Intelligent Intrusion Detection System Research Articles

Intelligent intrusion detection system featuring a virtual fence, active intruder detection, classification, tracking, and action recognition

An intrusion detection system (IDS) is primarily used to protect nuclear power plants from external threats, such as sabotage and malicious attacks. However, earlier versions of IDSs are configured to detect an intrusion from visual inspection by an operator. This has the disadvantages of requiring standby human resources and relying on operator capabilities. In this paper, therefore, we propose an image-based intelligent intrusion detection system (IIDS) with a virtual fence, active intruder detection, classification, and tracking, and motion recognition to solve these limitations. An integrated acquisition device was manufactured combining optical and thermal cameras to compensate for the disadvantages of optical cameras, which have difficulty detecting an intrusion at night, under adverse weather conditions, and when the intruder is camouflaged. The virtual fence has a function to set the boundary between surveillance and external areas in a graphical user interface, and to define an early pre-alarm area if necessary. The background model is designed to detect moving objects, and detected objects are segmented into bounding boxes. We implemented a network model based on a convolutional neural network (CNN) to classify moving objects as either intruders or wild animals. If an intruder is detected in real time and is crossing the virtual fence, the alarm tile blinks with the associated color. Five types of intruder behavior patterns are recognized by optimizing a long-term recurrent convolutional network (LRCN) model. The proposed IIDS meets the physical protection requirements recommended in the nuclear regulatory guidelines, and can be used as an unmanned surveillance system. It is expected to perform more active and reliable intrusion detection in combination with existing sensors, such as microwaves, electric fields, and fence disturbance sensors in a nuclear power plant.

Research and application of intelligent intrusion detection system with accuracy analysis methodology

As perimeter intrusion detection is of great value to security defense, an innovative intelligent intrusion detection system is analyzed and applied. The system is systematically designed through network topology, consisting of Infrared Image Collection and Pre-processing Module, Data Transmission Module, Intelligent Analysis and Automatic Alarm Module. Infrared Imagery Pre-processing is achieved through innovatively application of FLIR Tau 2336 based on advanced wavelet algorithm, considerably minimizing noises and enhancing details. Besides, synergistic action of intelligent analysis and automatic alarm are achieved through intelligent comparison between extracted imagery and models of pedestrian and vehicle. Moreover, innovative deployment plan of thermal infrared cameras is applied to avoid blind zone of intrusion detection. Through mix deployment of clockwise and anti-clockwise cameras, full coverage of security perimeter is achieved through only 14 thermal cameras, which is of great economic advantage. Finally, accuracy analysis methodology is proposed and test results are obtained - Detection Rate for all test locations is 100%, and more than 90% of test locations are with high alarm accuracy (above 90%). Alarm Accuracy and Missed-Alarm Rates are dependent on the distance between test and cameras, and the best alarm distance is 175.72 m. The proposed intelligent intrusion detection system is applied and its results are acceptable, being of great efficiency and economic advantage.

Multi-level trust based intelligence intrusion detection system to detect the malicious nodes using elliptic curve cryptography in MANET

Mobile ad hoc networks (MANETs) are qualified by multi-hop wireless links and resource restrained nodes. Generally, mobile ad hoc networks (MANETs) are susceptible to various attacks like gray hole attack, black hole attack, selective packet dropping attack, Sybil attack, and flooding attack. Therefore, the wireless network should be protected using encryption, firewalls, detection schemes to identify the attackers and decreasing their impact on the network. So, it’s an essential task to design the intelligent intrusion detection system. This research work deals with designing the multilevel trust based intelligence intrusion detection system with cryptography schemes for detecting the attackers. In order to identify the attackers, we propose a novel trust management with elliptic curve cryptography (ECC) algorithm. At first, a trust manager is maintained, its functions is to classify the trust into three different sets of trust level based upon the elliptic curve cryptography and Schnorr’s signature in the MANET. Each trust level has identified a single attacker. Thus, the proposed method has detected three types of attackers such as black hole attack, flooding attack and selective packet dropping attack. Furthermore, it have provided countermeasure for these attackers in the MANET as well as improved performances. Hence, it obtains higher throughput, minimum delay, minimum packet loss and efficient end to end delivery in MANET. Thus, the proposed scheme is a secure and optimal solution to encounter attackers, which represents to be efficient and significant.

