Implementation Of Intrusion Detection System Research Articles

Cybersecurity threats in the age of IoT: A review of protective measures

The Internet of Things (IoT) heralds a new era of connectivity, transforming the way devices interact and share information. With this transformative potential comes a concomitant rise in cybersecurity threats that pose significant challenges to the integrity of the IoT ecosystem. This paper undertakes a comprehensive examination of cybersecurity threats in the age of IoT, categorizing them into data breaches, malware attacks, physical manipulation, and more. Counteracting these threats necessitates a multifaceted approach encompassing device-level security, network-level measures, and effective management practices. Protective measures discussed include secure boot processes, encryption protocols, and the implementation of intrusion detection systems. However, persistent challenges, such as device diversity and resource constraints, underscore the need for ongoing research and development. Emerging technologies like blockchain, edge computing, and artificial intelligence offer promising avenues to bolster IoT security. In the pursuit of a secure IoT future, this paper emphasizes the critical importance of collaboration and collective efforts. The key findings underscore the centrality of robust security measures in the IoT landscape. The call to action resonates throughout the paper, urging stakeholders to unite in addressing challenges, embracing emerging technologies, and ensuring the responsible growth of IoT. Together, through shared knowledge and collaborative endeavors, we can forge a secure foundation for the continued expansion of IoT technologies

Implementation of IDS Using Snort with Barnyard2 Visualization for Network Monitoring in The Informatics Engineering Computer Lab at Muhammadiyah University Surakarta

The recent surge in cyberattacks should not be taken lightly, especially by large enterprises with sensitive data. Intrusion Detection Systems (IDS) are becoming a critical component for detecting network anomalies. One such network anomaly detection tool is SNORT, with a BASE (Basic Analysis and Security Engine) frontend for efficient data processing. Acting as a bridge between SNORT and BASE, the author uses barnyard2 as a backend to store logs obtained from SNORT into the database. The implementation methodology used in this research is an experimental approach, where the authors conduct experiments through trial and error to achieve the desired results. This IDS system was tested using two types of attacks, namely DDoS and SQL-Injection. The DDoS attack trial uses tools found in Kali Linux, namely Hping3 with 6 scenarios namely FIN, ACK, RST, UDP, SYN, and ICMP with the results detected in the snort database. SQL-Injection attack test using the DVWA vulnerable website with the result detected in the snort database when the attack is carried out. This proves that the accuracy level of the system reaches close to 100% with the rules given and the penetration testing given.

Logistic Regression Ensemble Classifier for Intrusion Detection System in Internet of Things

The Internet of Things (IoT) is a powerful technology that connect its users worldwide with everyday objects without any human interference. On the contrary, the utilization of IoT infrastructure in different fields such as smart homes, healthcare and transportation also raises potential risks of attacks and anomalies caused through node security breaches. Therefore, an Intrusion Detection System (IDS) must be developed to largely scale up the security of IoT technologies. This paper proposes a Logistic Regression based Ensemble Classifier (LREC) for effective IDS implementation. The LREC combines AdaBoost and Random Forest (RF) to develop an effective classifier using the iterative ensemble approach. The issue of data imbalance is avoided by using the adaptive synthetic sampling (ADASYN) approach. Further, inappropriate features are eliminated using recursive feature elimination (RFE). There are two different datasets, namely BoT-IoT and TON-IoT, for analyzing the proposed RFE-LREC method. The RFE-LREC is analyzed on the basis of accuracy, recall, precision, F1-score, false alarm rate (FAR), receiver operating characteristic (ROC) curve, true negative rate (TNR) and Matthews correlation coefficient (MCC). The existing researches, namely NetFlow-based feature set, TL-IDS and LSTM, are used to compare with the RFE-LREC. The classification accuracy of RFE-LREC for the BoT-IoT dataset is 99.99%, which is higher when compared to those of TL-IDS and LSTM.

