Implement Intrusion Detection Research Articles

Optimizing IoT Intrusion Detection Using Balanced Class Distribution, Feature Selection, and Ensemble Machine Learning Techniques.

Internet of Things (IoT) devices are leading to advancements in innovation, efficiency, and sustainability across various industries. However, as the number of connected IoT devices increases, the risk of intrusion becomes a major concern in IoT security. To prevent intrusions, it is crucial to implement intrusion detection systems (IDSs) that can detect and prevent such attacks. IDSs are a critical component of cybersecurity infrastructure. They are designed to detect and respond to malicious activities within a network or system. Traditional IDS methods rely on predefined signatures or rules to identify known threats, but these techniques may struggle to detect novel or sophisticated attacks. The implementation of IDSs with machine learning (ML) and deep learning (DL) techniques has been proposed to improve IDSs' ability to detect attacks. This will enhance overall cybersecurity posture and resilience. However, ML and DL techniques face several issues that may impact the models' performance and effectiveness, such as overfitting and the effects of unimportant features on finding meaningful patterns. To ensure better performance and reliability of machine learning models in IDSs when dealing with new and unseen threats, the models need to be optimized. This can be done by addressing overfitting and implementing feature selection. In this paper, we propose a scheme to optimize IoT intrusion detection by using class balancing and feature selection for preprocessing. We evaluated the experiment on the UNSW-NB15 dataset and the NSL-KD dataset by implementing two different ensemble models: one using a support vector machine (SVM) with bagging and another using long short-term memory (LSTM) with stacking. The results of the performance and the confusion matrix show that the LSTM stacking with analysis of variance (ANOVA) feature selection model is a superior model for classifying network attacks. It has remarkable accuracies of 96.92% and 99.77% and overfitting values of 0.33% and 0.04% on the two datasets, respectively. The model's ROC is also shaped with a sharp bend, with AUC values of 0.9665 and 0.9971 for the UNSW-NB15 dataset and the NSL-KD dataset, respectively.

Multi-classification in-vehicle intrusion detection system using packet- and sequence-level characteristics from time-embedded transformer with autoencoder

In recent years, the increased application of controller area network (CAN) protocols has made it the de facto standard for communication between electronic control units (ECUs) in the automotive and transportation fields. This widely used protocol was designed as a reliable and straightforward broadcast-based protocol that connects ECUs without considering security concerns such as node authentication or traffic encryption. Despite its efficiency, this tradeoff makes the CAN bus vulnerable to attacks. Implementing intrusion detection systems (IDSs) based on machine learning (ML) can address these security challenges effectively. However, existing ML-based IDSs have limited classification capabilities, lack adaptability and time sensitivity, incomprehensive analysis, and produce high false-negative rates (FNR), while attack schemes are becoming increasingly complex, resulting in insufficient capability of intrusion detection in real-time and insufficient ability to offer reliable protection. Therefore, our study proposes a novel in-vehicle IDS for multiclass classification using both packet- and sequence-level characteristics extracted from an autoencoder and a variant transformer (Time-embedded Transformer) with an improved position encoding mechanism, which analyses CAN traffic in-depth from various perspectives to overcome the existing challenges above. Both standard (Car-Hacking) and advanced (ROAD) datasets are used to evaluate the capabilities of our proposed IDS. The evaluation results demonstrated 100 % detection accuracy and 0 % FNR for both the Car-Hacking and ROAD Masquerade datasets, which also peaked at the highest F1 score for the ROAD Fabrication dataset, emphasizing superior intrusion detection to minimize FNR of the proposed model with high adaptability through its multi-dimensional analysis at packet- and sequence-level.

Implementing Intrusion Detection and Prevention in SDN

Implementing Intrusion Detection and Prevention in SDN

ENSURING THE FORMATION OF CONTROL ACTIONS FOR CONTROLLING COMPUTER NODE BASED ON PROJECTION ALGORITHMS OF STOCHASTIC APPROXIMATION

In modern conditions, it is important that the implementation of the planned goals leads to the formation of the planned financial and administrative conditions, even in the case of the risk of unauthorized changes in computer systems and environments. There is a need to develop and implement intrusion detection systems that can collect data from various sources within computer systems and networks they protect. Operating systems have system logs, entries in system logs serve as a basis for analyzing the various causes of system failures, identifying and debugging them. Computer attacks are becoming more sophisticated, decreasing efficiency makes it difficult to use traditional anomaly detection methods, so new ones are required. These new approaches and methods are usually based, among other things, on the analysis of data obtained from the system log. After attacks, as more and more components fail, the state of the computer system gradually deteriorates, while number of resources available to perform tasks decrease. Therefore, in this study we consider control of computer nodes based on linear semi-Markov model with changes in the input stream of requests. The approach is based on the use of semi-Markov models of complex systems and analytical nodal modeling. A linear semi-Markov model is offered to describe behavior of a computer node with changes in the input stream of requests. Due to this model, estimates of the temporal functional characteristics for various operation modes of a computer node can be obtained. On its basis, it is possible to provide a response to unauthorized intrusions and, to some extent, compensate for them.