Information Security Coding Rule Based on Neural Network and Greedy Algorithm and Application in Network Alarm Detection

With the development of computer network, network information resources have brought great convenience to users. However, the security problems of computer network have become increasingly prominent, and the main threat is the invasion of the information system through the network. Network intrusion will bring great losses to society, especially to the government and military agencies. With the increase of network intrusion, the firewall can't resist the attack on the network. Intrusion detection system makes up the shortcomings of traditional Internet security technology, and it is a kind of active defense technology. Through security log, audit data and other information, intrusion detection system can detect the network attacks and take the corresponding measures. Intelligent intrusion detection system is a hot spot in the field of network security, commonly based on neural network, genetic algorithm, greedy algorithm, fuzzy technology, and so on. In this paper, we apply the neural network and the greedy algorithm into the network security detection system. We analyze the theories of neural network and greedy algorithm, and introduce the evaluation model of network security system. Experiments show that the information security coding rule based on neural network and greedy algorithm can help network monitoring system better detect the network attacks.

An Intelligent Intrusion Detection and Prevention System for Safeguard Mobile Adhoc Networks against Malicious Nodes

Objectives: Mobile Adhoc Networks (MANETs) due to their dynamic topology are more liable to have security problems. These Adhoc Networks are easily susceptible to various types of attacker nodes. Out of the numerous attacks black hole, flooding and selective packet drop attacks are more hazardous attacks which reduce the performance of network under various parameters. Due to this problem, there is a need to develop a new approach for mitigating these attacker nodes simultaneously to improve the performance of MANETs Methods: An Intelligent Intrusion Detection and Prevention System (IIDPS) is proposed for preventing the ad hoc network from these three types of attacks under the AODV protocol. The proposed mechanism works on the basis of trust management. This research work consists of a central network administrator for detecting malicious nodes in the MANETs. IIDPS includes a trust manager which categorizes the trust of the network into different categories. Different types of malicious nodes are identified by the behavior classifier based on a predefined threshold and risk factor conditions. Findings: The proposed IIDPS is responsible for preventing MANETs from the black hole, flooding, and selective packet drop attacker nodes. At the same time, the proposed prevention system improves the performance of the network in the terms of numerous parameters like throughput, overhead, delay, packet delivery ratio etc. Novelty/ Improvement: There is no technique exist for MANETs under AODV protocol for detecting black hole, flooding and selective packet drop malicious nodes. The proposed IIDPS solves this issue to handle of these multiple attacks at the same time.

Using discriminant analysis to detect intrusions in external communication for self-driving vehicles

Security systems are a necessity for the deployment of smart vehicles in our society. Security in vehicular ad hoc networks is crucial to the reliable exchange of information and control data. In this paper, we propose an intelligent Intrusion Detection System (IDS) to protect the external communication of self-driving and semi self-driving vehicles. This technology has the ability to detect Denial of Service (DoS) and black hole attacks on vehicular ad hoc networks (VANETs). The advantage of the proposed IDS over existing security systems is that it detects attacks before they causes significant damage. The intrusion prediction technique is based on Linear Discriminant Analysis (LDA) and Quadratic Discriminant Analysis (QDA) which are used to predict attacks based on observed vehicle behavior. We perform simulations using Network Simulator 2 to demonstrate that the IDS achieves a low rate of false alarms and high accuracy in detection.

A Hypergraph and Arithmetic Residue-based Probabilistic Neural Network for classification in Intrusion Detection Systems

Over the past few decades, the design of an intelligent Intrusion Detection System (IDS) remains an open challenge to the research community. Continuous efforts by the researchers have resulted in the development of several learning models based on Artificial Neural Network (ANN) to improve the performance of the IDSs. However, there exists a tradeoff with respect to the stability of ANN architecture and the detection rate for less frequent attacks. This paper presents a novel approach based on Helly property of Hypergraph and Arithmetic Residue-based Probabilistic Neural Network (HG AR-PNN) to address the classification problem in IDS. The Helly property of Hypergraph was exploited for the identification of the optimal feature subset and the arithmetic residue of the optimal feature subset was used to train the PNN. The performance of HG AR-PNN was evaluated using KDD CUP 1999 intrusion dataset. Experimental results prove the dominance of HG AR-PNN classifier over the existing classifiers with respect to the stability and improved detection rate for less frequent attacks.

