Intrusion Detection Algorithm Research Articles

An adversarial environment reinforcement learning-driven intrusion detection algorithm for Internet of Things

The increasing prevalence of Internet of Things (IoT) systems has made them attractive targets for malicious actors. To address the evolving threats and the growing complexity of detection, there is a critical need to search for and develop new algorithms that are fast and robust in detecting and classifying dangerous network traffic. In this context, deep reinforcement learning (DRL) is gaining recognition as a prospective solution in numerous fields as it enables autonomous agents to cooperate with their environment for decision-making without relying on human experts. This article presents an innovative approach to intrusion detection in IoT systems using an adversarial reinforcement learning (RL) algorithm known for its exceptional predictive capabilities. The predictive process relies on a classifier, implemented as a streamlined and highly efficient neural network. Embedded within this classifier is a policy function meticulously trained using an innovative RL model. Importantly, this model ensures that the environment’s behavior is dynamically fine-tuned simultaneously with the learning process, improving the overall effectiveness of the intrusion detection approach. The efficiency of our proposal was assessed using the Bot-IoT database, consisting of a mixture of legitimate IoT network traffic and simulated attack scenarios. Our scheme shows superior performance compared to existing ones. Therefore, our approach to IoT intrusion detection can be considered a valuable alternative to existing methods, capable of significantly improving the IoT systems’ security.

SecureNet: Network Intrusion Detection using Machine Learning and Deep Learning Techniques

Abstract: In the ever-evolving landscape of cybersecurity, the need for robust intrusion detection systems has become paramount. This paper introduces a cutting-edge intrusion detection algorithm designed to enhance network security through the integration of advanced machine learning and deep learning methodologies. The proposed algorithm capitalizes on the strengths of both paradigms to achieve a comprehensive and adaptive approach to identifying malicious activities within a network. This research focuses on enhancing network security through the development and evaluation of a novel intrusion detection system leveraging both deep learning and traditional machine learning approaches. Utilizing the NSL-KDD dataset, we employ the Long Short-Term Memory (LSTM) model, a superior version of Recurrent Neural Networks (RNNs), and the K-Nearest Neighbors (KNN) algorithm for binary and multi-class classification of network intrusion anomalies. The LSTM model excels in capturing temporal dependencies, enabling the detection of nuanced sequential patterns, while the KNN algorithm contributes to a comprehensive classification framework. Experimental results demonstrate the effectiveness of the hybrid methodology, showcasing improved accuracy, precision, and recall compared to traditional methods. This research underscores the potential of integrating deep learning and classical machine learning techniques to bolster the capabilities of intrusion detection systems in safeguarding against evolving cyber threats

An Effective Intrusion Detection System for Edge Computing Using ConvNeXt and ResNet152V2

The proliferation of edge computing, driven by network applications and wireless devices, increases the vulnerability of confidential information to security risks. In this environment, existing intrusion detection algorithms fail to satisfy the requirements of prompt responses, heavy network load management, inadequate extraction of features, and imprecise model classification. In this work, the imbalanced data problem in the input dataset is mitigated using the Data Augmentation Generative Adversarial Network (DAGAN). Next, an efficient ConvNeXt-based feature extraction method is created to retrieve the key characteristics from the dataset for every class. Last, multi-attack intrusion detection is achieved through the deployment of an optimized deep learning classifier based on ResNet152V2. Furthermore, simulation experiments are carried out on the ToN-IoT and BoT-IoT datasets, and the outcomes demonstrate that our suggested model performs better than the existing models, with accuracy levels of 99.20% and 99.31%, respectively. These findings show that this approach is successful in building and refining large-scale IDS in the edge computing framework.

Security intrusion monitoring model for Internet of Things (IoT) using sniffing tools on wireless sensor networks