Federated Learning for IoT Intrusion Detection

The number of Internet of Things (IoT) devices has increased considerably in the past few years, resulting in a large growth of cyber attacks on IoT infrastructure. As part of a defense in depth approach to cybersecurity, intrusion detection systems (IDSs) have acquired a key role in attempting to detect malicious activities efficiently. Most modern approaches to IDS in IoT are based on machine learning (ML) techniques. The majority of these are centralized, which implies the sharing of data from source devices to a central server for classification. This presents potentially crucial issues related to privacy of user data as well as challenges in data transfers due to their volumes. In this article, we evaluate the use of federated learning (FL) as a method to implement intrusion detection in IoT environments. FL is an alternative, distributed method to centralized ML models, which has seen a surge of interest in IoT intrusion detection recently. In our implementation, we evaluate FL using a shallow artificial neural network (ANN) as the shared model and federated averaging (FedAvg) as the aggregation algorithm. The experiments are completed on the ToN_IoT and CICIDS2017 datasets in binary and multiclass classification. Classification is performed by the distributed devices using their own data. No sharing of data occurs among participants, maintaining data privacy. When compared against a centralized approach, results have shown that a collaborative FL IDS can be an efficient alternative, in terms of accuracy, precision, recall and F1-score, making it a viable option as an IoT IDS. Additionally, with these results as baseline, we have evaluated alternative aggregation algorithms, namely FedAvgM, FedAdam and FedAdagrad, in the same setting by using the Flower FL framework. The results from the evaluation show that, in our scenario, FedAvg and FedAvgM tend to perform better compared to the two adaptive algorithms, FedAdam and FedAdagrad.

Intelligent Intrusion Detection for Internet of Things Security: A Deep Convolutional Generative Adversarial Network-Enabled Approach

With the rapid advance of Internet of Things (IoT), it is difficult for cloud-centric computing to meet the requirements of low latency and ease of use. As an open and distributed system, edge computing integrates computing, networking, storage, and applications. It provides intelligent services on the edge of an IoT. The edge network is composed of various wireless and wired networks, and the computing and storage resources of edge nodes are limited. These conditions make the edge network expose to a variety of cyber attacks. Additionally, it is difficult for an IoT edge node to support large-scale network data collection and detection for IoT security. Although big data-enabled intrusion detection algorithms can ensure the high accuracy of intrusion detection systems, it is stressful for resource-limited edge nodes to implement those algorithms in IoT. Motivated by these challenges, we propose an intelligent intrusion detection algorithm implemented by big data mining based on a fuzzy rough set, generative adversarial network (GAN), and convolutional neural network (CNN). In our method, we first propose a fuzzy rough set-based algorithm to perform feature selection for big data via IoT. Then, we take advantage of the efficient feature extraction capabilities of CNN for implementing intrusion detection based on selected features. Furthermore, after combining CNN and GAN, we propose an intelligent algorithm to realize intrusion detection in a variety of scenarios. Finally, the proposed method is compared with existing methods for evaluation. Simulation results show that our method has up to 4% higher accuracy than existing methods.

A deep learning approach for intrusion detection in Internet of Things using focal loss function

