Intrusion Detection Algorithm Research Articles

Mechanisms for Securing Autonomous Shipping Services and Machine Learning Algorithms for Misbehaviour Detection

Technological developments within the maritime sector are resulting in rapid progress that will see the commercial use of autonomous vessels, known as Maritime Autonomous Surface Ships (MASSs). Such ships are equipped with a range of advanced technologies, such as IoT devices, artificial intelligence (AI) systems, machine learning (ML)-based algorithms, and augmented reality (AR) tools. Through such technologies, the autonomous vessels can be remotely controlled from Shore Control Centres (SCCs) by using real-time data to optimise their operations, enhance safety, and reduce the possibility of human error. Apart from the regulatory aspects, which are under definition by the International Maritime Organisation (IMO), cybersecurity vulnerabilities must be considered and properly addressed to prevent such complex systems from being tampered with. This paper proposes an approach that operates on two different levels to address cybersecurity. On one side, our solution is intended to secure communication channels between the SCCs and the vessels using Secure Exchange and COMmunication (SECOM) standard; on the other side, it aims to secure the underlying digital infrastructure in charge of data collection, storage and processing by relying on a set of machine learning (ML) algorithms for anomaly and intrusion detection. The proposed approach is validated against a real implementation of the SCC deployed in the Livorno seaport premises. Finally, the experimental results and the performance evaluation are provided to assess its effectiveness accordingly.

Network Data Intrusion Detection and Data Feature Extraction of Electromechanical Facilities from Machine Learning

With the rapid development of Internet technology, network security issues have become more complex and changeable. Various intrusion methods threaten the information network environment in the Electromechanical Facility (EF) system. This paper focuses on EF to study the relevant detection methods and data feature extraction in complex network intrusions. Firstly, four common machine learning algorithms are used to calculate the data set. The advantages and disadvantages of each algorithm are analyzed after tuning and comparison. Secondly, a network intrusion detection algorithm is proposed based on Recursive Feature Elimination (RFE) principal component analysis. It uses RFE to reduce the number of features and improve the elimination judgment index to align with the detection requirements of information network datasets. Finally, a fault diagnosis method is proposed based on empirical pattern decomposition and support vector machine under Renyi entropy complexity measurement. This method trains and identifies the Renyi entropy of several basic pattern components obtained by decomposing empirical patterns as feature vectors. The results show that the RFE method judged by random forest removes irrelevant features, and the evaluation index is improved to align with the network dataset’s detection requirements. It reduces the data dimension, reduces the operation time, and improves the accuracy of a few attack types. The comprehensive final detection effect is better than other algorithms. Additionally, the embedded operating system construction method based on the protection mechanism realizes the separate storage of the operating system and key data. Also, it can prevent the network system from being maliciously invaded, ensuring the stability of the instrument operation under harsh working conditions.

A lightweight intrusion detection algorithm for IoT based on data purification and a separable convolution improved CNN

With the rapid development of the IoT (Internet of Things), the network data present the characteristics of large volume and high dimension. Convolutional neural networks (CNNs) have become one of the most important intrusion detection methods due to their advantages in processing high-dimensional data. The conventional intrusion detection model based on CNN lacks an effective data purification means in the process of converting unstructured data into image data, and too many parameters are generated due to the complex structure of the model in the training process, leading to the problems of high time complexity and low detection rate of the model, which limits the application of the CNN in intrusion detection of the IoT. First, based on the principle of liquid molecular distillation, a data purification algorithm (DPA) for unstructured data is proposed in this paper, which reduces the "redundant" data generated in the process of converting unstructured data to image data. Second, based on the rigid-motion convolution principle of a separable wavelet, separable convolution is used to improve the CNN structure, and then a lightweight detection algorithm LSCNN (lightweight CNN based on separable convolution) is developed to reduce the number of parameters in the network structure and improve the time efficiency and accuracy of the algorithm. The experimental results on real intrusion detection datasets show that the LSCNN trained on DPA purified data has higher time efficiency and detection accuracy than the conventional CNN, and compared with the conventional machine learning algorithm, it has higher accuracy.

