Intelligent Intrusion Detection System Research Articles

Intelligent Intrusion Detection System in Internet of Vehicles using Random Forest, Logistic Regression and Decision Tree Algorithm

This study introduces an Intelligent Intrusion Detection System (IDS) for Internet of Vehicles (IoV) security. Using Random Forest, Logistic Regression, and Decision Tree algorithms, it detects and prevents intrusions in real-time. By combining these algorithms, the IDS aims to improve accuracy and adapt to evolving threats. Evaluation metrics include accuracy (93.6%), precision (94.4%), recall (95.3%), and F1 score (96.7%). Analysis of false positives/negatives informs refinement for real-world use. The IDS enhances cybersecurity for connected vehicles. This IDS provides a robust defense against cyber threats in the IoV ecosystem, ensuring user safety and privacy. Its multi-algorithmic approach and high-performance metrics make it a reliable solution for safeguarding connected vehicles.

Novel intrusion detection system based on a downsized kernel method for cybersecurity in smart agriculture

Smart farming aims to ameliorate the quantity and quality of farms products using modern information and communication technologies. Agriculture has always used cutting-edge technology to improve profitability, efficiency, and safety as well as creating the opportunity for more environmentally friendly operations. In smart agriculture network communication between smart devices is necessary to managing the agriculture process. Consequently, the possibility of information being exposed to hacking is very likely, which makes the information security system extremely important and cannot be neglected. Even though many solutions have been developed to overcome cyberattacks in smart networks, some limitations are observed, such as solving multi-class problems, high feature dimensions, and overhead computation. To address the aforementioned issues, an intelligent Intrusion Detection System (IDS) for identifying cyberattacks in the Internet of Agriculture Things (IoAT) is proposed. The developed model uses a proposed reduced kernel method, the Downsized Kernel Partial Least Square (DKPLS) to extract and reduce data feature dimension to improve detection performance. The DRKPLS approach is used to reduce the dimension of a kernel matrix generated using the Kernel Partial Least Square (KPLS) technique by selecting the most important features. In classification phase, the Kernel Extreme Learning Machine (KELM) is used to classify data for binary and multi-class classification. The proposed IDS is evaluated on a new Industrial IoT Dataset, X-IIoTID. The developed approach achieved higher performances for binary classification and for multi–class classification compared to others machine learning and deep learning approaches. The proposed approach achieved an accuracy rate of 99.92% for binary classification and 99.99% for multi–class classification. Furthermore, the higher percentage in multi-class classification is obtained for the two types of attacks Ransom Denial of Service (RDoS) and Command_Control respectively.

Mitigating Missing Rate and Early Cyberattack Discrimination Using Optimal Statistical Approach with Machine Learning Techniques in a Smart Grid

In the Industry 4.0 era of smart grids, the real-world problem of blackouts and cascading failures due to cyberattacks is a significant concern and highly challenging because the existing Intrusion Detection System (IDS) falls behind in handling missing rates, response times, and detection accuracy. Addressing this problem with an early attack detection mechanism with a reduced missing rate and decreased response time is critical. The development of an Intelligent IDS is vital to the mission-critical infrastructure of a smart grid to prevent physical sabotage and processing downtime. This paper aims to develop a robust Anomaly-based IDS using a statistical approach with a machine learning classifier to discriminate cyberattacks from natural faults and man-made events to avoid blackouts and cascading failures. The novel mechanism of a statistical approach with a machine learning (SAML) classifier based on Neighborhood Component Analysis, ExtraTrees, and AdaBoost for feature extraction, bagging, and boosting, respectively, is proposed with optimal hyperparameter tuning for the early discrimination of cyberattacks from natural faults and man-made events. The proposed model is tested using the publicly available Industrial Control Systems Cyber Attack Power System (Triple Class) dataset with a three-bus/two-line transmission system from Mississippi State University and Oak Ridge National Laboratory. Furthermore, the proposed model is evaluated for scalability and generalization using the publicly accessible IEEE 14-bus and 57-bus system datasets of False Data Injection (FDI) attacks. The test results achieved higher detection accuracy, lower missing rates, decreased false alarm rates, and reduced response time compared to the existing approaches.

