maps (HSOM) model with the Artificial Neural Network model. Additionally, scaling down the nodes in the proposed Self Organizing Maps (SOM) model demonstrated a reduction of 955% in training time and a 27% increase in macro averages of precision, recall, and f1-score. A significant implication of this study would be adopting the proposed SOM model as localized IoT threat detection, as the research proves the increase in detection performance after scaling down the model's input and output nodes. The contribution of the research is a scalable and high-performant IoT threat detection framework suited for localized IoT deployment.

A Novel Intrusion Detection Framework (IDF) using Machine Learning Methods

An intrusion detection system is a critical security feature that analyses network traffic in order to avoid serious unauthorized access to network resources. For securing networks against potential breaches, effective intrusion detection is critical. In this paper, a novel Intrusion Detection Framework (IDF) is proposed. The three modules that comprise the suggested IDF are: (i) Data Pre-processing Module (DPM), (ii) Feature Selection Module (FSM), and Classification Module (CM). DPM collects and processes network traffic in order to prepare data for training and testing. The FSM seeks to identify the key elements for recognizing DPM intrusion attempts. An Improved Particle Swarm Optimization is used (IPSO). IPSO is a hybrid method that uses both filter and wrapper approaches to generate accurate and relevant information for the classification step that follows. Primary Selection Phase (PSP) and Completed Selection Phase (CSP) are the two consecutive feature selection phases in IPSO. PSP employs a filtering approaches to quickly identify the most significant features for detecting intrusion threats while eliminating those that are redundant or ineffective. In CSP, the next level of IPSO, this behavior reduces the computing cost. For accurate feature selection, CSP uses Binary Particle Swarm Optimization (Bi-PSO) as a wrapper approach. Based on the most effective features identified by FSM, The CM aims to identify intrusion attempts with the minimal processing time. Therefore, a K-Nearest Neighbor KNN classifier has been deployed. As a result, based on the significant features identified by the IPSO technique, KNN can accurately detect intrusion attacks with the least amount of processing time. The experimental results have shown that the proposed IDF outperforms other recent techniques using UNSW_NB-15 dataset. The accuracy, precision, recall, F1score, and processing time of the experimental outcomes of our findings were assessed. Our results were competitive with an accuracy of 99.8%, precision of 99.94%, recall of 99.85%, F1-score of 99.89%, and excursion time of 59.15s when compared to the findings of the current works.

Optimized deep learning methodology for intruder behavior detection and classification in cloud

Apps, networks, frameworks, and services are all made possible by the cloud. In order to get the most out of the improved accessibility and computational capabilities, the Service Providers can offer an optimal use of current services. Application services have been revolutionised as their launch since they are useful and cost-effective for both suppliers and users. Increasingly, cyber defence is a vital research area in today’s environment, where networks are essential. The software and hardware of a network are constantly monitored by an intrusion detection framework (IDF), which is an essential part of any cyber defence plan. Many of the current IDSs are still struggling to improve detection performance, reduce false alarm rates and detect new threats. Based on parametric computation analysis, this study provides a deep learning approach to optimize cloud networks and to identify intruders. Results of suggested approach have been displayed from data compared to current methods in the conclusion section.

A Novel Hybrid Quantum-Classical Framework for an In-Vehicle Controller Area Network Intrusion Detection

A Novel Hybrid Quantum-Classical Framework for an In-Vehicle Controller Area Network Intrusion Detection

Retracted: An AI‐Driven Hybrid Framework for Intrusion Detection in IoT‐Enabled E‐Health

Retracted: An AI‐Driven Hybrid Framework for Intrusion Detection in IoT‐Enabled E‐Health

CRSF: An Intrusion Detection Framework for Industrial Internet of Things Based on Pretrained CNN2D-RNN and SVM

CRSF: An Intrusion Detection Framework for Industrial Internet of Things Based on Pretrained CNN2D-RNN and SVM

Edge of Things Inspired Robust Intrusion Detection Framework for Scalable and Decentralized Applications

Ubiquitous data monitoring and processing with minimal latency is one of the crucial challenges in real-time and scalable applications. Internet of Things (IoT), fog computing, edge computing, cloud computing, and the edge of things are the spine of all real-time and scalable applications. Conspicuously, this study proposed a novel framework for a real-time and scalable application that changes dynamically with time. In this study, IoT deployment is recommended for data acquisition. The Pre-Processing of data with local edge and fog nodes is implemented in this study. The threshold-oriented data classification method is deployed to improve the intrusion detection mechanism’s performance. The employment of machine learning-empowered intelligent algorithms in a distributed manner is implemented to enhance the overall response rate of the layered framework. The placement of respondent nodes near the framework’s IoT layer minimizes the network’s latency. For economic evaluation of the proposed framework with minimal efforts, EdgeCloudSim and FogNetSim++ simulation environments are deployed in this study. The experimental results confirm the robustness of the proposed system by its improvised threshold-oriented data classification and intrusion detection approach, improved response rate, and prediction mechanism. Moreover, the proposed layered framework provides a robust solution for real-time and scalable applications that changes dynamically with time.