ENSURING THE FORMATION OF CONTROL ACTIONS FOR CONTROLLING COMPUTER NODE BASED ON PROJECTION ALGORITHMS OF STOCHASTIC APPROXIMATION

In modern conditions, it is important that the implementation of the planned goals leads to the formation of the planned financial and administrative conditions, even in the case of the risk of unauthorized changes in computer systems and environments. There is a need to develop and implement intrusion detection systems that can collect data from various sources within computer systems and networks they protect. Operating systems have system logs, entries in system logs serve as a basis for analyzing the various causes of system failures, identifying and debugging them. Computer attacks are becoming more sophisticated, decreasing efficiency makes it difficult to use traditional anomaly detection methods, so new ones are required. These new approaches and methods are usually based, among other things, on the analysis of data obtained from the system log. After attacks, as more and more components fail, the state of the computer system gradually deteriorates, while number of resources available to perform tasks decrease. Therefore, in this study we consider control of computer nodes based on linear semi-Markov model with changes in the input stream of requests. The approach is based on the use of semi-Markov models of complex systems and analytical nodal modeling. A linear semi-Markov model is offered to describe behavior of a computer node with changes in the input stream of requests. Due to this model, estimates of the temporal functional characteristics for various operation modes of a computer node can be obtained. On its basis, it is possible to provide a response to unauthorized intrusions and, to some extent, compensate for them.

Intrusion detection using enhanced genetic sine swarm algorithm based deep meta-heuristic ANN classifier on UNSW-NB15 and NSL-KDD dataset

Prediction of malicious attacks and monitoring of network behaviour is significant for providing security and mitigating the loss of credential information. In order to monitor network traffic and identify different types of attacks in the network, numerous existing algorithms have been provided for classifying unauthorized access from the authorized access. However, the traditional techniques have faced complications in satisfying the accuracy while making predictions of malicious activities. Detection accuracy have been addressed as a drawback which hinders in making appropriate identification of threats. In order to overcome such challenges, the proposed work is designed with effective IDS mechanism for detecting and classifying the attacks taken from the UNSW-NB15 and NSL-KDD dataset. IDS (Intrusion Detection System) implementation is accomplished with three stages such as pre-processing is the initial phase in which scaling re-sizing of all images to similar width and height. Process of checking missing values reduces the computational complexities and enhances accuracy. Second stage is the novel feature-selection process accomplished by E-GSS (Enhanced Genetic Sine Swarm Intelligence) for selecting significant and optimal features. Finally, classification is the final phase in which intrusion is classified using novel DMH-ANN (Deep Meta-Heuristics Artificial Neural Network) which is internally being compared to three classifiers such as RF (Random Forest), NB (Naïve Bayes) and XG-Boost (Extreme Gradient). Experimental evaluation is carried out with the performance metrics such as accuracy, precision and recall and compared with existing algorithms for exhibiting the effectiveness of the proposed model. The research outcome reveals its efficiency in detecting and classifying attacks with greater accuracy.

Assessing Machine Learning Techniques for Intrusion Detection in Cyber-Physical Systems

Cyber-physical systems (CPS) are vital to key infrastructures such as Smart Grids and water treatment, and are increasingly vulnerable to a broad spectrum of evolving attacks. Whereas traditional security mechanisms, such as encryption and firewalls, are often inadequate for CPS architectures, the implementation of Intrusion Detection Systems (IDS) tailored for CPS has become an essential strategy for securing them. In this context, it is worth noting the difference between traditional offline Machine Learning (ML) techniques and understanding how they perform under different IDS applications. To answer these questions, this article presents a novel comparison of five offline and three online ML algorithms for intrusion detection using seven CPS-specific datasets, revealing that offline ML is superior when attack signatures are present without time constraints, while online techniques offer a quicker response to new attacks. The findings provide a pathway for enhancing CPS security through a balanced and effective combination of ML techniques.

Multi-Layered Filtration Framework for Efficient Detection of Network Attacks Using Machine Learning.