Evaluating the cost of classifier discrimination choices for IoT sensor attack detection

The intrusion detection of IoT devices through the classification of malicious traffic packets have become more complex and resource intensive as algorithm design and the scope of the problems have changed. In this research, we compare the cost of a traditional supervised pattern recognition algorithm (k-Nearest Neighbor (KNN)), with the cost of a current deep learning (DL) unsupervised algorithm (Convolutional Neural Network (CNN)) in their simplest forms. The classifier costs are calculated based on the attributes of design, computation, scope, training, use, and retirement. We find that the DL algorithm is applicable to a wider range of problem-solving tasks, but it costs more to implement and operate than a traditional classifier. This research proposes an economic classifier model for deploying suitable AI-based intrusion detection classifiers in IoT environments. The model was empirically validated on the IoT-23 dataset using KNN and CNN. This study closes a gap in prior research that mostly concentrated on technical elements by incorporating economic factors into the evaluation of AI algorithms for IoT intrusion detection. This research thus evaluated the economic implications of deploying AI-based intrusion detection systems in IoT environments, considering performance metrics, implementation costs, and the cost of classifier discrimination choices. Researchers and practitioners should focus on the cost–benefit trade-offs of any artificial intelligence application for intrusion detection, recommending an economic evaluation and task fit assessment before adopting automated solutions or classifiers for IoT intrusion detection, particularly in large-scale industrial settings that involve active attacks.

ALRN-RCS: Advanced Approach to Network Intrusion Detection Using Attention Long-Term Recurrent Networks and Chaotic Optimization

Detecting intrusions within a network is essential for protecting digital environments; it encompasses the observation and analysis of network traffic to recognize and counteract unauthorized or malicious activities. Conventional methods in network intrusion detection face several challenges such as polymorphic and evasive attacks, scalability issues, and anomaly-based complexity. To address these complexities, this paper proposed a novel method named Attention Long-term Recurrent Network-based Random Chaotic Sine (ALRN-RCS) algorithm for network intrusion detection. In this study, Long Short-Term Memory (LSTM) is utilized to capture complex patterns in network traffic and identify anomalous activities. Also, the attention-based Recurrent Neural Network (RNN) is employed to focus on relevant features within network traffic and enable precise intrusion detection. In this paper, we have incorporated the Chaotic Chimp Sine Cosine optimization algorithm, employing a random update strategy, to optimize hyperparameters and improve the overall efficacy of the proposed approach and the study conducted experiments on the datasets namely the UNSW NB-15, Network Intrusion Detection dataset, and the Segmented Image-based Network Intrusion Detection (SIDD) dataset. Diverse assessment criteria, including accuracy, F1-score, recall, AUC-ROC, and precision, are employed to assess the effectiveness of the ALRN-RCS method and to draw comparisons with established methodologies. The experimental results depict the effectiveness of the ALRN-RCS method for addressing the dynamic and sophisticated nature of modern cyber threats.

Retraction Note: Research on campus network security protection system framework based on cloud data and intrusion detection algorithm

Retraction Note: Research on campus network security protection system framework based on cloud data and intrusion detection algorithm

Evaluating intrusion detection for microservice applications: Benchmark, dataset, and case studies

Microservices are predominant for cloud-based applications, which serve millions of customers daily, that commonly run business-critical systems on software containers and multi-tenant environments; so, it is of utmost importance to secure these systems. Intrusion detection is a widely applied technique that is now being used in microservices to build behavior detection models and report possible attacks during runtime. However, it is cumbersome to evaluate and compare the effectiveness of different approaches. Standardized frameworks are non-existent and without fairly comparing new techniques to the state-of-the-art, it is difficult to understand their pros and cons. This paper presents a comprehensive approach to evaluate and compare different intrusion detection approaches for microservice applications. A benchmarking methodology is proposed to allow users to standardize the process for a representative and reproducible evaluation. We also present a dataset that applies representative workloads and technologies based on microservice applications state-of-the-art. The benchmark and dataset are used in three case studies, characterized by dynamicity, scalability, and continuous delivery, to evaluate and compare state-of-the-art algorithms with the objective of tackling intrusion detection in microservices. Experiments show the usefulness and wide application range of the benchmark while showing the capacity of intrusion detection algorithms in different applications and deployments.

