Hybrid Intrusion Detection System Research Articles

A Deep Intelligent Hybrid Intrusion Detection Framework with LIME

Network security has grown to be a major issue as a result of the development of Internet of Things (IoT) devices. Attacks known as Distributed Denial of Service (DDoS) can overwhelm and impair networks. In order to identify DDoS and other network intrusion threats in real-time, accurately, and with justification, this study suggests a unique deep learning-driven fog computing architecture named as Deep Intelligent Hybrid Intrusion Detection Framework with LIME (DIHIF-LIME). The main advancement is the creation of a hybrid intrusion detection system that integrates randomness measurements taken from network traffic with a K-Nearest Neighbor (KNN) machine learning classifier. The justification for predictions is explained using Local Interpretable Model-Agnostic Explanations (LIME), which promotes explainability. Using datasets including network assaults, Long-Short-Term Memory (LSTM) neural networks are created and compared. Utilizing 5-fold cross-validation, LSTM outperformed benchmarks with the maximum accuracy of 99.97%. In conclusion, the proposed fog computing intrusion detection framework with LIME explainability offers a rapid, precise, scalable, and interpretable end-to-end solution from IoT devices to the cloud. A thorough test shows that the method is effective in protecting IoT networks from DDoS and other assaults. The two main advances th­­at are presented are hybrid detection and LIME explainability.

Secure Your Network: Building a Hybrid Intrusion Detection System in Java

Abstract: To protect the system from different types of intrusions, an intrusion detection system ID is required. It is essential to analyse the communication in order to classify the material as malicious or helpful. The usage of intrusion detection systems for cyber security shouldn't add to the processing time required for classification. These days, classification algorithms are utilized in conjunction with machine learning approaches to identify harmful data or intrusions. KDD cup 99 is the data set that was used in the experiment. Hybrid classification models can be used to adjust the performance of individual classification methods. This model blends rule-based algorithms with categorization techniques. An additional degree of security is provided by the combination of machine and human intelligence in classification. Precision, recall, F-Measure, and Mean Age Precision are used to validate an algorithm. The algorithm has a 92.35 percent accuracy rate. Even after merging our human-written criteria with traditional machine learning classification techniques, the model's accuracy is still considered satisfactory. However, there is still room for improvement and a more specific classification of the attack

Combating Evolving Threats: A Signature-Anomaly Based Hybrid Intrusion Detection System for Smart Homes with False Positive Mitigation

Abstract: As people are looking for a more comfortable life, IoT applications are coming to play. Smart home system is one of the most popular IoT applications in the last decade. A smart home network is crucial to function smart home system properly. Cyber attacks on a smart home network can damage a lot. Network intrusion detection and prevention system (NIDPS) is a good solution to protect against Cyber threat in smart home network. This research will implement hybrid NIDPS in smart home network by combining signature based and anomaly-detection based NIDPS. This hybrid NIDPS will prevent known known attack from public internet, local internet and zero-day attack. Also, this system will be able to reduce false positive result and improve signature based NIDPS rules accurately by manual inspection.

Enhanced Hybrid Intrusion Detection System with Attention Mechanism using Deep Learning

Enhanced Hybrid Intrusion Detection System with Attention Mechanism using Deep Learning

A novel intrusion detection system based on a hybrid quantum support vector machine and improved Grey Wolf optimizer

AbstractThe Internet of Things (IoT) has grown significantly in recent years, allowing devices with sensors to share data via the internet. Despite the growing popularity of IoT devices, they remain vulnerable to cyber-attacks. To address this issue, researchers have proposed the Hybrid Intrusion Detection System (HIDS) as a way to enhance the security of IoT. This paper presents a novel intrusion detection model, namely QSVM-IGWO, for improving the detection capabilities and reducing false positive alarms of HIDS. This model aims to improve the performance of the Quantum Support Vector Machine (QSVM) by incorporating parameters from the Improved Grey Wolf Optimizer (IGWO) algorithm. IGWO is introduced under the hypothesis that the social hierarchy observed in grey wolves enhances the searching procedure and overcomes the limitations of GWO. In addition, the QSVM model is employed for binary classification by selecting the kernel function to obtain an optimal solution. Experimental results show promising performance of QSVM-IGWO in terms of accuracy, Recall, Precision, F1 score, and ROC curve, when compared with recent detection models.