The Internet of Things (IoT) has revolutionized the way devices interact and share data over wireless sensor networks (WSN), enabling seamless connectivity and automation. However, the proliferation of IoT devices has raised serious security and privacy risks concerns due to their inherent vulnerabilities. This paper proposes a model for security intrusion monitoring by analyzing the existing literature and providing insights into the design, implementation, and effective deployment of the proposed model to detect intrusion in IoT using sniffing tools for network traffic analysis in real-time within WSN. The model passively monitors network traffic and identifies anomalous patterns, unauthorized access attempts, and abnormal device behavior. The review findings highlight the significance of the proposed model in enhancing the security of IoT systems. By detecting anomalous behavior and potential security breaches. The model enables timely response and mitigation actions to ensure the confidentiality, integrity and availability (CIA) of IoT devices data. The model includes consideration of network architecture, deployment of intrusion detection algorithms, and establishment of response mechanisms. It identifies various types of security threats, such as unauthorized access attempts, Denial-of-service, Distributed DoS, Brute-force, Heartbleed, Botnet, Inside Infiltration and device tampering, thereby providing response mechanisms that include generating alerts, isolating compromised devices, or blocking suspicious network traffic. The model incorporates a feedback loop to continuously update the detection mechanisms and adapt to evolving security threats in real-time. Series of experiments and simulations to be conducted using various IoT devices and network scenarios to evaluate model effectiveness. The model to comprise of wireless Router, MatLab for Deep Neural Network (DNN) training, Raspberry Pi, Wireshark setup and an array of Internet of Things (IoT) devices. The researcher to use dataset by extracting intrinsic, host-based and time-based attributes from Wireshark Sniffing tool. The datasets generated shall be piped by tshark to an output text file saved as a csv. Under-sampling technique to be used to address class imbalance of datasets. The model shall then be trained using the dataset to be able to detect intrusion in IoTs. The results is expected to demonstrate the model's ability to detect a wide range of security intrusions with high accuracy and minimal false positives. In conclusion, the model offers a proactive approach to safeguard IoT deployment. By leveraging sniffing tools and advanced analysis techniques, the model enhances the detection and response capabilities, enabling efficient protection against emerging threats in IoT. However, challenges associated with the model are identified, including the complexity of network monitoring and potential privacy concerns.

Intrusion Detection Model for Wireless Sensor Networks Based on FedAvg and XGBoost Algorithm

For the characteristics of channel instability in wireless sensor networks, this paper proposes an intrusion detection algorithm based on FedAvg (federated averaging) and XGBoost (extreme gradient boosting) wireless sensor networks using fog computing architecture. First, the network edge is extended by introducing fog computing nodes to reduce the communication delay. It reduces the transmission bandwidth and privacy leakage risk while improving the accuracy of jointly learned global and local models. Then, the histogram-based approximation calculation method is improved to adapt to the unbalanced data characteristics of wireless sensor networks. Finally, by introducing TOP-K gradient selection, the number of model parameter uploads is minimized, and the efficiency of model parameter interaction is improved. The experimental results show that this algorithm has superior detection performance and low energy consumption. It is also compared with other algorithms to demonstrate the high detection rate and low computational complexity of this algorithm.

Intrusion Detection Based on Adaptive Sample Distribution Dual-Experience Replay Reinforcement Learning

In order to cope with ever-evolving and increasing cyber threats, intrusion detection systems have become a crucial component of cyber security. Compared with signature-based intrusion detection methods, anomaly-based methods typically employ machine learning techniques to train detection models and possess the capability to discover unknown attacks. However, intrusion detection methods face the challenge of low detection rates for minority class attacks due to imbalanced data distributions. Traditional intrusion detection algorithms address this issue by resampling or generating synthetic data. Additionally, reinforcement learning, as a machine learning method that interacts with the environment to obtain feedback and improve performance, is gradually being considered for application in the field of intrusion detection. This paper proposes a reinforcement-learning-based intrusion detection method that innovatively uses adaptive sample distribution dual-experience replay to enhance a reinforcement learning algorithm, aiming to effectively address the issue of imbalanced sample distribution. We have also developed a reinforcement learning environment specifically designed for intrusion detection tasks. Experimental results demonstrate that the proposed model achieves favorable performance on the NSL-KDD, AWID, and CICIoT2023 datasets, effectively dealing with imbalanced data and showing better classification performance in detecting minority attacks.

An industrial network intrusion detection algorithm based on IGWO-GRU

An industrial network intrusion detection algorithm based on IGWO-GRU

A novel federated learning aggregation algorithm for AIoT intrusion detection

AbstractNowadays, the development of Artificial Intelligence of Things (AIoT) is advancing rapidly, and intelligent devices are increasingly exposed to more security risks on the network. Deep learning‐based intrusion detection is an effective security defence approach. Federated learning (FL) is capable of enabling deep learning models to be trained on local clients without uploading their data to a central server. This paper proposes a novel federated learning aggregation algorithm called fed‐dynamic gravitational search algorithm (Fed‐DGSA), which incorporates the GSA algorithm to optimize the weight updating process of FL local models. During the updating process, the decay rate of the gravity coefficient is optimized and random perturbations and dynamic weights are introduced to ensure a more stable and efficient FL aggregation process. The experimental results show that the detection accuracy of Fed‐DGSA has reached about 97.8%, and it is demonstrated that the model trained using Fed‐DGSA achieves higher accuracy compared to Fed‐Avg.