Intelligent Advanced Attack Detection Technology based on Multi-modal Data Fusion

This paper proposes an adaptive Wedman intrusion detection algorithm (AID-DFS) for data fusion. Firstly, feature extraction of abnormal text detection is carried out using a BI-gated loop (Bi-GRU). Multi-branch convolutional recurrent neural network (CNN-RNN) extracts hierarchical features from abnormal images. The multi-mode dynamic fusion uses the intermodal and intramodal attention mechanisms. In this way, a joint representation of multiple modes is obtained. The visual perception mechanism is used to realize multichannel integration and strengthen the function of original information in multichannel. The experimental results show that the proposed method has 99.6% accuracy and 94.9% accuracy. Compared with other algorithms, the proposed method can improve the performance of the intrusion system by about 10.2%.

E-commerce consumer privacy protection and immersive business experience simulation based on intrusion detection algorithms

In the process of e-commerce shopping, immersive service experiences and entertainment shopping models are increasingly popular among consumers. This article analyzes the privacy protection and immersive business experience simulation of e-commerce consumers based on intrusion detection algorithms.After studying intrusion detection algorithms, this article delves into personal privacy protection models related to public network e-commerce consumption. This article first explores the significance and current status of intrusion detection algorithms, as well as the research status of deep learning in this field, and conducts comparative experiments on improved intrusion detection algorithms. Then, after analyzing the requirements of the evaluation support system for privacy protection algorithms, the overall framework of the personal privacy protection system was designed and studied. Intrusion detection algorithm identifies possible privacy threats by monitoring and analyzing user behavior data, and then proposes an immersive business experience simulation framework, which includes virtual reality technology and personalized recommendation system, enabling users to immerse themselves in the virtual environment of e-commerce platform and enjoy personalized shopping experience. Interactive experiences can provide e-commerce consumers with more shopping pleasure, and at the same time, businesses need to ensure that consumer privacy is effectively protected during the consumption process. In the end, a new personal privacy protection model was successfully constructed, which verified the great advantages of the algorithm in terms of running time, and concluded that using intrusion detection algorithms can greatly protect the personal privacy of e-commerce consumers using public networks.

Optimizing a Feature Selection Intrusion Detection Algorithm with Data Mining

Intrusion detection safeguards computer systems against unauthorized access and malicious activities. Feature selection plays a pivotal role in enhancing the efficiency and effectiveness of intrusion detection algorithms by identifying the most relevant features from vast datasets. In this study, we propose a novel approach to optimize feature selection in intrusion detection algorithms using data mining techniques. We explore various data mining algorithms, including decision trees, genetic algorithms, and particle swarm optimization, to identify the optimal feature subset that maximizes detection accuracy while minimizing computational overhead. Experimental results demonstrate our approach’s efficacy in improving intrusion detection systems’ performance across different datasets, achieving higher detection rates with reduced computational complexity. Our work advances state-of-the-art intrusion detection by leveraging data mining for efficient feature selection.

ESVI-GaMM: A fast network intrusion detection approach based on the Bayesian gamma mixture model

As the application of networks permeates various aspects of daily life, maintaining network security has become a crucial challenge. A network intrusion detection system (NIDS) functions as a critical technique for securing cyberspace and has gained considerable attention. Although researchers have made significant progress in developing NIDSs, challenges still exist in high-speed networks with overwhelming network traffic. Existing methods largely focus on improving model detection accuracy and often overlook speed and computational efficiency. This oversight renders most current methods impractical for real-world high-speed network scenarios. To address this issue, we propose an innovative and efficient network intrusion detection algorithm, namely, the Bayesian gamma mixture model (GaMM) classifier. With the recently proposed extended stochastic variational inference (ESVI) framework, we introduce lower-bound approximations to the evidence lower bound (ELBO), namely, the original variational object function. An analytically tractable Bayesian estimation algorithm for a GaMM is derived through stochastic optimization of the obtained lower bound and we validate its performance and computational efficiency on three publicly available datasets (CICMalmem2022, OPCUA, and CICIDS2018). The experimental results indicate that the proposed classifier not only achieves a detection performance comparable to that of other benchmark models but also significantly reduces both the training and detection times.