Multi-task learning for IoT traffic classification: A comparative analysis of deep autoencoders

As a system allowing intra-network devices to automatically communicate over the Internet, the Internet of Things (IoT) faces increasing popularity in modern applications and security threats — particularly network intrusions that target both networks and devices. A major threat is network attacks that attempt to obtain unauthorised access and damage the networks or systems. To effectively safeguard against these attacks, it is essential to use efficient hybrid intrusion detection systems with advanced techniques. Deep learning-based algorithms, such as Autoencoders (AEs), have been recognised as efficient methods for intrusion detection. However, it is crucial to further analyse the impact of different structures on detection performance. This paper proposes a method combining AE for data reconstruction and anomaly detection and multi-task learning (MTL)-structured models for IoT traffic classification. Additionally, we suggest a hybrid resampling technique with the Synthetic Minority Over-Sampling Technique and Generative Adversarial Network (SMOTE-GAN) for enhanced training and conduct a comparative analysis of different neural networks with AEs. The experimental results on two publicly available datasets demonstrate the effectiveness and practicality of the proposed AE-MTL approach compared with single-task learning. Additionally, while the performance varies on different datasets, Long Short-Term Memory (LSTM), Gated Recurrent Units (GRU), and Convolutional Neural Network (CNN) have improved the detection of minor classes.

Self-healing hybrid intrusion detection system: an ensemble machine learning approach

The increasing complexity and adversity of cyber-attacks have prompted discussions in the cyber scenario for a prognosticate approach, rather than a reactionary one. In this paper, a signature-based intrusion detection system has been built based on C5 classifiers, to classify packets into normal and attack categories. Next, an anomaly-based intrusion detection was built based on the LSTM (Long-Short Term Memory) algorithm to detect anomalies. These anomalies are then fed into the signature generator to extract attributes. These attributes get uploaded into the C5 training set, aiding the ensemble model in continual learning with expanding signatures of unknown attacks. By generating signatures of unknown attacks, the self-healing attribute of the ensemble model contributes to the early detection of attacks. For the C5 classifier, the proposed model is evaluated on the UNSW-NB15 dataset, while for the LSTM model, it is evaluated on the ADFA-LD dataset. Compared to conventional models, the experimental results show better detection rates for both known and unknown attacks. The C5 classifier achieved a True Positive Rate of 97% while maintaining a false positive rate of 8%. Also, the LSTM model achieved a detection rate of 90% while retaining a 17% False Alarm Rate. As the proposed model learns, its performance in real network traffic also improves and it also eliminates human intervention when updating training data.

PCA-ANN: Feature selection based hybrid intrusion detection system in software defined network

Software Defined Networking (SDN) proposes a centralized network paradigm where a central controller manages the network. While this centralizes scheme opens up previously unachievable opportunities, it also makes the network more susceptible to a varying range of cyber threats. The development of effective Intrusion Detection Systems (IDS) designed for the SDN topology is a critical need to address the different vulnerabilities SDN faces. Towards that purpose, the inSDN dataset was specifically curated for intrusion detection in SDN with various attack scenarios unique to the SDN topology. This study leveraged the inSDN dataset to introduce an innovative Intrusion Detection System (IDS) model that amalgamates Principal Component Analysis (PCA), a dimensionality reduction technique widely employed in traditional Machine Learning (ML) to extract the principal features of the dataset and couples it with Artificial Neural Networks (ANN) to classify network traffic based on the extracted features. The proposed model attains an exceptional accuracy rate of 99.95% for multi-class classification and demonstrate that it surpasses the current state-of-the-art techniques while operating within a much simpler framework. This significantly diminishes the necessity for complex models that demand extensive computational resources when dealing with the inSDN attack dataset. The analysis of the dataset carried out in this study also provides insights into the redundancy present in the dataset and identifies the core features that contains most of the information in the dataset.

Smart Electrical Substation Cybersecurity Model Based on WPA3 and Cooperative Hybrid Intrusion Detection System (CHIDS)

Smart Electrical Substation Cybersecurity Model Based on WPA3 and Cooperative Hybrid Intrusion Detection System (CHIDS)

A Hybrid Intrusion Detection Approach for Cyber Attacks

The field of cybersecurity constantly evolves as attackers develop new methods and technologies. Defending against cyberattacks involves a combination of robust security measures, regular updates, user education, and the use of advanced technologies, such as intrusion detection systems and artificial intelligence, to find out the threats in real-time. IDS are designed to identify and address any unauthorized actions or potential security threats within a computer network or system. A hybrid intrusion detection system (IDS) combines many detection techniques and strategies from different IDS types into a single, coherent solution. Combining the benefits of each approach should result in more comprehensive and effective intrusion detection. This paper outlines a proposed anomaly intrusion detection system (AIDS) framework that leverages a hybrid of deep learning strategies. It incorporates Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) models, which were developed using XGBoost, and their efficacy was assessed with the NSL-KDD dataset. The evaluation of the suggested model focused on its accuracy, detection capabilities, and the rate of false positives. The outcomes of this research are noteworthy within the cybersecurity field. In this paper, a framework of an Anomaly IDS is proposed. The purpose of an anomaly IDS, or AIDS, is to spot odd behavior on a network or system that might point to a security breach or malevolent attempt to hack it. Anomaly-based IDSs concentrate on finding departures from accepted typical behavior, in contrast to signature-based detection systems, which depend on a predefined database of known attack patterns.