Advanced machine learning approach for DoS attack resilience in internet of vehicles security

Recent years have witnessed security as a great concern in vehicular networks (VANET). Particularly, Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks can jeopardize the network by broadcasting a storm of packets. Correspondingly, the network resources are jammed with malicious traffic. In this connection, the existing research presented various techniques to cope with DoS and DDoS attacks. Different from those traditional approaches, this study proposes an Intelligent Intrusion Detection System (IDS) by leveraging Machine Learning (ML). The proposed IDS utilizes a publicly available dataset on the application layer for mitigating DDoS attacks. The designed ML-based IDS relies on combining both the Random Projection (RP) and Randomized Matrix Factorization (RMF) methods to achieve the best results for enhancing the detection capabilities of the IDS. This amalgamation enhances the system's detection capabilities by extracting and analyzing meaningful features from network traffic data. Experimental validation of our approach involves a comprehensive evaluation of various ML models, including Extra Tree Classifier (ETC), Logistic Regression (LR), and Random Forest (RF). Remarkably, the combined accuracy of these models yields an average system accuracy of 0.98, surpassing existing methods. Unlike conventional approaches, our proposed IDS excels in efficiency and exhibits notable performance in detecting DoS and DDoS attacks in VANET. This proficiency ensures the integrity and safety of vehicle communications. Thus, our research substantially contributes to the vehicular network security field. The presented findings establish a foundation for future advancements in securing connected vehicles.

Machine Learning and Deep Learning Techniques for Internet of Things Network Anomaly Detection-Current Research Trends.

With its exponential growth, the Internet of Things (IoT) has produced unprecedented levels of connectivity and data. Anomaly detection is a security feature that identifies instances in which system behavior deviates from the expected norm, facilitating the prompt identification and resolution of anomalies. When AI and the IoT are combined, anomaly detection becomes more effective, enhancing the reliability, efficacy, and integrity of IoT systems. AI-based anomaly detection systems are capable of identifying a wide range of threats in IoT environments, including brute force, buffer overflow, injection, replay attacks, DDoS assault, SQL injection, and back-door exploits. Intelligent Intrusion Detection Systems (IDSs) are imperative in IoT devices, which help detect anomalies or intrusions in a network, as the IoT is increasingly employed in several industries but possesses a large attack surface which presents more entry points for attackers. This study reviews the literature on anomaly detection in IoT infrastructure using machine learning and deep learning. This paper discusses the challenges in detecting intrusions and anomalies in IoT systems, highlighting the increasing number of attacks. It reviews recent work on machine learning and deep-learning anomaly detection schemes for IoT networks, summarizing the available literature. From this survey, it is concluded that further development of current systems is needed by using varied datasets, real-time testing, and making the systems scalable.

Cloud Computing Security via Intelligent Intrusion Detection Mechanisms

New challenges of data breaches, unauthorized access, and insider threats have emerged with the rise of Cloud Computing. Attackers find cloud systems attractive due to their common infrastructure. To combat these security threats, strong security procedures must be integrated. An intrusion detection system (IDS) is a vital instrument for safeguarding networks and cloud environments. It tracks system activity and network traffic. This study compares the efficacy of various machine learning models for intrusion detection. The Random-Forest-Classifier model performed the best with a test accuracy of 99.88% in recognizing known and unknown threats. Furthermore, various benefits have been identified when contrasting this intelligent intrusion detection system with conventional rule-based and signature-based methods. The use of machine learning in intrusion detection systems offers enhanced security measures and improved threat detection capabilities, highlighting the importance of leveraging advanced technologies to secure cloud environments. This research illuminates the necessity to employ cutting-edge techniques to protect cloud computing systems from malicious actions in the era of cybersecurity. More than that, it stresses the necessity to invest in enrichment mechanisms in machine learning-based intrusion detection systems to stay abreast with the evolving security problems.

Security strategy for autonomous vehicle cyber-physical systems using transfer learning

Cyber-physical systems (CPSs) are emergent systems that enable effective real-time communication and collaboration (C&C) of physical components such as control systems, sensors, actuators, and the surrounding environment through a cyber communication infrastructure. As such, autonomous vehicles (AVs) are one of the fields that have significantly adopted the CPS approach to improving people's lives in smart cities by reducing energy consumption and air pollution. Therefore, autonomous vehicle-cyber physical systems (AV-CPSs) have attracted enormous investments from major corporations and are projected to be widely used. However, AV-CPS is vulnerable to cyber and physical threat vectors due to the deep integration of information technology (IT), including cloud computing, with the communication process. Cloud computing is critical in providing the scalable infrastructure required for real-time data processing, storage, and analysis in AV-CPS, allowing these systems to work seamlessly in smart cities. CPS components such as sensors and control systems through network infrastructure are particularly vulnerable to cyber-attacks targeted by attackers using the communication system. This paper proposes an intelligent intrusion detection system (IIDS) for AV-CPS using transfer learning to identify cyberattacks launched against connected physical components of AVs through a network infrastructure. First, AV-CPS was developed by implementing the controller area network (CAN) and integrating it into the AV simulation model. Second, the dataset was generated from the AV-CPS. The collected dataset was then preprocessed to be trained and tested via pre-trained CNNs. Third, eight pre-trained networks were implemented, namely, InceptionV3, ResNet-50, ShuffleNet, MobileNetV2, GoogLeNet, ResNet-18, SqueezeNet, and AlexNet. The performance of the implemented models was evaluated. According to the experimental evaluation results, GoogLeNet outperformed all other pre-rained networks, scoring an F1- score of 99.47%.