Internet of Things (IoT) is likely to revolutionize healthcare, energy, education, transportation, manufacturing, military, agriculture, and other industries. However, for the successful deployment of IoT in various industries, methods for detecting and preventing security breaches need to be designed and implemented. Over the past decade, a number of researchers in academia and industry have used Machine Learning (ML) techniques to design and implement Intrusion Detection Systems (IDSes) for computer networks in general; however, not much work has been done for intrusion detection in IoT. Datasets collected by various organizations were used by many of these researchers to train ML models for predicting intrusions. It is common for datasets used in such systems to be imbalanced (i.e., not all classes have equal number of samples). Predictive models developed using machine learning algorithms can produce unsatisfactory results if imbalanced datasets are used for training the models. To remedy this problem, techniques such as random oversampling and undersampling do not produce robust models. Furthermore, ML models trained using traditional loss functions, such as cross-entropy loss, fail to accurately predict minority class instances. To overcome the data imbalance problem for intrusion detection in IoT, we leverage the specialized loss function, called focal loss, that automatically down-weighs easy examples and focuses on the hard negatives by facilitating dynamically scaled-gradient updates for training effective ML models. We implemented our approach using two well-known Deep Learning (DL) neural network architectures. We conducted extensive experimental evaluations using three datasets from diverse IoT domains and compared our proposed approach with state-of-the-art intrusion detection models. We found that, our approach (training DL models using focal loss function) performed better with respect to accuracy, precision, F1 score and MCC score by as much as 24%, 39%, 39%, and 60%, respectively, compared to training them on the same datasets using cross-entropy loss function. We also compare our approach with two other state-of-the-art approaches and show that our approach performs better than these state-of-the-art approaches.

An Enterprise of Cognitive Fog Computing For Disturbance Recognition in Internet of Things

The Internet of Things (IoT) is a cutting-edge piece of cybernetic infrastructure that will eventually link all manner of previously disconnected physical objects to the web. The IoT is rapidly expanding into many facets of human life. IoT's attack surface has grown as a result of the technology's hyper-connectivity and inherent heterogeneity. In addition, IoT devices are used in both managed and unmanaged settings, leaving them open to innovative attacks. Fog computing is used in the proposed intrusion detection system for IoT applications to implement intrusion detection in a decentralised manner. Attack detection at fog nodes and summarization on a cloud server make up the proposed system's two parts. The local fog nodes in the IoT environment examine the traffic, and then they send a report to the cloud server that summarises the current global security state of the IoT application. According to the results of the experiments, the fog nodes are able to identify the attack 27% more quickly while also reducing the number of false alarms. The work that has been recommended provides a beginning point for the creation of a fog-based intrusion detection system that can be used for applications related to the IoT. The proposed system has a false alarm rate of only 0.32% and an accuracy of 98.15 percent. The proposed method can only identify attacks that conform to specific patterns.

Intrusion Detection in IoT Using Deep Learning.

Cybersecurity has been widely used in various applications, such as intelligent industrial systems, homes, personal devices, and cars, and has led to innovative developments that continue to face challenges in solving problems related to security methods for IoT devices. Effective security methods, such as deep learning for intrusion detection, have been introduced. Recent research has focused on improving deep learning algorithms for improved security in IoT. This research explores intrusion detection methods implemented using deep learning, compares the performance of different deep learning methods, and identifies the best method for implementing intrusion detection in IoT. This research is conducted using deep learning models based on convolutional neural networks (CNNs), long short-term memory (LSTM), and gated recurrent units (GRUs). A standard dataset for intrusion detection in IoT is considered to evaluate the proposed model. Finally, the empirical results are analyzed and compared with the existing approaches for intrusion detection in IoT. The proposed method seemed to have the highest accuracy compared to the existing methods.

A LSTM-FCNN based multi-class intrusion detection using scalable framework

Machine learning methods are widely used to implement intrusion detection models for detecting and classifying intrusions in a network or a system. However, many challenges arise since hackers continuously change the attacking patterns by discovering new system vulnerabilities. The degree of malicious attempts increases rapidly; as a result, conventional approaches fail to process voluminous data. So, a sophisticated detection approach with scalable solutions is required to tackle the problem. A deep learning model is proposed to address the intrusion classification problem effectively. The LSTM (Long Short-Term Memory) and FCN (Fully Connected Network) deep learning approaches classify the benign and malicious connections on intrusion datasets. The objective is to classify multi-class attack patterns more accurately. The proposed deep learning model provides a better classification result in two-class and five-class problems. It achieves an accuracy of 98.52%, 98.94%, 99.03%, 99.36%, 100%, and 99.64% using KDDCup99, NSLKDD, GureKDD, KDDCorrected, Kyoto, NITRIDS dataset respectively.

