Host Intrusion Detection System Research Articles

Autonomous intrusion detection for IoT: a decentralized and privacy preserving approach

The Internet of Things (IoT) has been increasingly adopted in domains such as smart infrastructure, healthcare, supply chain, transportation, and many others. However, the constrained computational resources of these devices make conventional security approaches against security threats not applicable. This limitation emphasizes the need to explore new approaches, specifically tailored to these kinds of devices. To increase protection against cyberattacks in IoT devices, Intrusion Detection Systems (IDSs) are considered an effective approach. Machine Learning (ML) techniques can be combined with Federated Learning to enhance the privacy and scalability of these systems. Many IDSs have been introduced, but there is a research gap concerning Host Intrusion Detection System (HIDS), which is the primary focus of our current work. Additionally, existing research predominantly focuses on the application of ML techniques and their evaluation, with limited attention to real-world implementation. We propose a lightweight HIDS that relies on the analysis of system call traces to detect malicious activities. The proposed HIDS achieved an accuracy rate of approximately 98%. Finally, by using eXplainable Artificial Intelligence methods, we sought to provide explanations for these these results.

Ab‐HIDS: An anomaly‐based host intrusion detection system using frequency of N‐gram system call features and ensemble learning for containerized environment

SummaryCloud's operating‐system‐level virtualization has introduced a new phase of lightweight virtualization through containers. The architecture of cloud‐native and microservices‐based application development strongly advocates for the use of containers due to their swift and convenient deployment capabilities. However, the security of applications within containers is important, as malicious or vulnerable content could jeopardize the container and the host system. This vulnerability also extends to neighboring containers and may compromise data integrity and confidentiality. The article focuses on developing an intrusion detection system tailored to containerized cloud environments by identifying system call analysis techniques and also proposes an anomaly‐based host intrusion detection system (Ab‐HIDS). This system employs the frequency of N‐grams system calls as distinctive features. To enhance performance, two ensemble learning models, namely voting‐based ensemble learning and XGBoost ensemble learning, are employed for training and testing the data. The proposed system is evaluated using the Leipzig Intrusion Detection Data Set (LID‐DS), demonstrating substantial performance compared to existing state‐of‐the‐art methods. Ab‐HIDS is validated for class imbalance using the imbalance ratio and synthetic minority over‐sampling technique methods. Our system achieved significant improvements in detection accuracy with 4% increase for the voting‐based ensemble model and 6% increase for the XGBoost ensemble model. Additionally, we observed reductions in the false positive rate by 0.9% and 0.8% for these models, respectively, compared to existing state‐of‐the‐art methods. These results illustrate the potential of our proposed approach in improving security measures within containerized environments.

MARS: The first line of defense for IoT incident response

The proliferation of Internet of Things (IoT) devices across homes, businesses, and industrial landscapes has significantly increased our capability to gather data and automate tasks. Despite their ubiquity, these devices are notably resource-constrained and frequently lack robust security defenses, presenting a substantial risk of intrusion and cyber threats. To address these concerns, we propose a novel anomaly-based host intrusion detection system specifically designed for IoT devices, titled MARS (Memory Anomaly Recognition System). MARS is designed to function as a crucial component in the incident response framework, acting as an early detection system for potential security breaches within an organization’s network or systems. The fundamental architecture of MARS leverages the device’s memory as a key indicator for monitoring system-level events. To enhance its security and integrity, MARS is embedded within a Trusted Execution Environment—a secure, hardware-isolated region of a microcontroller protected from untrusted software. This design choice not only makes MARS tamper-proof but also ensures reliable monitoring of the device’s memory. Deviations from established memory baselines, indicative of a security compromise, are detected through an anomaly detection algorithm hosted on a remote server. Our evaluation of the MARS prototype on STM32L562QEI6QU showed our proposed architecture can achieve decent scalability while maintaining trust, accuracy, and robustness of memory changes.