MAM-ISSIDS: multi-agent model-based intelligent and self-sharing intrusion detection system for distributed network

Intrusion detection system (IDS) is essential for protecting the computer networks from various threats and attacks. The autonomous multi-agent model (MAM) architecture is a scalable and smart alternative to leverage the strengths of the host and network based IDS. This paper proposes MAM-based intelligent and self-sharing IDS (MAM-ISSIDS) for distributed network to detect the host, network and web service attacks. Feature selection is performed by using the integrated particle swarm optimisation-genetic algorithm (PSO-GA) approach. The intuitionistic fuzzy rules are used to formulate the rules of the existing attackers for the benchmark dataset. The ontology structure is used to share the rules in network. The MAM is used for detecting the occurrence of abnormal traffic resulting due to the intrusion attacks. The proposed system achieves higher attack detection rate, accuracy and lower false positive rate due to the distributed sharing strategy of the MAM.

MAM-ISSIDS: multi-agent model-based intelligent and self-sharing intrusion detection system for distributed network

Intrusion detection system (IDS) is essential for protecting the computer networks from various threats and attacks. The autonomous multi-agent model (MAM) architecture is a scalable and smart alternative to leverage the strengths of the host and network based IDS. This paper proposes MAM-based intelligent and self-sharing IDS (MAM-ISSIDS) for distributed network to detect the host, network and web service attacks. Feature selection is performed by using the integrated particle swarm optimisation-genetic algorithm (PSO-GA) approach. The intuitionistic fuzzy rules are used to formulate the rules of the existing attackers for the benchmark dataset. The ontology structure is used to share the rules in network. The MAM is used for detecting the occurrence of abnormal traffic resulting due to the intrusion attacks. The proposed system achieves higher attack detection rate, accuracy and lower false positive rate due to the distributed sharing strategy of the MAM.

A Learnable Anomaly Detection System using Attributional Rules

The continuous changing networks introduce new attacks, which represent an explicit problem that affects the security of enterprise resources. Thus, there is a real need to build up intelligent intrusion detection systems that can learn from the network behavior. In this paper, a learnable anomaly intrusion detection system based on attributional rules is presented. The proposed model is chosen with the advantages of being expressive, flexible and can operate in noisy and inconsistent environments. The system is a real-time intrusion detector that utilizes incremental supervised machine learning technique. Such technique makes use of the Algorithm Quasi-optimal (AQ) which is based on attributional calculus. Here, an Algorithm Quasi-optimal for Intrusion Detection System (AQ4IDS) is exploited and implemented using attributional rules to discriminate between normal and anomalous network traffic. The behavior of AQ4IDS is tested, and to illustrate its superiority. The experimental results showed that, the model automatically accommodates new rules from continuous network stream. Many experiments have verified the fact that AQ4IDS can efficiently discriminate between normal and anomalous network traffic, in addition to offering the advantage of detecting novel and zero day attacks.

Intelligent Intrusion Detection of Grey Hole and Rushing Attacks in Self-Driving Vehicular Networks

Vehicular ad hoc networks (VANETs) play a vital role in the success of self-driving and semi self-driving vehicles, where they improve safety and comfort. Such vehicles depend heavily on external communication with the surrounding environment via data control and Cooperative Awareness Messages (CAMs) exchanges. VANETs are potentially exposed to a number of attacks, such as grey hole, black hole, wormhole and rushing attacks. This work presents an intelligent Intrusion Detection System (IDS) that relies on anomaly detection to protect the external communication system from grey hole and rushing attacks. These attacks aim to disrupt the transmission between vehicles and roadside units. The IDS uses features obtained from a trace file generated in a network simulator and consists of a feed-forward neural network and a support vector machine. Additionally, the paper studies the use of a novel systematic response, employed to protect the vehicle when it encounters malicious behaviour. Our simulations of the proposed detection system show that the proposed schemes possess outstanding detection rates with a reduction in false alarms. This safe mode response system has been evaluated using four performance metrics, namely, received packets, packet delivery ratio, dropped packets and the average end to end delay, under both normal and abnormal conditions.

