Integrated Intrusion Detection System Research Articles

Intrusion Detection System

Our project introduces an Integrated Intrusion Detection System (IDS) designed to bolster network and system security through a multi-faceted approach. This comprehensive IDS seamlessly combined Machine Learning, Anomaly Detection, File Scanning, and DDoS Prevention mechanisms to offer robust defense against diverse cyber threats. At the heart of the system lies the Machine Learning component, which continuously adapts to the evolving threat landscape. By analyzing network traffic and system behavior, it identifies both known and emerging threats in real-time, reducing reliance on traditional signature-based detection methods and allowing organizations to proactively stay ahead of cybercriminals. Anomaly Detection constantly monitors network and system activity, comparing it against established baselines. Any deviations from these baselines trigger alerts, facilitating swift responses to unusual activities that may indicate security breaches. File Scanning is another vital component ensuring data integrity and preventing malware infiltration or data exfiltration. It conducts thorough file analysis, checking for suspicious code, behavior, or unauthorized access, and offers continuous monitoring to detect anomalies in real-time. Additionally, our IDS includes Distributed Denial of Service (DDoS) Prevention mechanisms. By detecting and mitigating DDoS attacks, the system ensures the continuous availability of network resources and services even under intense traffic loads. This integrated approach to intrusion detection and prevention leverages Machine Learning, Honeypots, Anomaly Detection, File Scanning, and DDoS Prevention, empowering organizations to safeguard critical assets, maintain data integrity, and ensure network security in today's dynamic and perilous digital landscape. Our IDS solution serves as a valuable addition to the cybersecurity toolkit for organizations seeking comprehensive security against a wide range of threats.

A novel multi-module integrated intrusion detection system for high-dimensional imbalanced data.

The high dimension, complexity, and imbalance of network data are hot issues in the field of intrusion detection. Nowadays, intrusion detection systems face some challenges in improving the accuracy of minority classes detection, detecting unknown attacks, and reducing false alarm rates. To address the above problems, we propose a novel multi-module integrated intrusion detection system, namely GMM-WGAN-IDS. The system consists of three parts, such as feature extraction, imbalance processing, and classification. Firstly, the stacked autoencoder-based feature extraction module (SAE module) is proposed to obtain a deeper representation of the data. Secondly, on the basis of combining the clustering algorithm based on gaussian mixture model and the wasserstein generative adversarial network based on gaussian mixture model, the imbalance processing module (GMM-WGAN) is proposed. Thirdly, the classification module (CNN-LSTM) is designed based on convolutional neural network (CNN) and long short-term memory (LSTM). We evaluate the performance of GMM-WGAN-IDS on the NSL-KDD and UNSW-NB15 datasets, comparing it with other intrusion detection methods. Finally, the experimental results show that our proposed GMM-WGAN-IDS outperforms the state-of-the-art methods and achieves better performance.

Towards Effective Detection of Recent DDoS Attacks: A Deep Learning Approach

Distributed Denial of Service (DDoS) is a predominant threat to the availability of online services due to their size and frequency. However, developing an effective security mechanism to protect a network from this threat is a big challenge because DDoS uses various attack approaches coupled with several possible combinations. Furthermore, most of the existing deep learning- (DL-) based models pose a high processing overhead or may not perform well to detect the recently reported DDoS attacks as these models use outdated datasets for training and evaluation. To address the issues mentioned earlier, we propose CyDDoS, an integrated intrusion detection system (IDS) framework, which combines an ensemble of feature engineering algorithms with the deep neural network. The ensemble feature selection is based on five machine learning classifiers used to identify and extract the most relevant features used by the predictive model. This approach improves the model performance by processing only a subset of relevant features while reducing the computation requirement. We evaluate the model performance based on CICDDoS2019, a modern and realistic dataset consisting of normal and DDoS attack traffic. The evaluation considers different validation metrics such as accuracy, precision, F1-Score, and recall to argue the effectiveness of the proposed framework against state-of-the-art IDSs.

