Intelligent Intrusion Detection Research Articles

An intelligent dynamic cyber physical system threat detection system for ensuring secured communication in 6G autonomous vehicle networks

Smart cities have developed advanced technology that improves people’s lives. A collaboration of smart cities with autonomous vehicles shows the development towards a more advanced future. Cyber-physical system (CPS) are used blend the cyber and physical world, combined with electronic and mechanical systems, Autonomous vehicles (AVs) provide an ideal model of CPS. The integration of 6G technology with Autonomous Vehicles (AVs) marks a significant advancement in Intelligent Transportation Systems (ITS), offering enhanced self-sufficiency, intelligence, and effectiveness. Autonomous vehicles rely on a complex network of sensors, cameras, and software to operate. A cyber-attack could interfere with these systems, leading to accidents, injuries, or fatalities. Autonomous vehicles are often connected to broader transportation networks and infrastructure. A successful cyber-attack could disrupt not only individual vehicles but also public transportation systems, causing widespread chaos and economic damage. Autonomous vehicles communicate with other vehicles (V2V) and infrastructure (V2I) for safe and efficient operation. If these communication channels are compromised, it could lead to collisions, traffic jams, or other dangerous situations. So we present a novel approach to mitigating these security risks by leveraging pre-trained Convolutional Neural Network (CNN) models for dynamic cyber-attack detection within the cyber-physical systems (CPS) framework of AVs. The proposed Intelligent Intrusion Detection System (IIDS) employs a combination of advanced learning techniques, including Data Fusion, One-Class Support Vector Machine, Random Forest, and k-Nearest Neighbor, to improve detection accuracy. The study demonstrates that the EfficientNet model achieves superior performance with an accuracy of up to 99.97%, highlighting its potential to significantly enhance the security of AV networks. This research contributes to the development of intelligent cyber-security models that align with 6G standards, ultimately supporting the safe and efficient integration of AVs into smart cities.

An optimized and intelligent metaverse intrusion detection system based on rough sets

The convergence of the Internet of Things (IoT) and the Metaverse is revolutionizing the digital world by providing immersive, interactive environments as well as new data transmission opportunities. However, this rapid integration raises complex security issues, including an increased risk of unlawful access and data breaches. Strong cybersecurity measures are required to identify and prevent these attacks, preserving the security and confidentiality of users. Finding significant features for recognizing malicious attacks and enhancing the accuracy of network intrusion detection in general, and particularly in the virtual environment, are some of the significant research needs. This paper introduces an intelligent intrusion detection system (IIDS) based on rough set-based electric eel foraging optimization (RSEEFO) in conjunction with the AdaBoost-based classification algorithm. The main objective of this system is to detect and recognize different types of attacks on the interaction and connectivity between the IoT and the metaverse. The proposed IIDS-RSEEFO consists of three phases, which are data pre-processing, multi-IoT attack classification, and evaluation. The main problems associated with the adopted dataset are handled in data pre-processing. Then, in the second phase, a one-versus-all approach is employed along with RSEEFO and AdaBoost to handle the multi-class classification problem. Finally, several evaluation metrics are employed to assess the reliability and robustness of the proposed IIDS-RSEEFO. The proposed IIDS was tested on CIC-IoT-2023 and validated on UNSWNB-15. It achieved high accuracy across all attack types of CIC-IoT-2023, with accuracies of 99.7 %, 100 %, 100 %, 99.8 %, 100 %, 100 %, 99.8 %, and 100 % for benign traffic, DDoS, brute force, spoofing, DoS, Mirai, recon, and web-Based respectively, accompanied by robust sensitivity, F1-Score, Specificity, G-Mean, and crossover-error rate metrics demonstrating its effectiveness in accurately predicting each attack type. Additionally, it obtained high accuracy for all attack types of UNSWNB-15, with accuracies of 96.48 %, 99.12 %, 99.24 %, 93.78 %, 92.55 %, 92.55 %, 92.55 %, 94.73 %, 94.73 %, 98.09 %, 98.39 %, 99.50 %, and 99.95 % for analysis, backdoor, DoS, exploits, fuzzers, generic, normal, reconnaissance, shellcode, and worms, respectively. In addition, the results evaluated that the proposed model is superior compared to the existing intrusion detection systems.