IoT Network-Based Intrusion Detection Framework: A Solution to Process Ping Floods Originating From Embedded Devices

IoT Network-Based Intrusion Detection Framework: A Solution to Process Ping Floods Originating From Embedded Devices

WiFi Intrusion Detection using Artificial Neurons with Bio-inspired Optimization Algorithm

Wireless network growth has been remarkable in recent years. There is a significant increase in the manoeuvring of mobile and stand-alone appliances, with WiFi network connectivity as the main reason for this growth. In electronics products, these devices have become indispensable. Wireless networks have become increasingly vulnerable to attacks as their popularity has grown. Still, high accuracy and detection rate, and low false positive rate are needed for network intrusion detection systems (IDS). In this study, we propose artificial neuron training with a bio-inspired optimization algorithm (BOA) for WiFI networks to efficiently detect intrusion against them. The proposed WiFi intrusion detection framework has artificial neurons trained with Harris Hawks optimization (N-HHO) benchmarked on publicly available Aegean Wi-Fi intrusion Datstaset (AWID). We trained this dataset to propose N-HHO and validate performance evaluation with other BOAs and machine learning (ML) techniques. Our WiFi intrusion detection framework outperforms all other techniques and it could be an alternate option to be used for WiFi network security.

An Explainable Deep Learning Framework for Resilient Intrusion Detection in IoT-Enabled Transportation Networks

The security of safety-critical IoT systems, such as the Internet of Vehicles (IoV), has a great interest, focusing on using Intrusion Detection Systems (IDS) to recognise cyber-attacks in IoT networks. Deep learning methods are commonly used for the anomaly detection engines of many IDSs because of their ability to learn from heterogeneous data. However, while this type of machine learning model produces high false-positive rates and the reasons behind its predictions are not easily understood, even by experts. The ability to understand or comprehend the reasoning behind the decision of an IDS to block a particular packet helps cybersecurity experts validate the system’s effectiveness and develop more cyber-resilient systems. This paper proposes an explainable deep learning-based intrusion detection framework that helps improve the transparency and resiliency of DL-based IDS in IoT networks. The framework employs a SHapley Additive exPlanations (SHAP) mechanism to interpret decisions made by deep learning-based IDS to experts who rely on the decisions to ensure IoT networks’ security and design more cyber-resilient systems. The proposed framework was validated using the ToN_IoT dataset and compared with other compelling techniques. The experimental results have revealed the high performance of the proposed framework with a 99.15% accuracy and a 98.83% F1 score, illustrating its capability to protect IoV networks against sophisticated cyber-attacks.

AID4I: An Intrusion Detection Framework for Industrial Internet of Things Using Automated Machine Learning

AID4I: An Intrusion Detection Framework for Industrial Internet of Things Using Automated Machine Learning

HH-NIDS: Heterogeneous Hardware-Based Network Intrusion Detection Framework for IoT Security

This study proposes a heterogeneous hardware-based framework for network intrusion detection using lightweight artificial neural network models. With the increase in the volume of exchanged data, IoT networks’ security has become a crucial issue. Anomaly-based intrusion detection systems (IDS) using machine learning have recently gained increased popularity due to their generation’s ability to detect unseen attacks. However, the deployment of anomaly-based AI-assisted IDS for IoT devices is computationally expensive. A high-performance and ultra-low power consumption anomaly-based IDS framework is proposed and evaluated in this paper. The framework has achieved the highest accuracy of 98.57% and 99.66% on the UNSW-NB15 and IoT-23 datasets, respectively. The inference engine on the MAX78000EVKIT AI-microcontroller is 11.3 times faster than the Intel Core i7-9750H 2.6 GHz and 21.3 times faster than NVIDIA GeForce GTX 1650 graphics cards, when the power drawn was 18mW. In addition, the pipelined design on the PYNQ-Z2 SoC FPGA board with the Xilinx Zynq xc7z020-1clg400c device is optimised to run at the on-chip frequency (100 MHz), which shows a speedup of 53.5 times compared to the MAX78000EVKIT.