Clustering based Intrusion Detection System for effective Detection of known and Zero-day Attacks

Developing effective security measures is the most challenging task now a days and hence calls for the development of intelligent intrusion detection systems. Most of the existing intrusion detection systems perform best at detecting known attacks but fail to detect zero-day attacks due to the lack of labeled examples. Authors in this paper, comes with a clustering-based IDS framework that can effectively detect both known and zero-day attacks by following unsupervised machine learning techniques. This research uses NSL-KDD dataset for the motive of experimentation and the experimental results exhibit best performance with an accuracy of 78%.

IIDS: Intelligent Intrusion Detection System for Sustainable Development in Autonomous Vehicles

Connected and Autonomous Vehicles (CAVs) enable various capabilities and functionalities like automated driving assistance, navigation and path planning, cruise control, independent decision making, and low-carbon transportation in the real-time environment. However, the increased CAVs usage renders the potential vulnerabilities in the Internet of Vehicles (IoV) environment, making it susceptible to cyberattacks. An Intrusion Detection System (IDS) is a technique to report network assaults by potential Autonomous Vehicles (AVs) without encryption and authorization procedures for internal and external vehicular communications. This paper proposes an Intelligent IDS (IIDS) to enhance intrusion detection and categorize malicious AVs using a modified Convolutional Neural Network (CNN) with hyperparameter optimization approaches for IoV systems. The proposed IIDS framework works in a 5G Vehicle-to-Everything (V2X) environment to effectively broadcast messages about malicious AVs. Thus IIDS aids in preventing collisions and chaos, enhancing safety monitoring in the traffic. The experimental results depict that the proposed IIDS achieves 98% accuracy in detecting attacks.

A Softwarized Intrusion Detection System for IoT-Enabled Smart Healthcare System

The Internet of Things-enabled Smart Healthcare System (IoT-SHS) is a networked infrastructure of intelligent wearables, software applications, health systems, and services that continuously monitors and transmits patient-sensitive data using an open wireless channel. The conventional security mechanisms are unsuitable for detecting attacks in the dynamic IoT-SHS context due to resource limitations and heterogeneity in low-cost healthcare devices. Deep Learning (DL) solutions for Intrusion Detection System (IDS) and softwarization of the network has the potential to achieve secure network services in the IoT-SHS environment. Motivated by the aforementioned discussion, we propose an intelligent softwarized IDS for protecting the critical infrastructure of the IoT-SHS ecosystem. Specifically, the DL-based IDS is designed using a hybrid cuda Long Short-Term Memory Deep Neural Network (cuLSTM-DNN) algorithm to assist network administrators in efficient decision-making for the generated intrusions. To further bolster the system’s resilience, we suggest a deployment architecture for the proposed CUDA-powered IDS using OpenStack Tacker in a real SDN environment, ensuring that virtual machines can directly utilize the host’s NVIDIA GPU, thereby streamlining and enhancing the network’s operational efficiency. The experimental results using the CICDDoS2019 dataset confirm the effectiveness of the proposed framework over some baseline and recent state-of-the-art techniques.