IDetect: an intelligent intrusion detection system for wireless body area networks

Driven by recent technological advances in wireless communications, wireless sensors, and low power networked systems, wireless sensor networks (WSNs) are emerging as a promising technology in healthcare applications. Since information transmitted in these wireless body area networks (WBAN) often consists of critical and sensitive patient health and personal information, securing these networks is of central importance to their practical deployment in healthcare applications. The objective of this research is to design and develop intelligent intrusion detection techniques to improve security in WBAN. In this work, we propose iDetect, a multi-objective genetic algorithm based intrusion detection system (IDS) to provide optimal attack detection in these networks. The proposed algorithm guarantees that only those features necessary for detecting a specific attack is used in the intrusion detection process, thereby decreasing the computational complexity.

An intelligent intrusion detection system by using hierarchically structured learning automata

Nowadays, intelligent learning environments are efficient and interesting solutions for many complicated problems. Learning automata is an intelligent decision-making scheme that follows a learning strategy to select the optimal action through repeated interactions with its environment. In this paper, we adopt this learning system to develop a high-performance intrusion detection system. Intrusion detection systems are based on either anomaly detection or misuse detection approaches. Only known attacks can be detected by misuse detection, but anomaly detection is intelligent enough to detect all the unknown attacks. This paper was aimed to detect anomaly intrusive behaviors inside the network, in a learning manner. Simulative study, done based on KDD Cup 99 dataset, shows that the proposed approach outperforms existing schemes in terms of the attack detection ratio and the false alarm ratio.

A Hybrid Zone based Leader for Monitoring Sinkhole Attack in Wireless Sensor Network

Objectives: The main aim of this paper is security by applying Intelligent Intrusion detection System to detect one of the critical attack know as sinkhole attack in Wireless Sensor network. Methods/Analysis: The major problem occurs while transmitting the data is security. The malicious node attracts the packets from the other normal sensor nodes and drops the sensitive packets which may leads to selective forwarding attack and black hole attack. Findings: In the existing system, Leader based intrusion detection system is used to monitor the surrounding node. Here the leader can monitor the nodes only region wise and does not have any clustering technique. By using the clustering technique we can monitor the surrounding nodes in efficient manner and better solution. In the proposed system, an Intelligent Intrusion Detection System (IIDS) mechanism to detect the intruder in the network, which uses a Hybrid Approach to detect and prevent sinkhole attack, with two approaches such as Zone-Based Leader Election Method and Leader Based Monitoring. In Zone-Based Leader Election method, a set of nodes is located in different regions and a Cluster Based Zone Leader (CBZL) is allocated to every region in the network. In the Leader Based Monitoring Approach, when a node gets detected as a compromised node, it communicates the status of that node to the other leader within the WSN. Application/Improvement: This technique can identify the intruder node and improve the efficiency of the network. As a simulation results, we are implementing in Network Simulator. In environment monitoring and military applications the proposed approach can be deployed.

A NOVEL DISTRIBUTED INTRUSION DETECTION FRAMEWORK FOR NETWORK ANALYSIS

Computer networks are used to transfer information between different types of computer devices. Due to rapid development in internet technologies, network users and communication increases day by day. Hence there is a need for huge data analysis, but a currently available tool has been facing a bottleneck. The volume of data along with the speed it generates makes it difficult for the current available tools to handle big data. To overcome this situation, big data packet analysis can be performed through a cloud computing platform for distributed storage (HDFS) and distributed processing (map reduce). However, with the extensive use of cloud computing, security issues arise. With increase of networks, security methods also need to be increased day by day. Hence, intrusion detection system (IDS) are essential components in secure network environment monitors network traffic and allows early detection attacks and alerts the system. Snort is most commonly used IDS available under GPL, which allows pattern search. Hence, there is an urgent need to intelligent intrusion detection systems (IDSs) to detect intrusions automatically. The functionality of Snort IDS can be extended by integrating anomaly preprocessor to detect new attacks. This paper provides a novel distributed Intrusion detection framework for network analysis using snort and Hadoop.