An Intelligent Attack Detection Framework for the Internet of Autonomous Vehicles with Imbalanced Car Hacking Data

The modern Internet of Autonomous Vehicles (IoVs) has enabled the development of autonomous vehicles that can interact with each other and their surroundings, facilitating real-time data exchange and communication between vehicles, infrastructure, and the external environment. The lack of security procedures in vehicular networks and Controller Area Network (CAN) protocol leaves vehicles exposed to intrusions. One common attack type is the message injection attack, which inserts fake messages into original Electronic Control Units (ECUs) to trick them or create failures. Therefore, this paper tackles the pressing issue of cyber-attack detection in modern IoV systems, where the increasing connectivity of vehicles to the external world and each other creates a vast attack surface. The vulnerability of in-vehicle networks, particularly the CAN protocol, makes them susceptible to attacks such as message injection, which can have severe consequences. To address this, we propose an intelligent Intrusion detection system (IDS) to detect a wide range of threats utilizing machine learning techniques. However, a significant challenge lies in the inherent imbalance of car-hacking datasets, which can lead to misclassification of attack types. To overcome this, we employ various imbalanced pre-processing techniques, including NearMiss, Random over-sampling (ROS), and TomLinks, to pre-process and handle imbalanced data. Then, various Machine Learning (ML) techniques, including Logistic Regression (LR), Linear Discriminant Analysis (LDA), Naive Bayes (NB), and K-Nearest Neighbors (k-NN), are employed in detecting and predicting attack types on balanced data. We evaluate the performance and efficacy of these techniques using a comprehensive set of evaluation metrics, including accuracy, precision, F1_Score, and recall. This demonstrates how well the suggested IDS detects cyberattacks in external and intra-vehicle vehicular networks using unbalanced data on vehicle hacking. Using k-NN with various resampling techniques, the results show that the proposed system achieves 100% detection rates in testing on the Car-Hacking dataset in comparison with existing work, demonstrating the effectiveness of our approach in protecting modern vehicle systems from advanced threats.

Enhanced Network Intrusion Detection System for Internet of Things Security Using Multimodal Big Data Representation with Transfer Learning and Game Theory.

Internet of Things (IoT) applications and resources are highly vulnerable to flood attacks, including Distributed Denial of Service (DDoS) attacks. These attacks overwhelm the targeted device with numerous network packets, making its resources inaccessible to authorized users. Such attacks may comprise attack references, attack types, sub-categories, host information, malicious scripts, etc. These details assist security professionals in identifying weaknesses, tailoring defense measures, and responding rapidly to possible threats, thereby improving the overall security posture of IoT devices. Developing an intelligent Intrusion Detection System (IDS) is highly complex due to its numerous network features. This study presents an improved IDS for IoT security that employs multimodal big data representation and transfer learning. First, the Packet Capture (PCAP) files are crawled to retrieve the necessary attacks and bytes. Second, Spark-based big data optimization algorithms handle huge volumes of data. Second, a transfer learning approach such as word2vec retrieves semantically-based observed features. Third, an algorithm is developed to convert network bytes into images, and texture features are extracted by configuring an attention-based Residual Network (ResNet). Finally, the trained text and texture features are combined and used as multimodal features to classify various attacks. The proposed method is thoroughly evaluated on three widely used IoT-based datasets: CIC-IoT 2022, CIC-IoT 2023, and Edge-IIoT. The proposed method achieves excellent classification performance, with an accuracy of 98.2%. In addition, we present a game theory-based process to validate the proposed approach formally.