Personalized federated learning-based intrusion detection system: Poisoning attack and defense

To deal with the increasing number of cyber-attacks, intrusion detection system (IDS) plays an important role in monitoring and ensuring the security of the computer network. With the power of machine learning and deep learning, intelligent IDS systems have gained increasing attention due to their efficiency and high classification accuracy. However, the premise of machine learning/deep learning is that the data must be in one central entity (e.g., server) to train the model. This causes additional concerns, such as data transmission costs and privacy leakage. Federated learning complements this shortcoming with a privacy-preserving decentralized learning technique. In federated learning, the data are not shared with the server, local model training is performed where the data reside and only the model parameters are exchanged with the server. This work investigates the federated learning-based IDS approach in the context of IoT data to study the main challenges imposed by federated learning. Two main issues, such as data heterogeneity and poisoning attacks launched by malicious clients, are the main focus of this study. As real-world IoT datasets are heterogeneous, we propose a personalized federated learning-based IDS approach to handle imbalanced data distributions. Moreover, a curious yet malicious client can poison the local data or model to corrupt the global intrusion detection model due to the distributed nature of federated learning, where the central server has no control over the client’s local training process. This study demonstrates that the existence of a malicious client can degrade the performance of the federated learning-based IDS model. Accordingly, we propose a robust approach called pFL-IDS to combat poisoning attacks against the federated learning-enabled IDS on heterogeneous IoT data. Our approach introduces mini-batch logit adjustment loss to local model training to obtain a personalized model tailored to each local data distribution. Moreover, we design a detection mechanism at the server to identify malicious agents by considering the cosine similarity of local models from the non-poisoned client’s centroid. The non-poisoned centroid is determined from the similarity between the pre-computed global model and the local models. If the poisoning attack is successful, poisoned clients will be closer to the pre-computed global model; any models further from the pre-computed model are taken as the non-poisoned clients. With this two-phase client similarity alignment, we identify poisoned clients and restrict their aggregation on the global intrusion detection model. In comparison with the baseline methods, we demonstrate that our pFL-IDS can detect poisoning attacks without compromising performance.

Attentive transformer deep learning algorithm for intrusion detection on IoT systems using automatic Xplainable feature selection.

Recent years have witnessed an in-depth proliferation of the Internet of Things (IoT) and Industrial Internet of Things (IIoT) systems linked to Industry 4.0 technology. The increasing rate of IoT device usage is associated with rising security risks resulting from malicious network flows during data exchange between the connected devices. Various security threats have shown high adverse effects on the availability, functionality, and usability of the devices among which denial of service (DoS) and distributed denial of service (DDoS), which attempt to exhaust the capacity of the IoT network (gateway), thereby causing failure in the functionality of the system have been more pronounced. Various machine learning and deep learning algorithms have been used to propose intelligent intrusion detection systems (IDS) to mitigate the challenging effects of these network threats. One concern is that although deep learning algorithms have shown good accuracy results on tabular data, not all deep learning algorithms can perform well on tabular datasets, which happen to be the most commonly available format of datasets for machine learning tasks. Again, there is also the challenge of model explainability and feature selection, which affect model performance. In this regard, we propose a model for IDS that uses attentive mechanisms to automatically select salient features from a dataset to train the IDS model and provide explainable results, the TabNet-IDS. We implement the proposed model using the TabNet algorithm based on PyTorch which is a deep-learning framework. The results obtained show that the TabNet architecture can be used on tabular datasets for IoT security to achieve good results comparable to those of neural networks, reaching an accuracy of 97% on CIC-IDS2017, 95% on CSE-CICIDS2018 and 98% on CIC-DDoS2019 datasets.

An Intelligent Prairie Dog Optimization (IPDO) and Deep Auto-Neural Network (DANN) based IDS for WSN Security