The advancements and reliance on digital data necessitates dependence on information technology. The growing amount of digital data and their availability over the Internet have given rise to the problem of information security. With the increase in connectivity among devices and networks, maintaining the information security of an asset has now become essential for an organization. Intrusion detection systems (IDS) are widely used in networks for protection against different network attacks. Several machine-learning-based techniques have been used among researchers for the implementation of anomaly-based IDS (AIDS). In the past, the focus primarily remained on the improvement of the accuracy of the system. Efficiency with respect to time is an important aspect of an IDS, which most of the research has thus far somewhat overlooked. For this purpose, we propose a multi-layered filtration framework (MLFF) for feature reduction using a statistical approach. The proposed framework helps reduce the detection time without affecting the accuracy. We use the CIC-IDS2017 dataset for experiments. The proposed framework contains three filters and is connected in sequential order. The accuracy, precision, recall and F1 score are calculated against the selected machine learning models. In addition, the training time and the detection time are also calculated because these parameters are considered important in measuring the performance of a detection system. Generally, decision tree models, random forest methods, and artificial neural networks show better results in the detection of network attacks with minimum detection time.

ANOMALY DETECTION IN ZIGBEE-BASED IOT USING SECURE AND EFFICIENT DATA COLLECTION

This article outlines various techniques for detecting types of attacks that may arise in ZigBee-based IoT system. The researchers introduced a hybrid Intrusion Detection System (IDS), combining rule-based intrusion detection and machine learning-based anomaly detection. Rule-based attack detection techniques are used to provide an accurate detection method for known attacks. However, determining accurate detection rules requires significant human effort that is susceptible to error. If it is done incorrectly, it can result in false alarms. Therefore, to alleviate this potential problem, the system is being upgraded by combining it (hybrid) with machine learning-based anomaly detection. This article expounds the researchers’ IDS implementation covering a wide variety of detection techniques to detect both known attacks and potential new types of attacks in ZigBee-based IoT system. Furthermore, a safe and efficient meth-od for large-scale IDS data collection is introduced to provide a trusted reporting mechanism that can operate on the stringent IoT resource requirements appropriate to today's IoT systems.

A deep learning approach for intrusion detection in Internet of Things using focal loss function

Internet of Things (IoT) is likely to revolutionize healthcare, energy, education, transportation, manufacturing, military, agriculture, and other industries. However, for the successful deployment of IoT in various industries, methods for detecting and preventing security breaches need to be designed and implemented. Over the past decade, a number of researchers in academia and industry have used Machine Learning (ML) techniques to design and implement Intrusion Detection Systems (IDSes) for computer networks in general; however, not much work has been done for intrusion detection in IoT. Datasets collected by various organizations were used by many of these researchers to train ML models for predicting intrusions. It is common for datasets used in such systems to be imbalanced (i.e., not all classes have equal number of samples). Predictive models developed using machine learning algorithms can produce unsatisfactory results if imbalanced datasets are used for training the models. To remedy this problem, techniques such as random oversampling and undersampling do not produce robust models. Furthermore, ML models trained using traditional loss functions, such as cross-entropy loss, fail to accurately predict minority class instances. To overcome the data imbalance problem for intrusion detection in IoT, we leverage the specialized loss function, called focal loss, that automatically down-weighs easy examples and focuses on the hard negatives by facilitating dynamically scaled-gradient updates for training effective ML models. We implemented our approach using two well-known Deep Learning (DL) neural network architectures. We conducted extensive experimental evaluations using three datasets from diverse IoT domains and compared our proposed approach with state-of-the-art intrusion detection models. We found that, our approach (training DL models using focal loss function) performed better with respect to accuracy, precision, F1 score and MCC score by as much as 24%, 39%, 39%, and 60%, respectively, compared to training them on the same datasets using cross-entropy loss function. We also compare our approach with two other state-of-the-art approaches and show that our approach performs better than these state-of-the-art approaches.

Design and Implementation of Intrusion Detection System (IDS) for Wireless Local Area Network (WLAN) Security at SMKN 5 Bengkulu City

The network at SMK Negeri 5 Bengkulu City at this time often has complaints such as a decrease in internet network performance which in turn affects all computers connected to the network. Intrusion Detection System (IDS) whose job is to monitor networks and suspicious activities in a network system. The research method that the authors use is a linear sequential process model. The life cycle of implementing a network system is defined in a number of phases, namely: Problem Identification and Formulation, Literature Study, Testing, Implementation, System Design, System Requirements Analysis. The author uses Snort, Telegram Bot on Ubuntu based IDS sensor engine. The results of this thesis research conclude that the applied IDS system can function to detect intruders or intruders on the IDS sensor machine, which is displayed in the form of notifications to telegrams.