Intelligent intrusion detection through deep autoencoder and stacked long short-term memory

In the realm of network intrusion detection, the escalating complexity and diversity of cyber threats necessitate innovative approaches to enhance detection accuracy. This study introduces an integrated solution leveraging deep learning techniques for improved intrusion detection. The proposed framework consists on a deep autoencoder for feature extraction, and a stacked long short-term memory (LSTM) network ensemble for classification. The deep autoencoder compresses raw network data, extracting salient features and mitigating noise. Subsequently, the stacked LSTM ensemble captures intricate temporal dependencies, correcting anomaly detection precision. Experiments conducted on the UNSW-NB15 dataset, and a benchmark in intrusion detection validate the effectiveness of the approach. The solution achieves an accuracy of 90.59%, with precision, recall, and F1-Score metrics reaching 90.65, 90.59, and 90.57, respectively. Notably, the framework outperforms standalone models and demonstrates the advantage of synergizing deep autoencoder-driven feature extraction with the stacked LSTM ensemble. Furthermore, a binary classification experiment attains an accuracy of about 90.59%, surpassing the multiclass classification and affirming the model's potential for binary threat identification. Comparative analyses highlight the pivotal role of feature extraction, while experimentation illustrates the enhancement achieved by incorporating the synergistic deep autoencoder-Stacked LSTM approach.

Intelligent Intrusion Detection System in Internet of Vehicles using Random Forest, Logistic Regression and Decision Tree Algorithm

This study introduces an Intelligent Intrusion Detection System (IDS) for Internet of Vehicles (IoV) security. Using Random Forest, Logistic Regression, and Decision Tree algorithms, it detects and prevents intrusions in real-time. By combining these algorithms, the IDS aims to improve accuracy and adapt to evolving threats. Evaluation metrics include accuracy (93.6%), precision (94.4%), recall (95.3%), and F1 score (96.7%). Analysis of false positives/negatives informs refinement for real-world use. The IDS enhances cybersecurity for connected vehicles. This IDS provides a robust defense against cyber threats in the IoV ecosystem, ensuring user safety and privacy. Its multi-algorithmic approach and high-performance metrics make it a reliable solution for safeguarding connected vehicles.

Novel intrusion detection system based on a downsized kernel method for cybersecurity in smart agriculture

Smart farming aims to ameliorate the quantity and quality of farms products using modern information and communication technologies. Agriculture has always used cutting-edge technology to improve profitability, efficiency, and safety as well as creating the opportunity for more environmentally friendly operations. In smart agriculture network communication between smart devices is necessary to managing the agriculture process. Consequently, the possibility of information being exposed to hacking is very likely, which makes the information security system extremely important and cannot be neglected. Even though many solutions have been developed to overcome cyberattacks in smart networks, some limitations are observed, such as solving multi-class problems, high feature dimensions, and overhead computation. To address the aforementioned issues, an intelligent Intrusion Detection System (IDS) for identifying cyberattacks in the Internet of Agriculture Things (IoAT) is proposed. The developed model uses a proposed reduced kernel method, the Downsized Kernel Partial Least Square (DKPLS) to extract and reduce data feature dimension to improve detection performance. The DRKPLS approach is used to reduce the dimension of a kernel matrix generated using the Kernel Partial Least Square (KPLS) technique by selecting the most important features. In classification phase, the Kernel Extreme Learning Machine (KELM) is used to classify data for binary and multi-class classification. The proposed IDS is evaluated on a new Industrial IoT Dataset, X-IIoTID. The developed approach achieved higher performances for binary classification and for multi–class classification compared to others machine learning and deep learning approaches. The proposed approach achieved an accuracy rate of 99.92% for binary classification and 99.99% for multi–class classification. Furthermore, the higher percentage in multi-class classification is obtained for the two types of attacks Ransom Denial of Service (RDoS) and Command_Control respectively.

Advanced machine learning approach for DoS attack resilience in internet of vehicles security

Recent years have witnessed security as a great concern in vehicular networks (VANET). Particularly, Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks can jeopardize the network by broadcasting a storm of packets. Correspondingly, the network resources are jammed with malicious traffic. In this connection, the existing research presented various techniques to cope with DoS and DDoS attacks. Different from those traditional approaches, this study proposes an Intelligent Intrusion Detection System (IDS) by leveraging Machine Learning (ML). The proposed IDS utilizes a publicly available dataset on the application layer for mitigating DDoS attacks. The designed ML-based IDS relies on combining both the Random Projection (RP) and Randomized Matrix Factorization (RMF) methods to achieve the best results for enhancing the detection capabilities of the IDS. This amalgamation enhances the system's detection capabilities by extracting and analyzing meaningful features from network traffic data. Experimental validation of our approach involves a comprehensive evaluation of various ML models, including Extra Tree Classifier (ETC), Logistic Regression (LR), and Random Forest (RF). Remarkably, the combined accuracy of these models yields an average system accuracy of 0.98, surpassing existing methods. Unlike conventional approaches, our proposed IDS excels in efficiency and exhibits notable performance in detecting DoS and DDoS attacks in VANET. This proficiency ensures the integrity and safety of vehicle communications. Thus, our research substantially contributes to the vehicular network security field. The presented findings establish a foundation for future advancements in securing connected vehicles.

