Hybrid Intrusion Detection Method Research Articles

A hybrid intrusion detection method based on convolutional neural network and AdaBoost

A hybrid intrusion detection method based on convolutional neural network and AdaBoost

Research on hybrid intrusion detection based on improved Harris Hawk optimization algorithm

Aiming at the problem of low detection accuracy of network traffic data types by traditional intrusion detection methods, we propose an improved Harris Hawk hybrid intrusion detection method to enhance the detection capability. The improved Harris Hawk optimization algorithm is used as a feature selection scheme to reduce the impact of redundant and noisy features on the performance of the classification model. The algorithm introduces the singer map to initialise the population, uses multi-information fusion to obtain the best prey position, and applies the sine function-based escape energy to execute a prey search strategy to obtain the optimal subset of features. In addition, the original data is preprocessed by the k-nearest neighbour and deep denoising autoencoder (KNN-DDAE) to relieve the imbalance problem of the network traffic data. Finally, a deep neural network (DNN) is used to complete the classification. Simulation experiments are conducted on the dataset NSL-KDD, KDD CUP99, and UNSW-NB15. The results show that our feature selection and data balancing scheme greatly improves the detection accuracy. In addition, the detection performance of this method is better than the current popular intrusion detection schemes.

Implementation of art therapy assisted by the internet of medical things based on blockchain and fuzzy set theory

This work aims to improve the stability and efficiency of the Internet of Medical Things (IoMT), strengthen the security and privacy of personal information, and create a healthy and safe network environment. First, art therapy in the current medical environment is discussed, and the security defenses of the IoMT supporting art therapy are studied. Then, a security defense method for IoMT is proposed by combining basic Blockchain knowledge with the Fuzzy Sets Theory. Specifically, a Density-awarded Fuzzy C-means (DFCM) algorithm is developed to solve the clustering issue of unbalanced data sets. Besides, the Fuzzy Support Vector Machine (FSVM) model is used to classify data points far from the sample center to increase classification accuracy. In the simulation experiment, the DFCM algorithm achieves a pleasing clustering effect on the four data sets, involving the data sets with density changes and imbalanced sample points within the cluster. Moreover, the combination of DFCM and FSVM (DFCM-FSVM) for attack detection in the Internet of Things (IoT) realizes the optimal accuracy in the detection of different behaviors compared with similar algorithms; the detection accuracy of normal behavior, scheduled attack, gray hole attack, and black hole attack is 99.8%, 89.8%, 99.4%, and 91.5%, respectively. This work creatively proposes a hybrid intrusion detection method based on fuzzy theory. As the second line of defense in security protection, it plays a critical role and is suitable for the network environment of the perception layer. In conclusion, the attack detection method based on Blockchain combined with the Fuzzy Sets Theory can precisely identify potential attacks in abnormal data, which has important practical value for maintaining data security and the regular operation of the IoMT.

Research on hybrid intrusion detection method based on the ADASYN and ID3 algorithms.

Intrusion detection system plays an important role in network security. Early detection of the potential attacks can prevent the further network intrusion from adversaries. To improve the effectiveness of the intrusion detection rate, this paper proposes a hybrid intrusion detection method that utilizes ADASYN (Adaptive Synthetic) and the decision tree based on ID3 algorithm. At first, the intrusion detection dataset is transformed by coding technology and normalized. Subsequently, the ADASYN algorithm is applied to implement oversampling on the training set, and the ID3 algorithm is employed to build a decision tree model. In addition, the model proposed by the research is evaluated by accuracy, precision, recall, and false alarm rate. Besides, a performance comparison is conducted with other models. Consequently, it is found that the combined model based on ADASYN and ID3 decision tree proposed in this research possesses higher accuracy as well as lower false alarm rate, which is more suitable for intrusion detection tasks.

New hybrid method for attack detection using combination of evolutionary algorithms, SVM, and ANN

Intrusion detection systems (IDS) have been playing an important role for providing security of computer networks. They detect different types of attacks and malicious software usage, which sometimes cannot be identified by firewalls. Based on machine learning algorithms, many IDS have been extended to classify network traffic as normal or abnormal. This paper describes a new hybrid intrusion detection method with two phases - a feature selection phase and an attack detection phase. In the feature selection phase, a wrapper technique, namely MGA-SVM, is used. This technique combines features of support vector machine (SVM) and the genetic algorithm with multi-parent crossover and multi-parent mutation (MGA). In the attack detection phase, an artificial neural network (ANN) is used to detect attacks. For improving its performance, a combination of a hybrid gravitational search (HGS) and a particle swarm optimization (PSO) is used to train the classifier. The proposed hybrid method is thus called MGA-SVM-HGS-PSO-ANN. It's performance is compared with other popular techniques such as Chi-SVM, ANN based on gradient descent (GD-ANN) and decision tree (DT), ANN based on genetic algorithm (GA-ANN), ANN based on combining gravitational search (GS) and PSO (GSPSO-ANN), ANN based on PSO (PSO-ANN), and ANN based on GS (GS-ANN). Using the NSL-KDD dataset as a standard benchmark for attack detection evaluation, the obtained test results show that the proposed MGA-SVM-HGS-PSO-ANN method can attain a maximum detection accuracy of 99.3%, dimension reduction of NSL-KDD from 42 to 4 features, and needs only 3 s as maximum training time.