Reduction of the Delays Within an Intrusion Detection System (IDS) Based on Software Defined Networking (SDN)

Software Defined Networking (SDN) is a very useful tool not only to manage networks but also to increase network security, in particular by implementing Intrusion Detection Systems (IDS) directly into the SDN architecture. The implementation of IDS within the SDN paradigm can simplify the implementation, speed up incident responses, and, in general, allow to promptly react to cyber attacks through proper countermeasures. Nevertheless, embedding IDS within SDN also introduces delays that cannot be tolerated in specific network environments, like industrial control systems. This paper focuses on the implementation of an IDS based on Machine Learning (ML) algorithms into an SDN architecture and proposes a very practical approach to reduce the delay by using the sequential implementation of prototypes of increasing software and hardware complexity so allowing quick tests to highlight the main problems, solve them and pass to the next operative step. A fully validated performance evaluation is then shown by exploiting all the presented solutions and by using further improved hardware features. The overall performance is very good and compliant with most, even if not yet all, industrial control systems constraints. Results show how the proposed solutions provide a significant improvement of the latency so opening the door to a real implementation in the field.

Effect of Balancing Data Using Synthetic Data on the Performance of Machine Learning Classifiers for Intrusion Detection in Computer Networks

Attacks on computer networks have increased significantly in recent days, due in part to the availability of sophisticated tools for launching such attacks as well as the thriving underground cyber-crime economy to support it. Over the past several years, researchers in academia and industry used machine learning (ML) techniques to design and implement Intrusion Detection Systems (IDSes) for computer networks. Many of these researchers used datasets collected by various organizations to train ML classifiers for detecting intrusions. In many of the datasets used in training ML classifiers in such systems, data are imbalanced (i.e., not all classes had equal number of samples). ML classifiers trained with such imbalanced datasets may produce unsatisfactory results. Traditionally, researchers used over-sampling and under-sampling for balancing data in datasets to overcome this problem. In this work, in addition to random over-sampling, we also used a synthetic data generation method, called Conditional Generative Adversarial Network (CTGAN), to balance data and study their effect on the performance of various widely used ML classifiers. To the best of our knowledge, no one else has used CTGAN to generate synthetic samples to balance intrusion detection datasets. Based on extensive experiments using widely used datasets NSL-KDD and UNSW-NB15, we found that training ML classifiers on datasets balanced with synthetic samples generated by CTGAN increased their prediction accuracy by up to 8% and improved their MCC score by up to 13%, compared to training the same ML classifiers over imbalanced datasets. We also show that this approach consistently performs better than some of the recently proposed state-of-the-art IDSes on both datasets. Our experiments also demonstrate that the accuracy of some ML classifiers trained over datasets balanced with random over-sampling decline compared to the same ML classifiers trained over original imbalanced dataset.

Progress of Machine Learning in the Field of Intrusion Detection Systems

With the growth in the use of the Internet and local area networks, malicious attacks and intrusions into computer systems are increasing. Implementing intrusion detection systems have become extremely important to help maintain good network security. Support vector machines (SVMs), a classic pattern recognition tool, have been widely used in intrusion detection. They can handle very large data with high efficiency, are easy to use, and exhibit good prediction behavior. This paper presents a new SVM model enriched with a Gaussian kernel function based on the features of the training data for intrusion detection. The new model is tested with the CICIDS2017 dataset. The test proves better results in terms of detection efficiency and false alarm rate, which can give better coverage and make detection more efficient.

Feature Selection and Ensemble-Based Intrusion Detection System: An Efficient and Comprehensive Approach

The emergence of ground-breaking technologies such as artificial intelligence, cloud computing, big data powered by the Internet, and its highly valued real-world applications consisting of symmetric and asymmetric data distributions, has significantly changed our lives in many positive aspects. However, it equally comes with the current catastrophic daily escalating cyberattacks. Thus, raising the need for researchers to harness the innovative strengths of machine learning to design and implement intrusion detection systems (IDSs) to help mitigate these unfortunate cyber threats. Nevertheless, trustworthy and effective IDSs is a challenge due to low accuracy engendered by vast, irrelevant, and redundant features; inept detection of all types of novel attacks by individual machine learning classifiers; costly and faulty use of labeled training datasets cum significant false alarm rates (FAR) and the excessive model building and testing time. Therefore, this paper proposed a promising hybrid feature selection (HFS) with an ensemble classifier, which efficiently selects relevant features and provides consistent attack classification. Initially, we harness the various strengths of CfsSubsetEval, genetic search, and a rule-based engine to effectively select subsets of features with high correlation, which considerably reduced the model complexity and enhanced the generalization of learning algorithms, both of which are symmetry learning attributes. Moreover, using a voting method and average of probabilities, we present an ensemble classifier that used K-means, One-Class SVM, DBSCAN, and Expectation-Maximization, abbreviated (KODE) as an enhanced classifier that consistently classifies the asymmetric probability distributions between malicious and normal instances. HFS-KODE achieves remarkable results using 10-fold cross-validation, CIC-IDS2017, NSL-KDD, and UNSW-NB15 datasets and various metrics. For example, it outclassed all the selected individual classification methods, cutting-edge feature selection, and some current IDSs techniques with an excellent performance accuracy of 99.99%, 99.73%, and 99.997%, and a detection rate of 99.75%, 96.64%, and 99.93% for CIC-IDS2017, NSL-KDD, and UNSW-NB15, respectively based on only 11, 8, 13 selected relevant features from the above datasets. Finally, considering the drastically reduced FAR and time, coupled with no need for labeled datasets, it is self-evident that HFS-KODE proves to have a remarkable performance compared to many current approaches.