Wireless sensor networks (WSNs) are targets of intrusion, which seeks to make these networks less capable of performing their duties or even completely eradicate them. The Intrusion Detection System (IDS) is highly important for WSN, since it aids in the identification and detection of harmful attacks that impair the network's regular functionality. In order to strengthen the security of WSN, several machine learning and deep learning approaches are employed in the traditional works. However, its main drawbacks are computational burden, system complexity, poor network performance outcomes, and high false alarms. Therefore, the goal of this study is to develop an intelligent IDS framework for significantly enhancing WSN security through the use of deep learning model. Here, the min-max normalization and data discretization operations are carried out to produce the preprocessed dataset. Then, an Intelligent Prairie Dog Optimization (IPDO) algorithm is used to reduce the dimensionality of features by identifying the best optimal solution with a higher convergence rate. Moreover, a Deep Auto-Neural Network (DANN) based classification method is used to properly forecast the class of data with less false alarms and higher detection rate. For evaluation, a thorough analysis is conducted to evaluate the performance and detection results of the proposed IPDO-DANN model.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The industrial internet of things (IIoT) is an evolutionary extension of the traditional Internet of Things (IoT) into processes and machines for applications in the industrial sector. The IIoT systems generate a large amount of private and sensitive data i.e., stored and processed somewhere on the cloud-edge continuum. The IIoT devices, and the IIoT networks are subject to security mechanisms such as intelligent Intrusion Detection and Prevention Systems (IDS/IPS) systems, that can detect and respond unseen malicious network attacks. The adoption of centralized machine learning methods for IDS has become impractical due to the high computational cost and privacy concerns associated with storing large amounts of data on a single server along the cloud-edge continuum. The combination of federated learning and Blockchain has emerged as a promising advancement in addressing the challenge. Federated learning distributes learning to individual IIoT devices without compromising data privacy, while Blockchain enhances privacy and security. Many academic and industrial efforts outline IDS mechanisms using machine learning, deep learning, federated learning, and Blockchain technologies. The utilization of federated learning-based IDS has become increasingly popular and is now being applied to various tasks including IDS/IPS systems. However, existing intrusion detection systems (IDSs) survey are limited to the scope of classical machine learning and deep learning. To address this limitation, we analyze the IIoT literature that integrates Blockchain and federated learning to enhance IDSs and improve its threat detection capabilities. This survey explores the role of Blockchain and federated learning in addressing security and privacy issues, particularly those associated with IDS/IPS in IIoT networks. Insights on the possibilities of machine learning, federated learning, and Blockchain in supporting IDS to monitor IIoT network traffic for anomaly detection are discussed in detail through state of the art. Furthermore, we provide a set of recommendation based on our literature for the effective implementation of a Blockchain and federated learning-based network intrusion detection system. Finally, we summarize the study and highlight challenges as future research directions for Blockchain and Federated Learning-based technologies for cybersecurity and intrusion detection in IIoT.

Deep Reinforcement Learning for intrusion detection in Internet of Things: Best practices, lessons learnt, and open challenges

The Internet of Things (IoT) scenario places important challenges even for deep learning-based intrusion detection systems. IoTs are highly heterogeneous networks in which multiple types of nodes and connections between them proliferate at a fast pace. From a deep learning perspective, such complexity translates into dynamic feature spaces where the extraction of semantic patterns and correlations among features may require sophisticated inductive biases to be learnt by gradient-based techniques. The research community has recently suggested using Deep Reinforcement Learning (DRL) as a potent approach to effectively identify cyber-threat attempts in IoTs.DRL consists of a Markov Decision Process-based meta-model that permits solving high-dimensional combinatorial optimization problems where differentiable supervisory signals may be absent. For this reason, multiple intelligent intrusion detection systems have been proposed for the IoT environment where high-level requirements are been pursued alongside the detection accuracy. These goals are related to optimizing the computational overhead, reducing power consumption at the edge, and preserving the privacy of sensitive information, among others.This survey offers a clear bird’s eye view of the most recent design choices for DRL-based intrusion detection systems with a focus on the specific context of IoT. Our aim is not only to offer an exhaustive taxonomy of design alternatives made by DRL practitioners in the field of Intrusion detection, but also to discuss the advantages and the effective deployment of each setting concerning real IoT environments. We hope this work would guide the researchers interested in Intrusion Detection for IoTs to establish solid criteria for the most effective usage of Deep Reinforcement Learning in their future work.

Towards an Intelligent Intrusion Detection System to Detect Malicious Activities in Cloud Computing

Several sectors have embraced Cloud Computing (CC) due to its inherent characteristics, such as scalability and flexibility. However, despite these advantages, security concerns remain a significant challenge for cloud providers. CC introduces new vulnerabilities, including unauthorized access, data breaches, and insider threats. The shared infrastructure of cloud systems makes them attractive targets for attackers. The integration of robust security mechanisms becomes crucial to address these security challenges. One such mechanism is an Intrusion Detection System (IDS), which is fundamental in safeguarding networks and cloud environments. An IDS monitors network traffic and system activities. In recent years, researchers have explored the use of Machine Learning (ML) and Deep Learning (DL) approaches to enhance the performance of IDS. ML and DL algorithms have demonstrated their ability to analyze large volumes of data and make accurate predictions. By leveraging these techniques, IDSs can adapt to evolving threats, detect previous attacks, and reduce false positives. This article proposes a novel IDS model based on DL algorithms like the Radial Basis Function Neural Network (RBFNN) and Random Forest (RF). The RF classifier is used for feature selection, and the RBFNN algorithm is used to detect intrusion in CC environments. Moreover, the datasets Bot-IoT and NSL-KDD have been utilized to validate our suggested approach. To evaluate the impact of our approach on an imbalanced dataset, we relied on Matthew’s Correlation Coefficient (MCC) as a normalized measure. Our method achieves accuracy (ACC) higher than 92% using the minimum features, and we managed to increase the MCC from 28% to 93%. The contributions of this study are twofold. Firstly, it presents a novel IDS model that leverages DL algorithms, demonstrating an improved ACC higher than 92% using minimal features and a substantial increase in MCC from 28% to 93%. Secondly, it addresses the security challenges specific to CC environments, offering a promising solution to enhance security in cloud systems. By integrating the proposed IDS model into cloud environments, cloud providers can benefit from enhanced security measures, effectively mitigating unauthorized access and potential data breaches. The utilization of DL algorithms, RBFNN, and RF has shown remarkable potential in detecting intrusions and strengthening the overall security posture of CC.