DL-HIDS: deep learning-based host intrusion detection system using system calls-to-image for containerized cloud environment

DL-HIDS: deep learning-based host intrusion detection system using system calls-to-image for containerized cloud environment

Combining dynamic and static host intrusion detection features using variational long short-term memory recurrent autoencoder

Despite the many advantages offered by Host Intrusion Detection Systems (HIDS), they are rarely adopted in mainstream cybersecurity strategies. Unlike Network Intrusion Detection Systems, a HIDS is the last layer of defence between potential attacks and the underlying OSs. One of the main reasons behind this is its poor capabilities to adequately protect against zero-day attacks. With the rising number of zero-day exploits and related attacks, this is an increasingly imperative requirement for a modern HIDS. In this paper variational long short-term memory — recurrent autoencoder approach which improves zero-day attack detection is proposed. We have practically implemented our model using TensorFlow and evaluated its performance using benchmark ADFA-LD and UNM datasets. We have also compared the results against those from notable publications in the area.

Fog-Driven Approach for Distributed Intrusion Detection System in Auditing the Data Dased on Blockchain-Cloud Systems

Intrusion detection is a familiar phrase in the information and network security domain. An Intrusion Detection System (IDS) is a device or software that will keep track of the networks, for unlawful movements, and policy breaches that arise within the network. There are different forms of IDS, Host Intrusion Detection System (HIDS) helps in identifying unauthorized activities on the host, Network Intrusion Detection System (NIDS) helps in identifying attacks in the network, whereas Distributed Intrusion Detection System (DIDS) consists of multiple IDS over a large area of network where individual IDS communicates with each other or with the central the authorized central server. The proposed work has a three-layered architecture for DIDS for securing data sharing among different IDS. The bottom layer uses multiple IDS, the fog layer is supported with Blockchain functionality, and the cloud service at the upper layer stores required data permanently for future analysis. The fog computing-based architecture for DIDS tries to implement the application in a scalable and trustless environment using distributed ledger technology. The evaluation of the proposed work is carried out for fog, cloud, and integrated fog-cloud with the Blockchain functionality and without Blockchain functionality in measuring performance metrics related to throughput, service latency, response time, block creation time, and block execution time.

Botnet Detection and Mitigation Model for IoT Networks Using Federated Learning.

The Internet of Things (IoT) introduces significant security vulnerabilities, raising concerns about cyber-attacks. Attackers exploit these vulnerabilities to launch distributed denial-of-service (DDoS) attacks, compromising availability and causing financial damage to digital infrastructure. This study focuses on mitigating DDoS attacks in corporate local networks by developing a model that operates closer to the attack source. The model utilizes Host Intrusion Detection Systems (HIDS) to identify anomalous behaviors in IoT devices and employs network-based intrusion detection approaches through a Network Intrusion Detection System (NIDS) for comprehensive attack identification. Additionally, a Host Intrusion Detection and Prevention System (HIDPS) is implemented in a fog computing infrastructure for real-time and precise attack detection. The proposed model integrates NIDS with federated learning, allowing devices to locally analyze their data and contribute to the detection of anomalous traffic. The distributed architecture enhances security by preventing volumetric attack traffic from reaching internet service providers and destination servers. This research contributes to the advancement of cybersecurity in local network environments and strengthens the protection of IoT networks against malicious traffic. This work highlights the efficiency of using a federated training and detection procedure through deep learning to minimize the impact of a single point of failure (SPOF) and reduce the workload of each device, thus achieving accuracy of 89.753% during detection and increasing privacy issues in a decentralized IoT infrastructure with a near-real-time detection and mitigation system.

Enabling data-driven anomaly detection by design in cyber-physical production systems

Designing and developing distributed cyber-physical production systems (CPPS) is a time-consuming, complex, and error-prone process. These systems are typically heterogeneous, i.e., they consist of multiple components implemented with different languages and development tools. One of the main problems nowadays in CPPS implementation is enabling security mechanisms by design while reducing the complexity and increasing the system’s maintainability. Adopting the IEC 61499 standard is an excellent approach to tackle these challenges by enabling the design, deployment, and management of CPPS in a model-based engineering methodology. We propose a method for CPPS design based on the IEC 61499 standard. The method allows designers to embed a bio-inspired anomaly-based host intrusion detection system (A-HIDS) in Edge devices. This A-HIDS is based on the incremental Dendritic Cell Algorithm (iDCA) and can analyze OPC UA network data exchanged between the Edge devices and detect attacks that target the CPPS’ Edge layer. This study’s findings have practical implications on the industrial security community by making novel contributions to the intrusion detection problem in CPPS considering immune-inspired solutions, and cost-effective security by design system implementation. According to the experimental data, the proposed solution can dramatically reduce design and code complexity while improving application maintainability and successfully detecting network attacks without negatively impacting the performance of the CPPS Edge devices.