Intrusion Detection System Using Ensemble of Rule Learners and First Search Algorithm as Feature Selectors

Recently, the use of Internet is increased for digital communication to share a lot of sensitive information between computers and mobile devices. For secure communication, data or information must be protected from adversaries. There are many methods of safeties like encryption, firewalls and access control. Intrusion detection system is mainly used to detect internal attacks in organization. Machine leaning techniques are mostly used to implement intrusion detection system. Ensemble method of machine learning gives high accuracy in which moderately accurate classifiers are combined. Ensemble classifier also provides less false positive rates. In this paper, a novel ensemble classifier using rule combination method has proposed for intrusion detection system. Ensemble classifier is designed using three rule learners as base classifiers. The benefits and feasibility of the proposed ensemble classifier have demonstrated by means of KDD’98 datasets. The main novelty of the proposed approach is based on three rule learner combination using rule of combination method of ensemble and feature selector. These three base classifiers are separately trained and combined using average probabilities rule combination. Base classifier’s accuracies have compared with the proposed ensemble classifier. Best First search algorithm has used to select relevant features from training dataset. This algorithm also helped to reduce dimension of training and testing dataset which benefits in reduction of training time. Several comparative experiments are conducted for evaluating performances of classifiers in term of accuracy and false positive rates. Experimental results show that the proposed ensemble classifier provide significant improvement of accuracy compared to individual classifiers with less positive rates.

A Review of Support Vector Machine-based Intrusion Detection System for Wireless Sensor Network with Different Kernel Functions

Wireless sensor network (WSN) is among the popular communication technology which capable of self-configured and infrastructure-less wireless networks to monitor physical or environmental conditions. WSN also is the most standard services employed in commercial and industrial applications, because of its technical development in a processor, communication, and low-power usage of embedded computing devices. However, WSN is vulnerable due to the dynamic nature of wireless network. One of the best solutions to mitigate the risk is implementing Intrusion Detection System (IDS) to the network. Numerous researches were done to improve the efficiency of WSN-IDS because attacks in networks has been evolved due to the rapid growth of technology. Support Vector Machine (SVM) is one of the best algorithms for the enhancement of WSN-IDS. Nevertheless, the efficiency of classification in SVM is based on the kernel function used. Since dynamic environment of WSN consist of nonlinear data, linear classification of SVM has limitations in maximizing its margin during the classification. It is important to have the best kernel in classifying nonlinear data as the main goal of SVM to maximize the margin in the feature space during classification. In this research, kernel function of SVM such as Linear, RBF, Polynomial and Sigmoid were used separately in data classification. In addition, a modified version of KDD’99, NSL-KDD was used for the experiment of this research. Performance evaluation was made based on the experimental result obtained. Finally, this research found out that RBF kernel provides the best classification result with 91% accuracy.

Unknown network attack detection based on open‐set recognition and active learning in drone network

AbstractWith the technical support of 5G, the drone network plays a critical role in the autonomous and digital era. However, due to wireless and autonomy characteristics, the drone network is prone to diverse malicious attacks, so it's vital to deploy network intrusion detection system to detect network attacks. For a real open drone network environment, unknown attacks will occur constantly, but the existing intrusion detection methods are usually designed for a static and closed‐set scenario and will fail to recognize the unknown attacks correctly, threatening the security of drone network. Therefore, we design an intrusion detection system to detect unknown network attacks in the drone network. Based on open‐set recognition, we propose the Open‐CNN model to implement intrusion detection and detect unknown attacks. Further to detect unknown attacks, we also propose an active learning (AL) approach for unknown attacks based on the least confidence query strategy, allowing the intrusion detection model to learn efficiently from the unknown attack instances detected by Open‐CNN at small labeling budgets. Extensive experiments demonstrate the effectiveness of Open‐CNN in detecting unknown attacks, with the accuracy improvement of 9% to 30% over the compared methods, and the proposed AL approach achieves good performance when retraining with only 1% of labeled unknown attack samples.