LH-IDS: Lightweight Hybrid Intrusion Detection System Based on Differential Privacy in VANETs

LH-IDS: Lightweight Hybrid Intrusion Detection System Based on Differential Privacy in VANETs

Hybrid Intrusion Detection System Based on Data Resampling and Deep Learning

Hybrid Intrusion Detection System Based on Data Resampling and Deep Learning

ILIDViz: An Incremental Learning-Based Visual Analysis System for Network Anomaly Detection

BackgroundWith the development of information technology, network traffic logs mixed with various kinds of cyber-attacks have grown explosively. Traditional intrusion detection systems (IDS) have limited ability to discover new inconstant patterns and identify malicious traffic traces in real-time. It is urgent to implement more effective intrusion detection technologies to protect computer security. MethodsIn this paper, we design a hybrid IDS, combining our incremental learning model (KAN-SOINN) and active learning, to learn new log patterns and detect various network anomalies in real-time. Results & ConclusionsThe experimental results on the NSLKDD dataset show that the KAN-SOINN can be improved continuously and detect malicious logs more effectively. Meanwhile, the comparative experiments prove that using a hybrid query strategy in active learning can improve the model learning efficiency.

Blockchain Assisted Hybrid Intrusion Detection System in Autonomous Vehicles for Industry 5.0

Blockchain Assisted Hybrid Intrusion Detection System in Autonomous Vehicles for Industry 5.0

Development of hybrid intrusion detection system based on Suricata with pfSense method for high reduction of DDoS attacks on IPv6 networks

Distributed Denial of Service (DDoS) attacks is a problem in computer networks. DDoS attacks pose a significant threat to internet networks as they cause congestion and disrupt the optimal functioning of servers. Detecting the source of these attacks is essential for effective protection. Therefore, in this study, we propose a hybrid strategy that combines Suricata, an intrusion detection system (IDS), with pfSense, a firewall, to address DDoS attacks. Suricata, the IDS, can identify the destination of the attack, which allows pfSense, the Firewall, to block the attack by dropping packets sent by the attacker. As a result, by leveraging this combined approach, we have observed significant improvements in the quality of service (QoS). The results of our study indicate a 1.08 % increase in throughput value, from 1881.97 bytes to 902.44 bytes, demonstrating improved efficiency in data transmission. Additionally, we observed a 57.32 % increase in the average total number of packets sent, from 1382 packets to 3238 packets, indicating better network performance. Furthermore, the proposed strategy significantly reduced delay and jitter values. The delay value decreased by 88.78 %, from 90.76 ms to 10.18 ms, and the jitter value decreased by 88.99 %, from 181.85 ms to 20.03 ms. These improvements signify a notable reduction in latency and packet timing variations, leading to a smoother network experience. Another crucial aspect we evaluated was the CPU utilization. The proposed strategy resulted in a substantial decrease in CPU utilization by 81.23 %, from 78.3 % to 14.7 %. The combination of pfSense and Suricata has proven to be a successful approach, providing robust protection against DDoS attacks, including those utilizing IPv6. This research can be implemented as a solution on a campus ad-hoc network with limited computers

Hybrid Intrusion Detection Systems Based Mean-Variance Mapping Optimization Algorithm and Random Search

Hybrid Intrusion Detection Systems Based Mean-Variance Mapping Optimization Algorithm and Random Search

Deep Learning Based Hybrid Intrusion Detection Systems to Protect Satellite Networks