A Lightweight Optimized Deep Learning-based Host-Intrusion Detection System Deployed on the Edge for IoT

A Lightweight Optimized Deep Learning-based Host-Intrusion Detection System Deployed on the Edge for IoT

THREATRACE: Detecting and Tracing Host-Based Threats in Node Level Through Provenance Graph Learning

Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent Threats (APT), are commonly adopted by modern attackers. Recent studies propose leveraging the rich contextual information in data provenance to detect threats in a host. Data provenance is a directed acyclic graph constructed from system audit data. Nodes in a provenance graph represent system entities (e.g., <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">processes</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">files</i> ) and edges represent system calls in the direction of information flow. However, previous studies, which extract features of the provenance graph, are not sensitive to the small quantity of threat-related entities and thus result in low performance when hunting stealthy threats. We present THREATRACE, an anomaly-based detector that detects host-based threats at system entity level without prior knowledge of attack patterns. We tailor GraphSAGE, an inductive graph neural network, to learn every benign entity’s role in a provenance graph. THREATRACE is a real-time system, which is scalable of monitoring a long-term running host and capable of detecting host-based intrusion in their early phase. We evaluate THREATRACE on five public datasets. The results show that THREATRACE outperforms seven state-of-the-art host intrusion detection systems.

Study of Intrusion Detection System

An intrusion detection system (IDS) could be a device or software application that observes a network for malicious activity or policy violations. Any malicious activity or violation is often reported or collected centrally employing a security information and event management system. Some IDS’s are proficient of responding to detected intrusion upon discovery. These are classified as intrusion prevention systems (IPS). A system that analyzes incoming network traffic is thought as Network intrusion detection system (NIDS). A system that monitors important software files is understood as Host intrusion detection system (HIDS). Wireless sensor networks (WSNs) are vulnerable to different kinds of security threats which will degenrate the performance of the entire network; that may lead to fatal problems like denial of service (DoS) attacks, direction attacks, Sybil attack etc. Key management protocols, authentication protocols and secure routing cannot provide security to WSNs for these varieties of attacks. Intrusion detection system (IDS) could be a solution to the present problem. It analyzes the network by collecting sufficient amount of knowledge and detects abnormal behavior of sensor node(s).

Network Intrusion Detection and Deduce System

Network Intrusion Detection and Deduce Systems keep a track of network traffic for anomalies based on signatures and heuristics that differ from dealer to dealer and from implementation to implementation. Host Intrusion Detection System and Host Intrusion Prevention System applicable at endpoints where NIDDS applies to network boundaries and segmentation points such as the gateways to the internet or other untrusted networks. By assessing the traffic for certain anomalies, a NIDDS can ascertain malicious or other undesired or unforeseen data. When a match is found based on patterns, signatures, or other heuristics, the system can log it, send an alert to the monitoring system or to the server, or even take action such as blocking, redirecting, or resetting the connection depending on the organisation. NIDDS is a malicious intrusion prevention system that uses publicly released signatures containing malicious or other dubious trails, as well as generic trails gathered from different anti-virus records and directories with unique user identifiers, in which the route can be anything from a search engine. The proposed system, detects the attack using a Raspberry Pi, a low-powered computer.

A tfidfvectorizer and singular value decomposition based host intrusion detection system framework for detecting anomalous system processes

Host based intrusion detection systems (HIDSs) are indispensable tools for providing a comprehensive security solution. They are capable of detecting host specific attacks, which cannot be detected using network based intrusion detection systems (NIDSs). This paper proposes a novel tfidfvectorizer and truncated singular value decomposition (SVD) based host intrusion detection system (HIDS) framework for identification of anomalous system processes in real time. The proposed HIDS framework takes the system call trace files as its input and transforms them into n-gram feature vector representational models. The framework then uses a vectorization technique called the tfidfvectorizer to compute the tfidf values of the n-gram terms of the transformed feature vectors. Dimensionality reduction of the transformed n-gram feature vectors are then carried out using truncated SVD based on their tfidf values. The dimensionality reduced tfidfvectorized n-gram feature vectors are finally provided as inputs to various machine learning based classifier models to determine whether the corresponding system call trace files are normal or anomalous. Experimental results on the benchmark ADFA-LD and ADFA-WD datasets show that the proposed HIDS framework effectively detects anomalous system processes with high accuracy and low processing overhead. It is also shown to outperform other HIDS frameworks proposed in the literature.