Intrusion detection framework based on homomorphic encryption in AMI network

In order to alleviate the privacy issue of traditional smart grids, some researchers have proposed a power metering system based on a federated learning framework, which jointly trains the model by exchanging gradients between multiple data owners instead of raw data. However, recent research shows that the federated learning framework still has privacy and security issues. Secondly, since the server does not have direct access to all parties data sets and training process, malicious attackers may conduct poisoning attacks. This is a new security threat in federated learning - poisoning attack. However, solving the two problems at the same time seems to be contradictory because privacy protection requires the inseparability of the training gradients of all parties, and security requires the server to be able to identify the poisoned client. To solve the above issues, this paper proposes an intrusion detection method based on federated learning client-side security in AMI networks, which uses CKKS to protect model parameters. In addition, to resist the poisoning attack in federated learning, the model trained by the data processing center and the model trained by each client are firstly calculated for the direction similarity, and the similarity value is scaled as the adaptive weight of the aggregation model. Then, the size of each client model update is normalized to be the same size as the data processing center model update. Finally, the normalized updates and adaptive weights are weighted averaged to form a global model update. The research results show that the method in this paper can effectively resist inference attacks and poisoning attacks. In the AMI network, the intrusion detection method based on federated learning can maintain a good detection performance.

Performance evaluation of a fast and efficient intrusion detection framework for advanced persistent threat-based cyberattacks

After the COVID-19 pandemic, cyberattacks are increasing as non-face-to-face environments such as telecommuting and telemedicine proliferate. Cyberattackers exploit vulnerabilities in remote systems and endpoint devices in major enterprises and infrastructures. To counter these attacks, fast detection and response are essential because advanced persistent threat (APT) attacks intelligently infiltrate endpoint devices for long periods and spread to large-scale environments. However, because conventional security systems are signature-based, fast detection of APT attacks is challenging, and it is difficult to respond flexibly to the environment. In this study, we propose an APT fast detection and response technique using open-source tools that improves the efficiency of existing endpoint information protection systems and swiftly detects the APT attack process. Performance test results based on realistic scenarios using the open-source APT attack library and MITER ATT&CK indicated that fast detection was possible with higher accuracy for the early stages of APT attacks in scenarios where endpoint attack detectors are interworking environments.

Cycle‐consistentgenerative adversarial network optimized with water strider optimization algorithm fostered intrusion detection framework for securing cloud computing environment

SummaryCloud computing is the delivery of computing services including servers, storage, databases, networking, software, analytics, and intelligence over the internet (“the cloud”) to offer faster innovation, flexible resources, and economies of scale. In this article, cycle‐consistent generative adversarial network (CCGAN) optimized with water strider optimization (WSO) algorithm fostered intrusion detection system (IDS) is proposed to secure the cloud computing (CC) environment (IDS‐CC‐CCGAN‐WSOA). Initially, the input data's are gathered via NSL‐KDD benchmark dataset. Then it is given to preprocessing. During preprocessing, it debugs the redundancy and missing value is restored using local least squares. Then, the preprocessed output is fed to the feature selection level. The optimum features are compiled utilizing correlation feature selection approach. This optimum features based, the data's are categorized as normal and anomalous data. The weights of this network are optimized by water strider optimization to attain effectual and optimum solution for recognizing the intruders. The proposed approach is executed in MATLAB. The performance metrics is examined to validate the performance of the proposed approach. Finally, the proposed approach attains 13.9367%, 13.268%, and 13.739% higher accuracy analyzed to the existing approaches, such as IDS‐CC‐DBN‐CSSA, IDS‐CC‐DNN‐IGASAA, and IDS‐CC‐MLPNN‐ABC.

An Enhanced Multi-Stage Deep Learning Framework for Detecting Malicious Activities From Autonomous Vehicles