Implementation of intrusion detection system and improvement utilising genetic algorithm

Implementation of intrusion detection system and improvement utilising genetic algorithm

Implementation of intrusion detection system and improvement utilising genetic algorithm

Implementation of intrusion detection system and improvement utilising genetic algorithm

Design and Implementation of Intrusion Detection Systems using RPL and AOVD Protocols-based Wireless Sensor Networks

Design and Implementation of Intrusion Detection Systems using RPL and AOVD Protocols-based Wireless Sensor Networks

Mengoptimalkan Keamanan Jaringan Komputer Menggunakan Snort dan Telegram Bot yang Terintegrasi dengan Mikrotik

The implementation of IDS (Intrusion Detection System) snort and telegram bot that can be integrated with a microtic router on the Uppala Villa Nusa Dua computer network is used to detect attack activities and suspicious activity on the Uppala Villa Nusa Dua computer network and to provide notification in real-time logs of suspicious activity on computer network. The research method used is the SPDLC (Security Policy Development Life Cycle) method which has six stages: Identification, Analysis, Design, Implementation, Testing and Evaluation. The software used on the server computer is Snort, WinPcap, Xampp and BASE (Basic Analysis and Security Engine) while for testing a computer network security system using Nmap, Loic and Brutus tools. The results obtained by the implementation of the IDS (Intrusion Detection System) Snort and telegram bot have been successfully implemented and can be integrated with the microtic router. Based on testing conducted after the implementation of the new system, it was found that 95% of the use of snort and telegram bot can optimize the computer network security system at Uppala Villa Nusa Dua.

Model-Based Feature Selection for Developing Network Attack Detection and Alerting System

The use of the Intrusion Detection Systems (IDS) still has unresolved problems, namely the lack of accuracy in attack detection, resulting in false-positive problems and many false alarms. Machine learning is one way that is often utilized to overcome challenges that arise during the implementation of IDS.. We present a system that uses a machine learning approach to detect network attacks and send attack alerts in this study. The CSE-CICIDS2018 Dataset and Model-Based Feature Selection technique are used to assess the performance of eight classifier algorithms in identifying network attacks in order to determine the best algorithm. The resulting XGBoost Model is chosen as the model that provides the highest performance results in this comparison of machine learning models, with an accuracy rate of 99 percent for two-class classification and 98.4 percent for multi-class classification.

An improved deep bagging convolutional neural network classifier for efficient intrusion detection system

In the current trend, the network-based system has substantial jobs, and they have become the targets of attackers. When an intrusion occurs, the security of a computer system is compromised. As a result, we must seek out the best methods for ensuring frameworks. A crucial component of the security management architecture is the intrusion detection system (IDS). To maintain effective network security, the design and implementation of IDS remain an important assessment topic. For intrusion detection, the previous system created an enhanced relevance vector machine (ERVM) classifier. However, intrusion detection is not robust for large-scale intrusion datasets, resulting in a high attack rate. The suggested work developed an improved deep bagging based convolutional neural network (DBCNN) for intrusion detection to address this issue. Preprocessing, feature selection, and classification are three processes included in the proposed framework. The KDD dataset is preprocessed in this stage using the kalman filter method. The feature selection is then carried out using the inertia weight based dragonfly method (IWDA). Finally, the DBCNN classifier successfully identifies interruption assaults. The KDD dataset is used to test the new model. The test results show that the proposed work accomplishes better execution contrasted and the current framework as far as accuracy, precision, recall and f-measure.