A Brute-Force Black-Box Method to Attack Machine Learning-Based Systems in Cybersecurity

Machine learning algorithms are widely utilized in cybersecurity. However, recent studies show that machine learning algorithms are vulnerable to adversarial examples. This poses new threats to the security-critical applications in cybersecurity. Currently, there is still a short of study on adversarial examples in the domain of cybersecurity. In this paper, we propose a new method known as the brute-force attack method to better evaluate the robustness of the machine learning classifiers in cybersecurity against adversarial examples. The proposed method, which works in a black-box way and covers some shortages of the existing adversarial attack methods based on generative adversarial networks, is simple to implement and only needs the output of the target classifiers to generate adversarial examples. To have a comprehensive evaluation of the attack performance of the proposed method, we use our method to generate adversarial examples against the common machine learning based security systems in cybersecurity including host intrusion detection systems, Android malware detection systems, and network intrusion detection systems. We compare the attack performance of the proposed method against these security systems with that of state-of-the-art adversarial attack methods based on generative adversarial networks. The preliminary experimental results show that the proposed method, which is more efficient in computation and outperforms the state-of-the-art attack methods based on generative adversarial networks, can be used to evaluate the robustness of various machine learning based systems in cybersecurity against adversarial examples.

A Host Intrusion Detection System architecture for embedded industrial devices

The integration of Cyber-Physical Systems in the industrial domain has become indispensable for Industry 4.0. Unfortunately, as the interconnectivity among them increases, so do the opportunities for malicious users to target them. Hence, it is necessary to increase the security of these systems and their components. A wide range of security solutions (e.g., industrial Firewalls) are already an integral part of Industrial Automation Systems, however, these are deployed at strategical system locations and might not be capable of identifying intrusions that target specific elements of embedded industrial devices. Host Intrusion Detection Systems (Host IDS) are one security solution that allow to detect such type of intrusions, as they analyze information related to specific host devices. This contribution presents a feasible Host IDS architecture for embedded industrial devices. This architecture takes into consideration features and capabilities of Host IDS from the IT domain. It also considers system-, environmental- and device-specific properties from the industrial domain. These properties are presented in the form of abstracted requirements and considerations that are contemplated for the conceptualization of the presented architecture. Furthermore, the feasibility of this architecture is validated through the implementation and evaluation of a prototypical Host IDS deployed in a Programmable Logic Controller (PLC) hosting a Real-Time Operating System (RTOS). This evaluation is achieved through the demonstration of a set of hypotheses derived from the abstracted requirements and supported by the evaluation of test scenarios. To the best of our knowledge, this is the first fully operational Host IDS to be deployed and evaluated on a PLC.

A Noble Approach of Real Time Intrusion Detection System (NART-IDS)

Malicious users use different techniques such as cracking passwords, text traffic, sniffing unencrypted or light, etc. System overhead and compromise critical systems. Therefore, there must be some sort of security for the organization's private resources from the Internet and from the inside. Therefore, the intrusion detection system (IDS) could be the best solution. It complements the firewall to improve the security holes. An intrusion detection system includes a management console and sensors. The management console holds all the responsibility of functionality of IDS comprises with its initialization, packet capturing, and report generation, whereas the sensors used to monitor hosts or networks in real time. There may be different categories of Intrusion Detection System. IDS can be designed in the concept of Signature analysis as well as anomaly behavior analysis. Therefore IDS used to capture the behavior of suspected packets. These functions are in host mode and called as Host Intrusion Detection System (HIDS) and in Network mode called as Network Intrusion Detection System (NIDS). The entitled dissertation work is carried out to obtain the best analysis performance through signature based detection system. It is efficient for host as well as network system .here basically Transmission Control Packets (TCP) and User Datagram Packets (UDP) considered to analysis for finding different attacks like Probe,DoS,R2l and U2R. This system is being found functionally efficient and also provide layer wise attacks details. Here different agent modules used to perform desired isolated responsibility like Mobile Agent (MA) to activate different IDS chest at different hosts, Tenet Agent (TA) for signature rule, Analysis Agent (AA) etc. The proposed system can greatly improve efficiency from offline detection to real-time online detection. Since the proposed system derives features from packet headers. Many attacks were experimented in this system. Experiments were performed to demonstrate the excellent effectiveness and efficiency of the proposed system. The proposed system can greatly improve efficiency from offline detection to real-time online detection. Since the proposed system derives features from packet headers. The entitled system can be further enhanced to capture more type of attacks at the levels of multiple layers and also may stop attacks as well.