An Intrusion Detection Model Based on Extra Trees Algorithm with Dimensionality Reduction and Oversampling

With the advancement of the university information process, more and more application systems are running on the campus network, and the information system becomes larger and more complex. With the rapid growth of network users and the popularization and deepening of computer knowledge, the campus network has been transformed from an experimental network for education and scientific research into an operational network that attaches equal importance to education, scientific research, and service. As the most important transmission carrier of digital information, how to ensure its security has become an urgent issue for colleges and universities. Therefore, this paper uses advanced intrusion detection technology to design the corresponding model to solve the security problem of the campus network. When traditional machine learning algorithms train network intrusion data sets, they are prone to problems such as too many feature dimensions, overfitting, and imbalance of data sets, which lead to lower accuracy and low time efficiency of intrusion detection algorithms. In order to solve the above problems, this paper proposes an intrusion detection model based on Extra Trees, which uses linear discriminant analysis to reduce the dimension of data, then uses oversampling to reduce the influence of imbalance of sample categories of the network intrusion dataset, and finally uses Extra Trees algorithm to train the model. The experimental results show that after LDA reduction and oversampling, using the Extra Trees classification model can improve the overall recognition performance of imbalanced data sets under multi-classification and satisfy the network intrusion detection.

Smart Irrigation with Intrusion Detection

This paper proposes a comprehensive approach to smart irrigation by integrating intrusion detection mechanisms. By combining the functionalities of smart irrigation systems with intrusion detection systems (IDS), the proposed framework offers enhanced security and reliability in agricultural water management. The system employs a network of sensors weather, and soil moisture levels patterns, and other relevant parameters to optimize irrigation scheduling. Concurrently, it utilizes intrusion detection algorithms to identify and respond to unauthorized access attempts or anomalous behaviors within the irrigation infrastructure. The proposed approach represents a noteworthy advancement in the direction of sustainable and secure management of water in agriculture, contributing to improved crop yields, resource conservation, and overall perseverance in the face of emerging challenges. Additionally, by incorporating machine learning algorithms into the intrusion detection system, the framework is able to change and grow over time, enhancing its capacity to identify and neutralize possible threats. Furthermore, the system can more accurately predict when irrigation is needed by utilizing real-time data analysis and predictive modeling approaches. This maximizes water usage efficiency while reducing waste. This all-encompassing strategy encourages a more ecologically sustainable method of managing water resources while also strengthening the resilience of farming operations. Furthermore, the framework enables farmers to take educated decisions in real-time, maximizing productivity and lowering risks, by giving them actionable insights and alerts about security breaches and irrigation needs.

An efficient intrusion detection technique for traffic pattern learning

Efficient intrusion detection algorithms are required for network traffic learning patterns in order to protect advanced network communication channels. These systems can be used to detect normal and unusual patterns, signatures, and rule violations. In recent years, conventional and deep machine learning algorithms have been utilized in the field of network intrusion detection for network traffic learning systems. The use of machine learning opens up new attack surfaces that are very intriguing to investigate. Attackers can introduce noisy data into training data to influence testing patterns in computer networks. The goal of this work is to create an efficient intrusion detection solution for network traffic learning patterns using a supervised and unsupervised technique. We developed an effective intrusion detection system (IDs) using an appropriate NSLKDD dataset for network traffic patterns. The model was trained and evaluated using the Genetic Optimization Algorithm (GOA) and the Niave Bayesian technique to recognize usual and unexpected network traffic patterns. We created a strategy that begins with a random population and subsequent iterates through the fitness function, returning the best parents with high detection accuracy. The best parents were determined using the n-parameters iterated by the crossover and mutation procedures. A cross over function was created to combine genes from two fitness parents by randomly selecting portions from each parent. The individual components of the crossover offsprings are randomly flipped to achieve the mutation. The fitness of the previous generation was obtained to generate a new generation, and this process was repeated n times. This was created to detect network intrusions using Nave Bayes' binary categorization problem and evolutionary algorithms. We accomplished this task by aggregating noise into training set before broadcasting the average number, and it is critical not to have that public average too frequently. The experimental results reveal that our proposed GA fared better than the NB technique, with a detection accuracy of 95.0% versus a recommendable detection accuracy of 53.0%.