Machine Learning and Deep Learning Techniques for Internet of Things Network Anomaly Detection-Current Research Trends.

With its exponential growth, the Internet of Things (IoT) has produced unprecedented levels of connectivity and data. Anomaly detection is a security feature that identifies instances in which system behavior deviates from the expected norm, facilitating the prompt identification and resolution of anomalies. When AI and the IoT are combined, anomaly detection becomes more effective, enhancing the reliability, efficacy, and integrity of IoT systems. AI-based anomaly detection systems are capable of identifying a wide range of threats in IoT environments, including brute force, buffer overflow, injection, replay attacks, DDoS assault, SQL injection, and back-door exploits. Intelligent Intrusion Detection Systems (IDSs) are imperative in IoT devices, which help detect anomalies or intrusions in a network, as the IoT is increasingly employed in several industries but possesses a large attack surface which presents more entry points for attackers. This study reviews the literature on anomaly detection in IoT infrastructure using machine learning and deep learning. This paper discusses the challenges in detecting intrusions and anomalies in IoT systems, highlighting the increasing number of attacks. It reviews recent work on machine learning and deep-learning anomaly detection schemes for IoT networks, summarizing the available literature. From this survey, it is concluded that further development of current systems is needed by using varied datasets, real-time testing, and making the systems scalable.

Intelligent intrusion detection for optical fiber perimeter security system based on an improved high efficiency feature extraction technique

The automated analysis of optical fiber vibration sensing data has been highly demanded in engineering applications. Therefore, intrusion analysis, which aims at detecting, recognizing, and classifying intrusions, holds great importance for optical fiber vibration sensing. In this work, an intelligent intrusion detection scheme employing an improved high-efficiency feature extraction technique and utilizing a dual Mach–Zehnder interferometer (DMZI)-based optical fiber perimeter security system is proposed. So, the DMZI-based perimeter security system in practical settings can be successfully established. Specifically, time-frequency feature vectors with nine features are firstly constructed using a maximal overlap discrete wavelet transformation approach and a zero crossing rate method. Then, the feature vectors are classified into corresponding categories using a radial basis function neural network. The effectiveness of the proposed scheme has been validated using six types of human intrusions, such as knocking, climbing, waggling, cutting, crashing and kicking the fence. The results show that the given intrusions can be accurately and rapidly recognized by the proposed scheme. The average recognition rate of 95.0% is achieved, and the average processing time for each sample data is only 0.033 s, which is significantly lower than the sampling interval (0.3 s) in our experiment. It is believed that the proposed scheme holds promising potential in the field of optical fiber perimeter security systems.

Retracted: Intelligent Intrusion Detection Method of Industrial Internet of Things Based on CNN-BiLSTM

Retracted: Intelligent Intrusion Detection Method of Industrial Internet of Things Based on CNN-BiLSTM

Cloud Computing Security via Intelligent Intrusion Detection Mechanisms

New challenges of data breaches, unauthorized access, and insider threats have emerged with the rise of Cloud Computing. Attackers find cloud systems attractive due to their common infrastructure. To combat these security threats, strong security procedures must be integrated. An intrusion detection system (IDS) is a vital instrument for safeguarding networks and cloud environments. It tracks system activity and network traffic. This study compares the efficacy of various machine learning models for intrusion detection. The Random-Forest-Classifier model performed the best with a test accuracy of 99.88% in recognizing known and unknown threats. Furthermore, various benefits have been identified when contrasting this intelligent intrusion detection system with conventional rule-based and signature-based methods. The use of machine learning in intrusion detection systems offers enhanced security measures and improved threat detection capabilities, highlighting the importance of leveraging advanced technologies to secure cloud environments. This research illuminates the necessity to employ cutting-edge techniques to protect cloud computing systems from malicious actions in the era of cybersecurity. More than that, it stresses the necessity to invest in enrichment mechanisms in machine learning-based intrusion detection systems to stay abreast with the evolving security problems.