A Novel Optimization Algorithm Based on Stinging Behavior of Bee

&lt;span lang="EN-US"&gt;Optimization algorithms are search methods to find an optimal solution to a problem with a set of constraints. Bio-Inspired Algorithms (BIAs) are based on biological behavior to solve a real world problem. BIA with optimization technique is to improve the overall performance of BIA. The aim of this paper is to introduce a novel optimization algorithm which is inspired by natural stinging behavior of honey bee to find the optimal solution. This algorithm performs both monitor and sting if any occurrence of predators. By applying a novel optimization algorithm based on stinging behavior of bee, used to solve the intrusion detection problems. In this paper, a new host intrusion detection system based on novel optimization algorithm has been proposed and implemented. The performance of the proposed Anomaly-based Host Intrusion Detection System (A-HIDS) using a novel optimization algorithm based on stinging behavior of bee has been tested. In this paper, after an explanation of the natural stinging behavior of honey bee, a novel optimization algorithm and A-HIDS are described and implemented. The results show that the novel optimization algorithm offers some advantage according to the nature of the problem.&lt;/span&gt;

A Survey on Anomaly Based Host Intrusion Detection System

An intrusion detection system (IDS) is hardware, software or a combination of two, for monitoring network or system activities to detect malicious signs. In computer security, designing a robust intrusion detection system is one of the most fundamental and important problems. The primary function of system is detecting intrusion and gives alerts when user tries to intrusion on timely manner. In these techniques when IDS find out intrusion it will send alert massage to the system administrator. Anomaly detection is an important problem that has been researched within diverse research areas and application domains. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. From the existing anomaly detection techniques, each technique has relative strengths and weaknesses. The current state of the experiment practice in the field of anomaly-based intrusion detection is reviewed and survey recent studies in this. This survey provides a study of existing anomaly detection techniques, and how the techniques used in one area can be applied in another application domain.

A semantic web enabled host intrusion detection system

Security has preeminent importance in today's technological environment. In recent years, as cyber-attacks have emerged new security concerns have arisen. In order to overcome the serious consequences of these cyber-attacks, fully-functioning and performance-improved intrusion detections systems are required. In this work, we propose a semantic web based host intrusion detection system to reduce the search time for malware scanning and to improve the performance of the intrusion detection systems. For this purpose, we used ontologies to provide semantic expressiveness and knowledge description for an intrusion detection system. The proposed ontology based intrusion detection system scans for malwares running on the operating system. Also, services and processes that are working on the system are scanned, and results are compared with a malware database. If any match occurs, the proposed system displays a malware list that matches with the information of that malware and where it is running.

A semantic web enabled host intrusion detection system

Security has preeminent importance in today's technological environment. In recent years, as cyber-attacks have emerged new security concerns have arisen. In order to overcome the serious consequences of these cyber-attacks, fully-functioning and performance-improved intrusion detections systems are required. In this work, we propose a semantic web based host intrusion detection system to reduce the search time for malware scanning and to improve the performance of the intrusion detection systems. For this purpose, we used ontologies to provide semantic expressiveness and knowledge description for an intrusion detection system. The proposed ontology based intrusion detection system scans for malwares running on the operating system. Also, services and processes that are working on the system are scanned, and results are compared with a malware database. If any match occurs, the proposed system displays a malware list that matches with the information of that malware and where it is running.