Fine Tuned Deep Neural Networks for Intrusion Detection System

Intrusion detection system is used to gather and analyze data from networks for possible threats identification. It is used to record all significant events within network and takes corrective action when threats are detected. Some existing intrusion detection systems have experienced false positive or negative alarms. Recently, deep neural networks are being widely used to implement intrusion detection system to increase accuracy and reduce false alarms. Deep Neural networks are encouraged by the architecture depth of the human brain. These can possibly remove better portrayals from the information to make much better models. Tuning of hyper parameter of complex and computationally expensive deep networks is essential to advance classification accuracy by reducing training time. This hyper parameter tuning is also known as automated machine learning. In this paper, a deep neural network has been used for intrusion detection system. Different architecture of Multilayer perceptron has verified to learn best performance on intrusion detection system. Different hyper parameters of multilayer perceptron have tuned using different optimization techniques. Small to complex architecture of Perceptrons have used to carry out experiments. It was observed that smaller or simpler Neural Network is able to capture the function representation more closely than the more complex one. More complex deep networks with higher capacities are more prone to over fit. Hyper parameters tuning techniques such as dropout and regularization have helped to reduce complexities of model. It is also found that hyper parameter optimization techniques such as Bayesian and Hyperband optimization reduce considerable time and effort. These optimization techniques offer accuracies of 83% and 82% respectively on test dataset.

Ensemble of Rule Learner and Sequential Minimum Optimization Algorithm for Intrusion Detection System

An intrusion detection system is a process which automates analyzing activities in network or a computer system. It is used to detect nasty code, hateful activities, intruders and uninvited communications over the Internet. The general intrusion detection system is struggling with some problems like false positive rate, false negative rate, low classification accuracy and slow speed. Now-a-days, this has turned an attention of many researchers to handle these issues. Recently, ensemble of different base classifier is widely used to implement intrusion detection system. In ensemble method of machine learning, the proper selection of base classifier is a challenging task. In this paper, machine learning ensemble have designed and implemented for the intrusion detection system. The ensemble of Partial Decision Tree and Sequential Minimum optimization algorithm to train support vector machine have used for intrusion detection system. Partial Decision Tree rule learner is simplicity and it generates rules fast. Sequential Minimum optimization algorithm is easy to use and is better scaling with training set size with less computational time. Due to these advantages of both classifiers, they jointly used with different methods of ensemble. We make use of all types of methods of ensemble. The performances of base classifiers have evaluated in term of false positive, accuracy and true positive. Performance results display that proposed majority voting method of ensemble using Partial Decision Tree rule learner and Sequential Minimum optimization algorithm based Support Vector Machine offers highest classification among different ensemble classifiers on training dataset. This method of ensemble exhibits highest true positive and lowest false positive rates. It is also observed that stacking of both PART and SMO exhibits lowest and same classification accuracy on test dataset

Anomaly Intrusion Detection System in Real Time Environment using Ensemble Learning Model

System security is of essential part now days for huge organizations. The Intrusion Detection System (IDS) are getting to be irreplaceable for successful assurance against intrusions that are continually changing in size and intricacy. With information honesty, privacy and accessibility, they must be solid, simple to oversee and with low upkeep cost. Different adjustments are being connected to IDS consistently to recognize new intrusions and handle them. This paper proposes model based on combination of ensemble classification for network traffic anomaly detection. Intrusion detection system is try to perform in real time, but they cannot improved due to the network connections. This research paper is trying to implement intrusion detection system (IDS) using ensemble method for misuse as well anomaly detection for HIDS and NIDS based also. This system used various individual classification methods and its ensemble model on KDD99 and NSL-KDD data set to check the performance of model. It also check the performance on creating real time network traffic using own attack creator and send this to the remote machine which has our proposed IDS system. This system used training rule set as a background knowledge which are generated by genetic algorithm. Ensemble approach contains three algorithms as Naive Bayes, Artificial Neural Network and J48. Ensemble classifiers apply on network packets mapping with GA rule set and generate the result. Finally our proposed model produces highest detection rate and lower false negative ratio compare to others. Also find the accuracy of each attack types.