Edge-Federated Learning-Based Intelligent Intrusion Detection System for Heterogeneous Internet of Things

Edge-Federated Learning-Based Intelligent Intrusion Detection System for Heterogeneous Internet of Things

Intelligent Intrusion Detection Based on Multi-Model Federated Learning for Software Defined Network

Intelligent Intrusion Detection Based on Multi-Model Federated Learning for Software Defined Network

Security strategy for autonomous vehicle cyber-physical systems using transfer learning

Cyber-physical systems (CPSs) are emergent systems that enable effective real-time communication and collaboration (C&C) of physical components such as control systems, sensors, actuators, and the surrounding environment through a cyber communication infrastructure. As such, autonomous vehicles (AVs) are one of the fields that have significantly adopted the CPS approach to improving people's lives in smart cities by reducing energy consumption and air pollution. Therefore, autonomous vehicle-cyber physical systems (AV-CPSs) have attracted enormous investments from major corporations and are projected to be widely used. However, AV-CPS is vulnerable to cyber and physical threat vectors due to the deep integration of information technology (IT), including cloud computing, with the communication process. Cloud computing is critical in providing the scalable infrastructure required for real-time data processing, storage, and analysis in AV-CPS, allowing these systems to work seamlessly in smart cities. CPS components such as sensors and control systems through network infrastructure are particularly vulnerable to cyber-attacks targeted by attackers using the communication system. This paper proposes an intelligent intrusion detection system (IIDS) for AV-CPS using transfer learning to identify cyberattacks launched against connected physical components of AVs through a network infrastructure. First, AV-CPS was developed by implementing the controller area network (CAN) and integrating it into the AV simulation model. Second, the dataset was generated from the AV-CPS. The collected dataset was then preprocessed to be trained and tested via pre-trained CNNs. Third, eight pre-trained networks were implemented, namely, InceptionV3, ResNet-50, ShuffleNet, MobileNetV2, GoogLeNet, ResNet-18, SqueezeNet, and AlexNet. The performance of the implemented models was evaluated. According to the experimental evaluation results, GoogLeNet outperformed all other pre-rained networks, scoring an F1- score of 99.47%.

Clustering based Intrusion Detection System for effective Detection of known and Zero-day Attacks

Developing effective security measures is the most challenging task now a days and hence calls for the development of intelligent intrusion detection systems. Most of the existing intrusion detection systems perform best at detecting known attacks but fail to detect zero-day attacks due to the lack of labeled examples. Authors in this paper, comes with a clustering-based IDS framework that can effectively detect both known and zero-day attacks by following unsupervised machine learning techniques. This research uses NSL-KDD dataset for the motive of experimentation and the experimental results exhibit best performance with an accuracy of 78%.

IIDS: Intelligent Intrusion Detection System for Sustainable Development in Autonomous Vehicles

Connected and Autonomous Vehicles (CAVs) enable various capabilities and functionalities like automated driving assistance, navigation and path planning, cruise control, independent decision making, and low-carbon transportation in the real-time environment. However, the increased CAVs usage renders the potential vulnerabilities in the Internet of Vehicles (IoV) environment, making it susceptible to cyberattacks. An Intrusion Detection System (IDS) is a technique to report network assaults by potential Autonomous Vehicles (AVs) without encryption and authorization procedures for internal and external vehicular communications. This paper proposes an Intelligent IDS (IIDS) to enhance intrusion detection and categorize malicious AVs using a modified Convolutional Neural Network (CNN) with hyperparameter optimization approaches for IoV systems. The proposed IIDS framework works in a 5G Vehicle-to-Everything (V2X) environment to effectively broadcast messages about malicious AVs. Thus IIDS aids in preventing collisions and chaos, enhancing safety monitoring in the traffic. The experimental results depict that the proposed IIDS achieves 98% accuracy in detecting attacks.