Despite the fact that satellite-terrestrial systems have advantages such as high throughput, low latency, and low energy consumption, as well as low exposure to physical threats and natural disasters and cost-effective global coverage, their integration exposes both of them to particular security challenges that can arise due to the migration of security challenges from one to another. Intrusion Detection Systems (IDS) can also be used to provide a high level of protection for modern network environments such as satellite-terrestrial integrated networks (STINs). To optimize the detection performance of malicious activities in network traffic, four hybrid intrusion detection systems for satellite-terrestrial communication systems (SAT-IDSs) are proposed in this paper. All the proposed systems exploit the sequential forward feature selection (SFS) method based on random forest (RF) to select important features from the dataset that increase relevance and reduce complexity and then combine them with a machine learning (ML) or deep learning (DL) model; Random Forest (RF), Long Short-Term memory (LSTM), Artificial Neural Networks (ANN), and Gated Recurrent Unit (GRU). Two datasets—STIN, which simulates satellite networks, and UNSW-NB15, which simulates terrestrial networks—were used to evaluate the performance of the proposed SAT-IDSs. The experimental results indicate that selecting significant and crucial features produced by RF-SFS vastly improves detection accuracy and computational efficiency. In the first dataset (STIN), the proposed hybrid ML system SFS-RF achieved an accuracy of 90.5% after using 10 selected features, compared to 85.41% when using the whole dataset. Furthermore, the RF-SFS-GRU model achieved the highest performance of the three proposed hybrid DL-based SAT-IDS with an accuracy of 87% after using 10 selected features, compared to 79% when using the entire dataset. In the second dataset (UNSW-NB15), the proposed hybrid ML system SFS-RF achieved an accuracy of 78.52% after using 10 selected features, compared to 75.4% when using the whole dataset. The model with the highest accuracy of the three proposed hybrid DL-based SAT-IDS was the RF-SFS-GRU model. It achieved an accuracy of 79% after using 10 selected features, compared to 74% when using the whole dataset.

ANOMALY DETECTION IN ZIGBEE-BASED IOT USING SECURE AND EFFICIENT DATA COLLECTION

This article outlines various techniques for detecting types of attacks that may arise in ZigBee-based IoT system. The researchers introduced a hybrid Intrusion Detection System (IDS), combining rule-based intrusion detection and machine learning-based anomaly detection. Rule-based attack detection techniques are used to provide an accurate detection method for known attacks. However, determining accurate detection rules requires significant human effort that is susceptible to error. If it is done incorrectly, it can result in false alarms. Therefore, to alleviate this potential problem, the system is being upgraded by combining it (hybrid) with machine learning-based anomaly detection. This article expounds the researchers’ IDS implementation covering a wide variety of detection techniques to detect both known attacks and potential new types of attacks in ZigBee-based IoT system. Furthermore, a safe and efficient meth-od for large-scale IDS data collection is introduced to provide a trusted reporting mechanism that can operate on the stringent IoT resource requirements appropriate to today's IoT systems.

HDLNIDS: Hybrid Deep-Learning-Based Network Intrusion Detection System

Attacks on networks are currently the most pressing issue confronting modern society. Network risks affect all networks, from small to large. An intrusion detection system must be present for detecting and mitigating hostile attacks inside networks. Machine Learning and Deep Learning are currently used in several sectors, particularly the security of information, to design efficient intrusion detection systems. These systems can quickly and accurately identify threats. However, because malicious threats emerge and evolve regularly, networks need an advanced security solution. Hence, building an intrusion detection system that is both effective and intelligent is one of the most cognizant research issues. There are several public datasets available for research on intrusion detection. Because of the complexity of attacks and the continually evolving detection of an attack method, publicly available intrusion databases must be updated frequently. A convolutional recurrent neural network is employed in this study to construct a deep-learning-based hybrid intrusion detection system that detects attacks over a network. To boost the efficiency of the intrusion detection system and predictability, the convolutional neural network performs the convolution to collect local features, while a deep-layered recurrent neural network extracts the features in the proposed Hybrid Deep-Learning-Based Network Intrusion Detection System (HDLNIDS). Experiments are conducted using publicly accessible benchmark CICIDS-2018 data, to determine the effectiveness of the proposed system. The findings of the research demonstrate that the proposed HDLNIDS outperforms current intrusion detection approaches with an average accuracy of 98.90% in detecting malicious attacks.

Ensemble of Learner for Network Intrusion Detection System

The uses of the internet have improved drastically for online communication and working from home. Data sharing and integration of global information bring network security risks. To protect private data and information, network security is becoming a very important research topic. An intrusion detection system is generally used as safe operational tool. It excellently detects and prevents intruders in a network by issuing a warning before the attack is launched in a network. An ensemble technique is extensively used to employ intrusion detection systems. In this paper, the stacking method of the ensemble has been proposed for the intrusion detection system. Three base classifiers have been stacked using the Meta classifier. Multilayer Perceptron, Ripple Down Rule learner, and RepTree Decision Tree have been used as Base Classifiers. These Base Classifiers are stacked using Logistic Regression with ridge estimator Meta Classifier. These learners have been trained and tested using the NSL dataset. A genetic algorithm has been applied for choosing relevant and most corrected features which helped in reducing the dimension of the dataset. Experimental results demonstrate that the proposed stacked classifier gives accuracies of 79.36%, 99.72%, and 99.64% on a test, train dataset, and cross-validation respectively. It is observed that the proposed stacked classifiers do better than existing hybrid intrusion detection systems.