Research on Virus Propagation Network Intrusion Detection Based on Graph Neural Network

The field of network security is highly concerned with intrusion detection, which safeguards the security of computer networks. The invention and application of intrusion detection technology play indispensable roles in network security, and it is crucial to investigate and comprehend this topic. Recently, with the continuous occurrence of intrusion incidents in virus propagation networks, traditional network detection algorithms for virus propagation have encountered limitations and have struggled to detect these incidents effectively and accurately. Therefore, updating the intrusion detection algorithm of the virus-spreading network is imperative. This paper introduces a novel system for virus propagation, whose core is a graph-based neural network. By organically combining two modules—a standardization module and a computation module—this system forms a powerful GNN model. The standardization module uses two methods, while the calculation module uses three methods. Through permutation and combination, we obtain six GNN models with different characteristics. To verify their performance, we conducted experiments on the selected datasets. The experimental results show that the proposed algorithm has excellent capabilities, high accuracy, reasonable complexity, and excellent stability in the intrusion detection of virus-spreading networks, making the network more secure and reliable.

An adversarial environment reinforcement learning-driven intrusion detection algorithm for Internet of Things

The increasing prevalence of Internet of Things (IoT) systems has made them attractive targets for malicious actors. To address the evolving threats and the growing complexity of detection, there is a critical need to search for and develop new algorithms that are fast and robust in detecting and classifying dangerous network traffic. In this context, deep reinforcement learning (DRL) is gaining recognition as a prospective solution in numerous fields as it enables autonomous agents to cooperate with their environment for decision-making without relying on human experts. This article presents an innovative approach to intrusion detection in IoT systems using an adversarial reinforcement learning (RL) algorithm known for its exceptional predictive capabilities. The predictive process relies on a classifier, implemented as a streamlined and highly efficient neural network. Embedded within this classifier is a policy function meticulously trained using an innovative RL model. Importantly, this model ensures that the environment’s behavior is dynamically fine-tuned simultaneously with the learning process, improving the overall effectiveness of the intrusion detection approach. The efficiency of our proposal was assessed using the Bot-IoT database, consisting of a mixture of legitimate IoT network traffic and simulated attack scenarios. Our scheme shows superior performance compared to existing ones. Therefore, our approach to IoT intrusion detection can be considered a valuable alternative to existing methods, capable of significantly improving the IoT systems’ security.

SecureNet: Network Intrusion Detection using Machine Learning and Deep Learning Techniques

Abstract: In the ever-evolving landscape of cybersecurity, the need for robust intrusion detection systems has become paramount. This paper introduces a cutting-edge intrusion detection algorithm designed to enhance network security through the integration of advanced machine learning and deep learning methodologies. The proposed algorithm capitalizes on the strengths of both paradigms to achieve a comprehensive and adaptive approach to identifying malicious activities within a network. This research focuses on enhancing network security through the development and evaluation of a novel intrusion detection system leveraging both deep learning and traditional machine learning approaches. Utilizing the NSL-KDD dataset, we employ the Long Short-Term Memory (LSTM) model, a superior version of Recurrent Neural Networks (RNNs), and the K-Nearest Neighbors (KNN) algorithm for binary and multi-class classification of network intrusion anomalies. The LSTM model excels in capturing temporal dependencies, enabling the detection of nuanced sequential patterns, while the KNN algorithm contributes to a comprehensive classification framework. Experimental results demonstrate the effectiveness of the hybrid methodology, showcasing improved accuracy, precision, and recall compared to traditional methods. This research underscores the potential of integrating deep learning and classical machine learning techniques to bolster the capabilities of intrusion detection systems in safeguarding against evolving cyber threats

An Effective Intrusion Detection System for Edge Computing Using ConvNeXt and ResNet152V2