Clustering extension of MOVICAB-IDS to identify SNMP community searches

There are many security systems to protect information resources, but we are still not free from possible successful attacks. This study aims at being one step towards the proposal of an intrusion detection system (IDS) that faces those attacks not previously seen (zero-day attacks), by studying the combination of clustering and neural visualization techniques. To do that, MObile VIsualization Connectionist Agent-Based IDS (MOVICAB-IDS), previously proposed as a hybrid intelligent IDS based on a visualization approach, is upgraded by adding clustering methods. One of the main drawbacks of MOVICAB-IDS was its dependence on human processing; it could not automatically raise an alarm to warn about attacks. Additionally, human users could fail to detect an intrusion even when visualized as an anomalous one. To overcome this limitation, present work proposes the application of clustering techniques to provide automatic response to MOVICAB-IDS to quickly abort intrusive actions while happening. To check the validity of the proposed clustering extension, it faces now an anomalous situation related to the Simple Network Management Protocol: a community search. This attack to get the community string (password guessing) is analysed by clustering and neural tools, individually and in conjunction. Through the experimental stage, it is shown that the combination of clustering and neural projection improves the detection capability on a continuous

Network Based Distributed Intelligent Intrusion Detecting System

The breach of security barriers of the computer systems has always been a greater concern in the information technology era. The Intrusions and Attacks seem to come from different angles and in different type everyday. It has been a critical battle to keep phase with the ever increasingly mounting threats to the computer Systems. Intruders analyze the computer systems through networks for any of possible loop-holes and vulnerabilities. The intruders exploit these compromising vulnerabilities to mount the attacks. The existing Intrusion Detection Systems (IDS) are not efficient and intelligent enough to detect the new type of attacks. The signature based IDSs detect the known type where as the misuse detection based IDSs producing a huge amount of false alarm and still needs administrator assistance. Traditional intrusion detection systems are increasingly limited by their need of an up-to-date and comprehensive knowledge base. The need for an Intelligent IDS is very essential at this point and I would like to introduce a Network-Based Distributed IDS with the capability to learn and detect the new type of attacks since novel architecture of proposed Intelligent IDS. This IDS will focus on overcoming the most prominent drawback of the existing IDS systems and may be a new step forward in a new direction since the success architecture.

Using response action with intelligent intrusion detection and prevention system against web application malware

Purpose – The purpose of this paper is to mitigate vulnerabilities in web applications, security detection and prevention are the most important mechanisms for security. However, most existing research focuses on how to prevent an attack at the web application layer, with less work dedicated to setting up a response action if a possible attack happened. Design/methodology/approach – A combination of a Signature-based Intrusion Detection System (SIDS) and an Anomaly-based Intrusion Detection System (AIDS), namely, the Intelligent Intrusion Detection and Prevention System (IIDPS). Findings – After evaluating the new system, a better result was generated in line with detection efficiency and the false alarm rate. This demonstrates the value of direct response action in an intrusion detection system. Research limitations/implications – Data limitation. Originality/value – The contributions of this paper are to first address the problem of web application vulnerabilities. Second, to propose a combination of an SIDS and an AIDS, namely, the IIDPS. Third, this paper presents a novel approach by connecting the IIDPS with a response action using fuzzy logic. Fourth, use the risk assessment to determine an appropriate response action against each attack event. Combining the system provides a better performance for the Intrusion Detection System, and makes the detection and prevention more effective.

Development and Design of Intelligent Intrusion Detection System Based on Data Mining

With the popularization and development of Internet, the network has penetrated into every corner of social life. Network brings people convenient but at the same time it also brings a series of safety problems. Intrusion detection system is an important part of network security system. Computer security problem is increasingly prominent, which puts forward higher requirements on intrusion detection system. In this paper, the application of data mining and intelligent Agent detection in the intrusion detection system is researched.

INTELLIGENT MULTI-AGENT INFORMATION SECURITY SYSTEM

It is proposed an agent approach for creation of intelligent intrusion detection system. The system allows detecting known type of attacks and anomalies in user activity and computer system behavior. The system includes different types of intelligent agents. The most important one is user agent based on neural network model of user behavior. Proposed approach is verified by experiments in real intranet of Institute of Physics and Technologies of National Technical University of Ukraine "Kiev Polytechnic Institute.