Intelligent Transportation Systems (ITS), particularly Autonomous Vehicles (AVs), are susceptible to safety and security concerns that impend people’s lives. Nothing like manually controlled vehicles, the safekeeping of communications and computing constituents of AVs can be threatened using sophisticated hacking techniques, consequently disrupting AVs from the operative usage in our daily life routines. Once manually controlled vehicles are linked to the Internet, so-called the Internet of Vehicles (IoVs), they would be misused by cyberattacks. In this paper, we present a multi-stage intrusion detection framework to identify intrusions from ITSs and produce low rate of false alarms. The proposed framework can automatically distinguish intrusions in real-time. The proposed framework is based on normal state-based and a deep learning-centered bidirectional Long Short Term Memory (LSTM) architecture to efficiently discover intrusions from the fundamental network gateways and communication networks of AVs. The designed framework is evaluated through two benchmark datasources, that is, the UNSWNB-15 datasource for exterior network communications and the car hacking datasource for in-vehicle communications. The outcomes indicated that the proposed framework achieves high performance that outperforms various current state-of-the-art systems with an accuracy rate of 98.88% for the UNSWNB-15 dataset and 99.11% for the car hacking dataset. Besides, the proposed framework is furthermore capable to detect zero-day (concealed) outbreaks from IoVs networks.

LIDS-SIoEL: intrusion detection framework for IoT-based smart environments security using ensemble learning

lIDS-SIoEL: intrusion detection framework for IoT-based smart environments security using ensemble learning

FLDID: Federated Learning Enabled Deep Intrusion Detection in Smart Manufacturing Industries.

The rapid development in manufacturing industries due to the introduction of IIoT devices has led to the emergence of Industry 4.0 which results in an industry with intelligence, increased efficiency and reduction in the cost of manufacturing. However, the introduction of IIoT devices opens up the door for a variety of cyber threats in smart industries. The detection of cyber threats against such extensive, complex, and heterogeneous smart manufacturing industries is very challenging due to the lack of sufficient attack traces. Therefore, in this work, a Federated Learning enabled Deep Intrusion Detection framework is proposed to detect cyber threats in smart manufacturing industries. The proposed FLDID framework allows multiple smart manufacturing industries to build a collaborative model to detect threats and overcome the limited attack example problem with individual industries. Moreover, to ensure the privacy of model gradients, Paillier-based encryption is used in communication between edge devices (representative of smart industries) and the server. The deep learning-based hybrid model, which consists of a Convolutional Neural Network, Long Short Term Memory, and Multi-Layer Perceptron is used in the intrusion detection model. An exhaustive set of experiments on the publically available dataset proves the effectiveness of the proposed framework for detecting cyber threats in smart industries over the state-of-the-art approaches.

An trustworthy intrusion detection framework enabled by ex-post-interpretation-enabled approach

An enormous number of machine learning models have been recently proposed for intrusion detection. Among these models, the complex models stand out as a prominent approach for intrusion detection in network security. In contrast with the simple models, the complex models are powerful in that it learns the complex abstraction between input and output under the premise of the loss of the transparency. This lack of interpretability hinders the landing of the complex model in the field of intrusion detection. To balance the model interpretability and performance, a novel trustworthy intrusion detection framework (TIDF) combining machine learning and ex-post-interpretation method is proposed in this paper. The proposed framework TIDF achieves 82% prediction accuracy. In the contrast experiment, TIDF outperforms the junior Network Security Manages Engineer (NSME). With the proposed framework, we achieve a good prediction performance and improve the model interpretability in the intrusion detection. Thus, the proposed framework may act as a potential useful tool in the intrusion detection system.

Intrusion detection framework using stacked auto encoder based deep neural network in IOT network

SummarySecurity is of paramount importance in the number of systems affiliated with increased IoT. Therefore, in this manuscript, a Stacked Auto Encoder based Deep Neural Network (DNN) fostered Intrusion Detection Framework is proposed to secure the IoT Environment. Here, the data is given to the preprocessing stage, in which redundancy elimination and replacement of missing value are done. Then, the preprocessed output is given to the feature selection process. Wherein, the Golden eagle optimization (GEO) algorithm selects the optimum features from pre‐processed data sets. Then selected features are given to the Stacked Auto encoder based deep neural network for classification, which classified the data, like normal, anomalies. Here, the proposed approach is implemented in Python language. To check the robustness of the proposed approach, the performance metrics, like accuracy, specificity, sensitivity, F‐measure, precision, and recall is measured. The simulation outcome show that the proposed Stacked Auto Encoder based Deep Neural Network based Intrusion Detection Framework (IDS‐FS‐GEO‐SAENN) method attains higher accuracy 99.75%, 97.85%, 95.13%, and 98.79, higher sensitivity 96.34%, 91.23%, 89.12%, and 87.25%, higher specificity 93.67%, 92.37%, 98.47%, and 94.78% compared with the existing methods, like FS‐SMO‐SDPN, FS‐WO‐RNNLSTM, FS‐hybrid GWOPSO‐RF, and FS‐CNNLSTMGRU, respectively.