An adaptive RFID anti-collision algorithm for network intrusion detection

 Radio frequency identification (RFID) provides real-time network monitoring capabilities for threat identification. However, accurate detection is impeded by tag interference. This paper presents an adaptive collision tree algorithm that selects optimal binary or octal splits based on collision counts to handle interference. Experiments demonstrate an integrated RFID intrusion detection framework that achieves 8.98% higher throughput and 99.82% detection accuracy compared to other protocols. The method enables efficient real-time threat identification as networks proliferate. However, there are limitations to the approach, such as assumptions of fixed tag populations rather than dynamic tags and a lack of field testing. To strengthen the approach, further research on fluctuating tags and validation in real-world network deployments is necessary. This work presents an adaptive method for leveraging RFID to achieve scalable and accurate network intrusion detection.

Modified genetic algorithm and fine-tuned long short-term memory network for intrusion detection in the internet of things networks with edge capabilities

The emergence of smart cities is an example of how new technologies, such as the Internet of Things (IoT), have facilitated the creation of extensive interconnected and intelligent ecosystems. The widespread deployment of IoT devices has enabled the provision of constant environmental feedback, thereby facilitating the automated adaptation of associated systems. This has brought about a fundamental transformation in the way contemporary society functions. The security of emerging technologies such as IoT has become a significant challenge due to the added complexities, misconfigurations, and conflicts between modern and legacy systems. This challenge has a notable impact on the reliability and accessibility of existing infrastructure. Edge computing (EC) is a collaborative computing system that brings data processing and analysis closer to the edge of the network, where the data is generated, rather than in a centralized cloud environment. The utilization of the IoT has become more prevalent in both everyday life and the manufacturing sector, with a particular emphasis on critical infrastructure. The IoT is presently being utilized across diverse domains, including but not limited to industrial, agricultural, healthcare, and logistical sectors. The security of IoT networks has implications for the safety of individuals, the security of the nation, and economic development. Notwithstanding, conventional intrusion detection techniques that rely on centralized cloud-based systems that have been suggested in previous studies for IoT network security are insufficient to meet the requirements for data confidentiality, network capacity, and prompt responsiveness. In addition, the integration of IoT applications into smart devices has been shown to augment their functionalities. However, it is important to note that this integration also brings about potential security vulnerabilities. Furthermore, a significant number of contemporary IoT devices exhibit restricted security capabilities, rendering them vulnerable to intricate attacks and impeding the extensive integration of IoT technologies. Also, a lot of IoT network devices have been put in place that don't have hardware security measures. This means that traditional intrusion detection systems (IDS) aren't enough to protect the IoT network ecosystem. To address these issues, this research suggests the IoT-Defender framework, which combines a Modified Genetic Algorithm (MGA) model with a deep Long Short-Term Memory (LSTM) network to find cyberattacks in IoT networks. This research represents a pioneering attempt to employ the MGA for feature selection and the GA for fine-tuning the LSTM parameters within an EC framework. The parameters of the LSTM model were fine-tuned through the manipulation of the number of hidden layers, utilizing the GA fitness function. The customization of the MGA aimed to enhance its performance in selecting relevant features, optimizing the use of limited resources on IoT devices and edge nodes. The fine-tuning process involved optimizing hyperparameters, architecture, and training strategies to maximize the LSTM network's effectiveness in learning and detecting patterns in IoT network traffic. The synergy between the MGA and LSTM aimed at creating a comprehensive and efficient IDS. The feature selection by the MGA contributes to improving the LSTM’s performance by providing it with more relevant and discriminating features. In order to solve the issue of class imbalance, we utilize the focal loss function, which provides greater weights to minority classes, hence improving the model’s capacity to learn from those particular classes. The performance of the IoT-Defender model was assessed on the BoT-IoT, UNSW-NB15, and N-BaIoT datasets utilizing a Raspberry Pi IoT device. The results of our study show that the IoT-Defender model works better than other methods. This is shown by its accuracy score of 99.41%, detection rate of 99.78%, precision score of 98.50%, false alarm rate of 2.56%, mean intersection over union (mIoU) of 0.68, and training time of 81.3 seconds on BoT-IoT. The proposed IoT model is designed to be lightweight and can be installed on edge servers to detect cyber-attacks in real-time, specifically in the context of IoT security.