Effect of Balancing Data Using Synthetic Data on the Performance of Machine Learning Classifiers for Intrusion Detection in Computer Networks

Attacks on computer networks have increased significantly in recent days, due in part to the availability of sophisticated tools for launching such attacks as well as the thriving underground cyber-crime economy to support it. Over the past several years, researchers in academia and industry used machine learning (ML) techniques to design and implement Intrusion Detection Systems (IDSes) for computer networks. Many of these researchers used datasets collected by various organizations to train ML classifiers for detecting intrusions. In many of the datasets used in training ML classifiers in such systems, data are imbalanced (i.e., not all classes had equal number of samples). ML classifiers trained with such imbalanced datasets may produce unsatisfactory results. Traditionally, researchers used over-sampling and under-sampling for balancing data in datasets to overcome this problem. In this work, in addition to random over-sampling, we also used a synthetic data generation method, called Conditional Generative Adversarial Network (CTGAN), to balance data and study their effect on the performance of various widely used ML classifiers. To the best of our knowledge, no one else has used CTGAN to generate synthetic samples to balance intrusion detection datasets. Based on extensive experiments using widely used datasets NSL-KDD and UNSW-NB15, we found that training ML classifiers on datasets balanced with synthetic samples generated by CTGAN increased their prediction accuracy by up to 8% and improved their MCC score by up to 13%, compared to training the same ML classifiers over imbalanced datasets. We also show that this approach consistently performs better than some of the recently proposed state-of-the-art IDSes on both datasets. Our experiments also demonstrate that the accuracy of some ML classifiers trained over datasets balanced with random over-sampling decline compared to the same ML classifiers trained over original imbalanced dataset.

Methodology for detecting network intrusions and signs of computer attacks based on an empirical approach

The article analyzes the characteristics of detection of network intrusions into the information system and detection of signs of computer attacks at the enterprise; analysis of possible actions by attackers, methods and principles of establishing an optimal network intrusion detection system were investigated; considered the possibilities of developing and using systems for detecting network intrusions and detecting signs of computer attacks at the enterprise in modern conditions; researched and developed recommendations for the implementation of intrusion detection systems and detection of signs of computer attacks for possible further installation in the information protection system of any organization.

Reduction of the Delays Within an Intrusion Detection System (IDS) Based on Software Defined Networking (SDN)

Software Defined Networking (SDN) is a very useful tool not only to manage networks but also to increase network security, in particular by implementing Intrusion Detection Systems (IDS) directly into the SDN architecture. The implementation of IDS within the SDN paradigm can simplify the implementation, speed up incident responses, and, in general, allow to promptly react to cyber attacks through proper countermeasures. Nevertheless, embedding IDS within SDN also introduces delays that cannot be tolerated in specific network environments, like industrial control systems. This paper focuses on the implementation of an IDS based on Machine Learning (ML) algorithms into an SDN architecture and proposes a very practical approach to reduce the delay by using the sequential implementation of prototypes of increasing software and hardware complexity so allowing quick tests to highlight the main problems, solve them and pass to the next operative step. A fully validated performance evaluation is then shown by exploiting all the presented solutions and by using further improved hardware features. The overall performance is very good and compliant with most, even if not yet all, industrial control systems constraints. Results show how the proposed solutions provide a significant improvement of the latency so opening the door to a real implementation in the field.

Intrusion Detection System with Remote Signalling for Vehicles Using an Arduino Controller and Radio-Frequency Technology

Malicious activities or policy violations have been a concern for the past years. For example, many people have been victims of robbery on vehicles. A conceptual diagram of an Intrusion Detection System (IDS) [1] [2] for vehicles with remote signaling using an Arduino controller and radio-frequency technology is proposed in this paper. To address malicious activities on vehicles, two aspects are considered here, namely: notifier and detector. Firstly, an object-oriented C module that puts on and off a controller (installed inside the vehicle) and an anti-theft electronic editing that powered using an alternator and supported by a back-up battery are implemented. Secondly, a magnetic intrusion sensor, controlled by a proximity detector using radio-frequency technology, has been installed on each vehicle door. To enable IDS, a user needs to activate the monitoring system when leaving their vehicle. This is done using a remote system. In case the user does not activate the monitoring system while leaving the vehicle, a 5-meter-proximity detector will automatically lock the system and set off the monitoring system whenever the user is outside the detection zone. The detection zone is a 5-meter radius area centered at the controller. Here, monitoring consists of geolocating any intruders within the detection zone. This means, if any of the vehicle doors is opened while the system is still locked, the controller will activate the vehicle alarm for a few seconds, thereafter send an SMS notification to the owner. The system automatically unlocks as soon as the proximity detector is within the detection zone. The contribution of this paper, as compared to other similar work, is to reinforce the electronic implementation of IDS.