The proliferation of edge computing, driven by network applications and wireless devices, increases the vulnerability of confidential information to security risks. In this environment, existing intrusion detection algorithms fail to satisfy the requirements of prompt responses, heavy network load management, inadequate extraction of features, and imprecise model classification. In this work, the imbalanced data problem in the input dataset is mitigated using the Data Augmentation Generative Adversarial Network (DAGAN). Next, an efficient ConvNeXt-based feature extraction method is created to retrieve the key characteristics from the dataset for every class. Last, multi-attack intrusion detection is achieved through the deployment of an optimized deep learning classifier based on ResNet152V2. Furthermore, simulation experiments are carried out on the ToN-IoT and BoT-IoT datasets, and the outcomes demonstrate that our suggested model performs better than the existing models, with accuracy levels of 99.20% and 99.31%, respectively. These findings show that this approach is successful in building and refining large-scale IDS in the edge computing framework.

Security intrusion monitoring model for Internet of Things (IoT) using sniffing tools on wireless sensor networks

The Internet of Things (IoT) has revolutionized the way devices interact and share data over wireless sensor networks (WSN), enabling seamless connectivity and automation. However, the proliferation of IoT devices has raised serious security and privacy risks concerns due to their inherent vulnerabilities. This paper proposes a model for security intrusion monitoring by analyzing the existing literature and providing insights into the design, implementation, and effective deployment of the proposed model to detect intrusion in IoT using sniffing tools for network traffic analysis in real-time within WSN. The model passively monitors network traffic and identifies anomalous patterns, unauthorized access attempts, and abnormal device behavior. The review findings highlight the significance of the proposed model in enhancing the security of IoT systems. By detecting anomalous behavior and potential security breaches. The model enables timely response and mitigation actions to ensure the confidentiality, integrity and availability (CIA) of IoT devices data. The model includes consideration of network architecture, deployment of intrusion detection algorithms, and establishment of response mechanisms. It identifies various types of security threats, such as unauthorized access attempts, Denial-of-service, Distributed DoS, Brute-force, Heartbleed, Botnet, Inside Infiltration and device tampering, thereby providing response mechanisms that include generating alerts, isolating compromised devices, or blocking suspicious network traffic. The model incorporates a feedback loop to continuously update the detection mechanisms and adapt to evolving security threats in real-time. Series of experiments and simulations to be conducted using various IoT devices and network scenarios to evaluate model effectiveness. The model to comprise of wireless Router, MatLab for Deep Neural Network (DNN) training, Raspberry Pi, Wireshark setup and an array of Internet of Things (IoT) devices. The researcher to use dataset by extracting intrinsic, host-based and time-based attributes from Wireshark Sniffing tool. The datasets generated shall be piped by tshark to an output text file saved as a csv. Under-sampling technique to be used to address class imbalance of datasets. The model shall then be trained using the dataset to be able to detect intrusion in IoTs. The results is expected to demonstrate the model's ability to detect a wide range of security intrusions with high accuracy and minimal false positives. In conclusion, the model offers a proactive approach to safeguard IoT deployment. By leveraging sniffing tools and advanced analysis techniques, the model enhances the detection and response capabilities, enabling efficient protection against emerging threats in IoT. However, challenges associated with the model are identified, including the complexity of network monitoring and potential privacy concerns.

Intrusion Detection Model for Wireless Sensor Networks Based on FedAvg and XGBoost Algorithm

For the characteristics of channel instability in wireless sensor networks, this paper proposes an intrusion detection algorithm based on FedAvg (federated averaging) and XGBoost (extreme gradient boosting) wireless sensor networks using fog computing architecture. First, the network edge is extended by introducing fog computing nodes to reduce the communication delay. It reduces the transmission bandwidth and privacy leakage risk while improving the accuracy of jointly learned global and local models. Then, the histogram-based approximation calculation method is improved to adapt to the unbalanced data characteristics of wireless sensor networks. Finally, by introducing TOP-K gradient selection, the number of model parameter uploads is minimized, and the efficiency of model parameter interaction is improved. The experimental results show that this algorithm has superior detection performance and low energy consumption. It is also compared with other algorithms to demonstrate the high detection rate and low computational complexity of this algorithm.