Hybrid Intrusion Detection Method to Increase Anomaly Detection by Using Data Mining Techniques

Hybrid Intrusion Detection Method to Increase Anomaly Detection by Using Data Mining Techniques

A Novel Lightweight Hybrid Intrusion Detection Method Using a Combination of Data Mining Techniques

Hybrid intrusion detection systems that make use of data mining techniques, in order to improve effectiveness, have been actively pursued in the last decade. However, their complexity to build detection models has become very expensive when confronted with large-scale datasets, making them unviable for real-time retraining. In order to overcome the limitation of the conventional hybrid method, we propose a new lightweight hybrid intrusion detection method that consists of a combination of feature selection, clustering and classification. According to our hypothesis that there are different natures of attack events in each of network protocols, the proposed method examines each of network protocol data separately, but their processes are the same. First, the training dataset is divided into training subsets, depending on their type of network protocol. Next, each training subset is reduced dimensionally by eliminating the irrelevant and redundant features throughout the feature selection process; and then broken down into disjointed regions, depending on their similar feature values, by K -Means clustering. Lastly, the C4.5 decision tree is used to build multiple misuse detection models for suspicious regions, which deviate from the normal and anomaly regions. As a result, each detection model is built from high-quality data, which are less complex and consist of relevant data. For better understanding of the enhanced performance, the proposed method was evaluated through experiments using the NSL-KDD dataset. The experimental results indicate that the proposed method is better in terms of effectiveness (F-value: 0.9957, classification accuracy: 99.52%, false positive rate: 0.26%), and efficiency (the training and testing times of the proposed method are approximately 33% and 25%, respectively, of the time required for its comparison) than the conventional hybrid method using the same algorithm.

English

3 ABSTRACT: With the growth of networked computers and associated applications, intrusion detection has become essential to keeping networks secure. A number of intrusion detection methods have been developed for protecting computers and networks using conventional statistical methods as well as data mining methods. It is necessary that the capabilities of intrusion detection methods be updated with the creation of new attacks. This paper proposes a hybrid intrusion detection method that uses a combination of supervised and outlier based methods for improving the efficiency of detection of new and old attacks. The method is evaluated with the benchmark intrusion dataset called the knowledge discovery and data mining Cup 1999 dataset and the new version of KDD (NSL-KDD) dataset. Thus the performance of our method is very good.

A novel hybrid intrusion detection method integrating anomaly detection with misuse detection

In this paper, a new hybrid intrusion detection method that hierarchically integrates a misuse detection model and an anomaly detection model in a decomposition structure is proposed. First, a misuse detection model is built based on the C4.5 decision tree algorithm and then the normal training data is decomposed into smaller subsets using the model. Next, multiple one-class SVM models are created for the decomposed subsets. As a result, each anomaly detection model does not only use the known attack information indirectly, but also builds the profiles of normal behavior very precisely. The proposed hybrid intrusion detection method was evaluated by conducting experiments with the NSL-KDD data set, which is a modified version of well-known KDD Cup 99 data set. The experimental results demonstrate that the proposed method is better than the conventional methods in terms of the detection rate for both unknown and known attacks while it maintains a low false positive rate. In addition, the proposed method significantly reduces the high time complexity of the training and testing processes. Experimentally, the training and testing time of the anomaly detection model is shown to be only 50% and 60%, respectively, of the time required for the conventional models.

MLH-IDS: A Multi-Level Hybrid Intrusion Detection Method

With the growth of networked computers and associated applications, intrusion detection has become essential to keeping networks secure. A number of intrusion detection methods have been developed for protecting computers and networks using conventional statistical methods as well as data mining methods. Data mining methods for misuse and anomaly-based intrusion detection, usually encompass supervised, unsupervised and outlier methods. It is necessary that the capabilities of intrusion detection methods be updated with the creation of new attacks. This paper proposes a multi-level hybrid intrusion detection method that uses a combination of supervised, unsupervised and outlierbased methods for improving the efficiency of detection of new and old attacks. The method is evaluated with a captured real-time flow and packet dataset called the Tezpur University intrusion detection system (TUIDS) dataset, a distributed denial of service dataset, and the benchmark intrusion dataset called the knowledge discovery and data mining Cup 1999 dataset and the new version of KDD (NSL-KDD) dataset. Experimental results are compared with existing multi-level intrusion detection methods and other classifiers. The performance of our method is very good.