Application cost of intelligent intrusion detection in medical logistics management under public cloud environment

Because the medical logistics management involves a large number of sensitive data and information, the security problem has become the key problem to be solved. This paper explores the use of Intelligent Intrusion Detection Technology in the public cloud to improve the security of medical logistics management applications, and evaluates its impact on costs. The research adopts computer steps, including collecting data and information of medical logistics management, constructing intrusion detection system model, designing experimental scheme, conducting simulation experiments and data analysis. The results show that the application of Intelligent Intrusion Detection Technology in the public cloud can significantly improve the security of medical logistics management and reduce the potential intrusion risk. The comprehensive analysis shows that the cost of intelligent intrusion detection technology is relatively low, which is reasonable compared with the improvement of security.

Attentive transformer deep learning algorithm for intrusion detection on IoT systems using automatic Xplainable feature selection.

Recent years have witnessed an in-depth proliferation of the Internet of Things (IoT) and Industrial Internet of Things (IIoT) systems linked to Industry 4.0 technology. The increasing rate of IoT device usage is associated with rising security risks resulting from malicious network flows during data exchange between the connected devices. Various security threats have shown high adverse effects on the availability, functionality, and usability of the devices among which denial of service (DoS) and distributed denial of service (DDoS), which attempt to exhaust the capacity of the IoT network (gateway), thereby causing failure in the functionality of the system have been more pronounced. Various machine learning and deep learning algorithms have been used to propose intelligent intrusion detection systems (IDS) to mitigate the challenging effects of these network threats. One concern is that although deep learning algorithms have shown good accuracy results on tabular data, not all deep learning algorithms can perform well on tabular datasets, which happen to be the most commonly available format of datasets for machine learning tasks. Again, there is also the challenge of model explainability and feature selection, which affect model performance. In this regard, we propose a model for IDS that uses attentive mechanisms to automatically select salient features from a dataset to train the IDS model and provide explainable results, the TabNet-IDS. We implement the proposed model using the TabNet algorithm based on PyTorch which is a deep-learning framework. The results obtained show that the TabNet architecture can be used on tabular datasets for IoT security to achieve good results comparable to those of neural networks, reaching an accuracy of 97% on CIC-IDS2017, 95% on CSE-CICIDS2018 and 98% on CIC-DDoS2019 datasets.

Blockchain and federated learning-based intrusion detection approaches for edge-enabled industrial IoT networks: a survey

The industrial internet of things (IIoT) is an evolutionary extension of the traditional Internet of Things (IoT) into processes and machines for applications in the industrial sector. The IIoT systems generate a large amount of private and sensitive data i.e., stored and processed somewhere on the cloud-edge continuum. The IIoT devices, and the IIoT networks are subject to security mechanisms such as intelligent Intrusion Detection and Prevention Systems (IDS/IPS) systems, that can detect and respond unseen malicious network attacks. The adoption of centralized machine learning methods for IDS has become impractical due to the high computational cost and privacy concerns associated with storing large amounts of data on a single server along the cloud-edge continuum. The combination of federated learning and Blockchain has emerged as a promising advancement in addressing the challenge. Federated learning distributes learning to individual IIoT devices without compromising data privacy, while Blockchain enhances privacy and security. Many academic and industrial efforts outline IDS mechanisms using machine learning, deep learning, federated learning, and Blockchain technologies. The utilization of federated learning-based IDS has become increasingly popular and is now being applied to various tasks including IDS/IPS systems. However, existing intrusion detection systems (IDSs) survey are limited to the scope of classical machine learning and deep learning. To address this limitation, we analyze the IIoT literature that integrates Blockchain and federated learning to enhance IDSs and improve its threat detection capabilities. This survey explores the role of Blockchain and federated learning in addressing security and privacy issues, particularly those associated with IDS/IPS in IIoT networks. Insights on the possibilities of machine learning, federated learning, and Blockchain in supporting IDS to monitor IIoT network traffic for anomaly detection are discussed in detail through state of the art. Furthermore, we provide a set of recommendation based on our literature for the effective implementation of a Blockchain and federated learning-based network intrusion detection system. Finally, we summarize the study and highlight challenges as future research directions for Blockchain and Federated Learning-based technologies for cybersecurity and intrusion detection in IIoT.