Intelligent Intrusion Detection System using Enhanced Arithmetic Optimization Algorithm with Deep Learning Model

Intelligent Intrusion Detection System using Enhanced Arithmetic Optimization Algorithm with Deep Learning Model

Dependable intrusion detection system using deep convolutional neural network: A Novel framework and performance evaluation approach

Intrusion detection systems (IDS) play a critical role in safeguarding computer networks against unauthorized access and malicious activities. However, traditional IDS approaches face challenges in accurately detecting complex and evolving cyber threats. The proposed framework leverages the power of deep learning to automatically extract meaningful features from network traffic data, enabling more accurate and robust intrusion detection. The proposed deep convolutional neural network (DCNN) has been trained on large-scale datasets, incorporating both normal and malicious network traffic, to enable effective discrimination between normal and anomalous behavior. To evaluate the performance of the framework, a comprehensive performance evaluation approach is developed, considering key metrics such as detection accuracy, false positive rate, and computational efficiency. Additionally, GPU has been utilized for boosting the performance of the model, demonstrating the effectiveness and superiority of the deep CNN-based intrusion detection system over traditional methods. The novelty of this study lies in the development of a dependable intrusion detection system that harnesses the potential of DCNN for network traffic analysis. The proposed framework is evaluated with four publicly available IDS datasets, namely ISCX-IDS 2012, DDoS (Kaggle), CICIDS2017, and CICIDS2018. Our results demonstrate the effectiveness of the optimized DCNN model in improving IDS performance and accuracy. With detection accuracy levels ranging from 99.79% to 100%, our results underscore the model’s efficacy, offering a dependable and efficient approach for the detection of cyber threats. The outcomes of this study have significant implications for network security, providing valuable insights for practitioners and researchers working towards building robust and intelligent intrusion detection systems.

A New Data-Balancing Approach Based on Generative Adversarial Network for Network Intrusion Detection System

An intrusion detection system (IDS) plays a critical role in maintaining network security by continuously monitoring network traffic and host systems to detect any potential security breaches or suspicious activities. With the recent surge in cyberattacks, there is a growing need for automated and intelligent IDSs. Many of these systems are designed to learn the normal patterns of network traffic, enabling them to identify any deviations from the norm, which can be indicative of anomalous or malicious behavior. Machine learning methods have proven to be effective in detecting malicious payloads in network traffic. However, the increasing volume of data generated by IDSs poses significant security risks and emphasizes the need for stronger network security measures. The performance of traditional machine learning methods heavily relies on the dataset and its balanced distribution. Unfortunately, many IDS datasets suffer from imbalanced class distributions, which hampers the effectiveness of machine learning techniques and leads to missed detection and false alarms in conventional IDSs. To address this challenge, this paper proposes a novel model-based generative adversarial network (GAN) called TDCGAN, which aims to improve the detection rate of the minority class in imbalanced datasets while maintaining efficiency. The TDCGAN model comprises a generator and three discriminators, with an election layer incorporated at the end of the architecture. This allows for the selection of the optimal outcome from the discriminators’ outputs. The UGR’16 dataset is employed for evaluation and benchmarking purposes. Various machine learning algorithms are used for comparison to demonstrate the efficacy of the proposed TDCGAN model. Experimental results reveal that TDCGAN offers an effective solution for addressing imbalanced intrusion detection and outperforms other traditionally used oversampling techniques. By leveraging the power of GANs and incorporating an election layer, TDCGAN demonstrates superior performance in detecting security threats in imbalanced IDS datasets.

SD-IIDS: intelligent intrusion detection system for software-defined networks

SD-IIDS: intelligent intrusion detection system for software-defined networks