Application of Random Forest Algorithm in Network Intrusion Detection of Government Affairs Departments

This paper reviews the current situation of intrusion detection and the commonly used random forest (RF) method, and confirms that support vector machine (SVM) and artificial neural network (ANN) are good methods, which are important components of building state network information security. Very complex and critical system technology. Appropriate security strategy must be based on the real needs of the government, guided by design principles, and establish a comprehensive and dynamic security system with technical management measures to truly protect government information security and maximize government efficiency. In this environment, we get the following conclusions: (1) In the performance test of different RF algorithms, the accuracy of the traditional RF algorithm is 83.4%, the security is 79.3%, and the correlation is 84.9%. In the data, we conclude that the high-dimensional clustering RF algorithm is the best in the performance test of different RF algorithms. (2) The security awareness and cognition of users also account for 6%, which shows that the security awareness of many users in government departments is not perfect, and the main reason for network intrusion in government departments is the intrusion of intruders and malicious code.

Proposed algorithm base optimisation plan for feature selection-based intrusion detection in cloud computing

<span>A crucial element in detecting unusual network system behavior is the network intrusion detection system (NIDS), which also helps to stop network attacks from happening. Despite the fact that a great deal of machine learning techniques has been used in intrusion detection, current solutions still struggle to provide accurate classification results. Furthermore, when dealing with imbalanced multi-category traffic data, a single classifier may not be able to produce a superior. Particularly, internet of things (IoT) gadgets is now a commonplace aspect of life. On the other hand, some problems are becoming worse and lack clear remedies. Convergence, communication speed, and security between various IoT devices are among the primary concerns. In order to achieve this goal, an enhanced artificial bee colony technique utilizing binary search equations and neural networks—known as the (BABCN) algorithm for intrusion detection in terms of convergence and communication speed—is presented in this study. The artificial bee is improved by the depth-first search framework and binary search equations upon which the BABCN method is based. The suggested approach has a good ability to detect intrusions in the network and enhances categorization, according to the findings obtained by using the NSL-KDD dataset.</span>

Hybrid wrapper feature selection method based on genetic algorithm and extreme learning machine for intrusion detection

Intrusion detection systems play a critical role in the mitigation of cyber-attacks on the Internet of Things (IoT) environment. Due to the integration of many devices within the IoT environment, a huge amount of data is generated. The generated data sets in most cases consist of irrelevant and redundant features that affect the performance of the existing intrusion detection systems (IDS). The selection of optimal features plays a critical role in the enhancement of intrusion detection systems. This study proposes a sequential feature selection approach using an optimized extreme learning machine (ELM) with an SVM (support vector machine) classifier. The main challenge of ELM is the selection of the input parameters, which affect its performance. In this study, the genetic algorithm (GA) is used to optimize the weights of ELM to boost its performance. After the optimization, the algorithm is applied as an estimator in the sequential forward selection (wrapper technique) to select key features. The final obtained feature subset is applied for classification using SVM. The IoT_ToN network and UNSWNB15 datasets were used to test the model's performance. The performance of the model was compared with other existing state-of-the-art classifiers such as k-nearest neighbors, gradient boosting, random forest, and decision tree. The model had the best quality of the selected feature subset. The results indicate that the proposed model had a better intrusion detection performance with 99%, and 86% accuracy for IoT_ToN network dataset and UNSWNB15 datasets, respectively. The model can be used as a promising tool for enhancing the classification performance of IDS datasets.

Q-Learning Based MEP Search Algorithm and Coverage Enhancement Strategy in IoT-Enabled Intrusion Detection

Q-Learning Based MEP Search Algorithm and Coverage Enhancement Strategy in IoT-Enabled Intrusion Detection

IMPROVING DETECTION FOR INTRUSION USING DEEP LSTM WITH HYBRID FEATURE SELECTION METHOD

Due to the importance of the intrusion detection system, which is considered supportive of enhancing network security. Therefore, we seek to increase the efficiency of intrusion detection systems through the use of deep learning mechanisms. However, intrusion detection algorithms still suffer from problems in the process of classification and determining the presence and type of attack, which causes a decrease in the detection rate, an increase in the number of false alarms, and reduces system performance. This is due to a large number of redundant features that are not relevant to the dataset. To find the  solve for this problem, here propose a hybrid algorithm based on the use of the feature selection technique, which helps in reaching the goal optimally by choosing the best and most important features. And it works by integrating three ways to minimize the features by deleting the static features, that do not have much value from the information gain and is done before the training stage by the deep learning model of LSTM as  preprocessing for the CSE-CIC-IDS data set, which helps in improving the performance of the system By minimizing the time for processing and increasing the detection rate and accuracy ratio. The results of the experiment showed a high accuracy of 99.84%.