Reliability Integrated Intrusion Detection System for Isolating Black Hole Attack in MANET

Mobile ad hoc network (MANET) is a temporary network which can be utilized for emergency applications. It is easy to deploy the attackers in the network. The network performance may get degraded due to the presence of attackers. Black hole attack is the major attack which will totally violate the network rules and degrade the routing process. In this research, the Reliability Integrated Intrusion Detection System (RIIDS) is used for isolating the black hole attacks. It contains three phases. In first phase, the node forwarding ration is estimated to provide node reliability. In second phase, route reliability metric is evaluated to obtain the effective routes which can withstand the attackers. In third phase, objective function with effective routing strategy is adopted to detect attackers and isolate them by discovering alternate routes. The simulation results are analyzed using AODV protocol in terms of various performance metrics i.e. attacker detection ratio, queuing delay, packet delivery ratio and confidentiality.

An integrated intrusion detection system using correlation‐based attribute selection and artificial neural network

AbstractSerious concerns regarding vulnerability and security have been raised as a result of the constant growth of computer networks. Intrusion detection systems (IDS) have been adopted by network administrators to provide essential network security. Commercial IDS in the market do not have the capability to identify novel attacks but generate false alarms for legitimate user activities. Neural networks can be applied for the solution of these issues and for providing improved accuracy. Correlation‐based attribute selection ranks the features according to the highest correlation between the attributes and class label. In this article, the authors propose a correlation‐based feature selection integrated with neural network for identifying anomalies. Experimental analysis performed on NSL‐KDD and UNSW‐NB datasets, which are benchmark datasets of intrusion detection with current attacks. The results show that the proposed model is superior in terms of accuracy, sensitivity, and specificity in comparison with some of the state‐of‐the‐art techniques. With the emergence of the Internet of Things Technology, such IDS can be deployed for securing the IoT servers in future. Wireless payment systems can be secured by building and deploying IDS. A secure integrated network management can be achieved which is error‐free and thereby improving performance.

An Integrated Intrusion Detection System by Combining SVM with AdaBoost

In the Internet, computers and network equipments are threatened by malicious intrusion, which seriously affects the security of the network. Intrusion behavior has the characteristics of fast upgrade, strong concealment and randomness, so that traditional methods of intrusion detection system (IDS) are difficult to prevent the attacks effectively. In this paper, an integrated network intrusion detection algorithm by combining support vector machine (SVM) with AdaBoost was presented. The SVM is used to construct base classifiers, and the AdaBoost is used for training these learning modules and generating the final intrusion detection model by iterating to update the weight of samples and detection model, until the number of iterations or the accuracy of detection model achieves target setting. The effectiveness of the proposed IDS is evaluated using DARPA99 datasets. Accuracy, a criterion, is used to evaluate the detection performance of the proposed IDS. Experimental results show that it achieves better performance when compared with two state-of-the-art IDS.

Based on the Function Analysis of Integrated Intrusion Detection System for Network Security

With the development of computer network, the network security is increasingly important. Recently intrusion detection becomes a novel network security strategy in order to achieve the purpose for network system security dynamic detection and surveillance. This paper introduces the structure and detection of the intrusion detection system and proposes an integrated intrusion detection system based on multiple detection methods and techniques. This paper also introduces the knowledge base of the intrusion behavior rules and achieves the optimal goals by data analysis and matching to ensure the satisfactory performance of network system security.

An Integrated Intrusion Detection System for Cluster-based Wireless Sensor Networks

A Wireless Sensor Network (WSN) consists of many low-cost, small devices. Usually, as they are deployed to an open and unprotected region, they are vulnerable to various types of attacks. In this research, a mechanism of Intrusion Detection System (IDS) created in a Cluster-based Wireless Sensor Network (CWSN) is proposed. The proposed IDS is an Integrated Intrusion Detection System (IIDS). It can provide the system to resist intrusions, and process in real-time by analyzing the attacks. The IIDS includes three individual IDSs: Intelligent Hybrid Intrusion Detection System (IHIDS), Hybrid Intrusion Detection System (HIDS) and misuse Intrusion Detection System. These are designed for the sink, cluster head and sensor node according to different capabilities and the probabilities of attacks these suffer from. The proposed IIDS consists of an anomaly and a misuse detection module. The goal is to raise the detection rate and lower the false positive rate through misuse detection and anomaly detection. Finally, a decision-making module is used to integrate the detected results and report the types of attacks.