Feature-Weighted Naive Bayesian Classifier for Wireless Network Intrusion Detection

Objective. Wireless sensor networks, crucial for various applications, face growing security challenges due to the escalating complexity and diversity of attack behaviours. This paper presents an advanced intrusion detection algorithm, leveraging feature-weighted Naive Bayes (NB), to enhance network attack detection accuracy. Methodology. Initially, a feature weighting algorithm is introduced to assign context-based weights to different feature terms. Subsequently, the NB algorithm is enhanced by incorporating Jensen–Shannon (JS) divergence, feature weighting, and inverse category frequency (ICF). Eventually, the improved NB algorithm is integrated into the intrusion detection model, and network event classification results are derived through a series of data processing steps applied to corresponding network traffic data. Results. The effectiveness of the proposed intrusion detection algorithm is evaluated through a comprehensive comparative analysis using the NSL-KDD dataset. Results demonstrate a significant enhancement in the detection accuracy of various attack types, including normal, denial of service (DoS), probe, remote-to-local (R2L), and user-to-root (U2R). Moreover, the proposed algorithm exhibits a lower false alarm rate compared to other algorithms. Conclusion. This paper introduces a wireless network intrusion algorithm that not only ensures improved detection accuracy and rate but also reduces the incidence of false detections. Addressing the evolving threat landscape faced by wireless sensor networks, this contribution represents a valuable advancement in intrusion detection technology.

A Transformer-based network intrusion detection approach for cloud security

AbstractThe distributed architecture of cloud computing necessitates robust defense mechanisms to secure network-accessible resources against a diverse and dynamic threat landscape. A Network Intrusion Detection System (NIDS) is pivotal in this context, with its efficacy in cloud environments hinging on its adaptability to evolving threat vectors while mitigating false positives. In this paper, we present a novel NIDS algorithm, anchored in the Transformer model and finely tailored for cloud environments. Our algorithm melds the fundamental aspects of network intrusion detection with the sophisticated attention mechanism inherent to the Transformer model, facilitating a more insightful examination of the relationships between input features and diverse intrusion types, thereby bolstering detection accuracy. We provide a detailed design of our approach and have conducted a thorough comparative evaluation. Our experimental results demonstrate that the accuracy of our model is over 93%, which is comparable to that of the CNN-LSTM model, underscoring the effectiveness and viability of our Transformer-based intrusion detection algorithm in bolstering cloud security.

An Improved Algorithm for Network Intrusion Detection Based on Deep Residual Networks

An Improved Algorithm for Network Intrusion Detection Based on Deep Residual Networks

Assessing the Effectiveness of Machine Learning Algorithms for Intrusion Detection

Assessing the Effectiveness of Machine Learning Algorithms for Intrusion Detection

A novel approach to intrusion detection using zero-shot learning hybrid partial labels

Computer networks have become the backbone of our interconnected world in today's technologically driven landscape. Unauthorized access or malicious activity carried out by threat actors to acquire control of network resources, exploit vulnerabilities, or undermine system integrity are examples of network intrusion. ZSL(Zero-Shot Learning) is a machine learning paradigm that addresses the problem of detecting and categorizing objects or concepts that were not present in the training data. . Traditional supervised learning algorithms for intrusion detection frequently struggle with insufficient labeled data and may struggle to adapt to unexpected assault patterns. In this article We have proposed a unique zero-shot learning hybrid partial label model suited to a large image-based network intrusion dataset to overcome these difficulties. The core contribution of this study is the creation and successful implementation of a novel zero-shot learning hybrid partial label model for network intrusion detection, which has a remarkable accuracy of 99.12%. The suggested system lays the groundwork for future study into other feature selection techniques and the performance of other machine learning classifiers on larger datasets. Such research can advance the state-of-the-art in intrusion detection and improve our ability to detect and prevent the network attacks. We hope that our research will spur additional research and innovation in this critical area of cybersecurity.