Intrusion Detection And Prevention Systems Research Articles

Enhanced honeypot security for intrusion detection and prevention systems using blockchain

The project aims to enhance honeypot security through the integration of blockchain technology into an intrusion detection and prevention system (IDPS). Honeypots are decoy systems deployed to detect, deflect, or study unauthorized use of information systems. By leveraging blockchain, a decentralized and tamper-proof ledger, the project ensures the integrity and immutability of honeypot data, providing robust security against cyber threats.The system employs a blockchain-based architecture where each honeypot event is recorded as a block in the chain, ensuring the integrity of the data. Additionally, smart contracts are utilized to automatically execute predefined actions based on specific conditions detected by the honeypot system, such as blocking IP addresses upon detecting malicious activities. Furthermore, the system facilitates the sharing of threat intelligence among peers in real-time, enhancing collaborative security efforts. Through the integration of blockchain technology, smart contracts, and threat intelligence sharing, the project offers an innovative approach to honeypot security, providing organizations with a more resilient defense against cyber threats.

Next-Generation Threat Detection and Mitigation in 6G Wireless Networks Using IAM, ZTNA and Advanced Security Mechanisms

As the deployment of 6G wireless networks looms on the horizon, the imperative to fortify their security infrastructure becomes increasingly pressing. One way to achieve this is through Identity and Access Management (IAM) frameworks to implement strong authentication and authorization mechanisms. Zero Trust Network Access (ZTNA) architectures advocate for a shift towards continuous verification and least-privileged access principles. Secure network segmentation and behavior anomaly detection systems limit the scope of potential breaches. Intrusion Detection and Prevention Systems (IDPS) detect and block cyber threats. These advanced security mechanisms improve the resilience of 6G networks and ensure the integrity, confidentiality, and availability of critical network assets. IAM protocols exhibit fast user authentication speeds with average authentication time of 0.5 seconds. ZTNA frameworks ensure high network security with a 98% detection rate of abnormal network behaviors

Next-Generation Threat Detection and Mitigation in 6G Wireless Networks Using IAM, ZTNA and Advanced Security Mechanisms

As the deployment of 6G wireless networks looms on the horizon, the imperative to fortify their security infrastructure becomes increasingly pressing. One way to achieve this is through Identity and Access Management (IAM) frameworks to implement strong authentication and authorization mechanisms. Zero Trust Network Access (ZTNA) architectures advocate for a shift towards continuous verification and least-privileged access principles. Secure network segmentation and behavior anomaly detection systems limit the scope of potential breaches. Intrusion Detection and Prevention Systems (IDPS) detect and block cyber threats. These advanced security mechanisms improve the resilience of 6G networks and ensure the integrity, confidentiality, and availability of critical network assets. IAM protocols exhibit fast user authentication speeds with average authentication time of 0.5 seconds. ZTNA frameworks ensure high network security with a 98% detection rate of abnormal network behaviors.

PORTABLE INTRUSION DETECTION AND PREVENTION SYSTEM FOR DHCP STARVATION ATTACK IN WIRELESS NETWORK

The DHCP service has become highly critical as it plays a pivotal role in the connectivity success of approximately 22.18% of users who access the internet through wireless networks in Indonesia. DHCP services are not exempt from security threats, one of which is a Denial of Service attack known as DHCP starvation, capable of disrupting the availability of DHCP services. A novel technique employed in this attack involves manipulating the ARP protocol when the DHCP server detects IP conflicts within the network. Researchers propose an ARP protocol-based analysis method for detection and prevention, leading to the development of a portable device that serves as an Intrusion Detection and Prevention System (IDPS). This approach aims to not only enhance effectiveness but also improve efficiency. The IDPS application is crafted using the Python, with support from Scapy and Paramiko libraries. The results of detection and prevention show an accuracy rate of 100%.

Mitigating DDoS attacks with an intrusion detection and prevention system based on 2-player Bayesian game theory

Distributed Denial of Service (DDoS) attacks are very dangerous to the availability and security of networks, so they need improved ways to be stopped. This article suggests a new way to fight DDoS attacks that uses Intrusion Detection and Prevention Systems (IDPS) and 2-Player Bayesian Game Theory. Traditional IDPSs often have trouble responding quickly to changing attack tactics, which makes them less effective as defenses. The suggested structure, on the other hand, imagines the attacker and defense interacting as a Bayesian game. This lets them make proactive choices and come up with flexible ways to respond.The system uses Bayesian reasoning to describe the attacker’s actions and plans’ doubt, which lets it better assess the threat and decide how to respond. By constantly changing probability distributions based on what it sees attackers doing and what it sees defenders doing, the IDPS can quickly and effectively change its defenses to deal with new threats. The strategy contact between the attacker and the defense adds a competition factor that makes attackers less likely to start DDoS attacks by making them more expensive and risky. The proposed method works to stop different kinds of DDoS attacks while reducing the number of fake positives and negatives through a lot of simulations and experiments.

F-TLBO-ID: Fuzzy fed teaching learning based optimisation algorithm to predict the number of [formula omitted]-barriers for intrusion detection

Ensuring fast and efficient Intrusion Detection and Prevention (IDP) at international borders is crucial for maintaining security and safeguarding nations. In this study, we propose an innovative approach that harnesses the power of machine learning and Wireless Sensor Networks (WSNs) to achieve faster and more accurate IDP. Our novel Fuzzy fed Teaching Learning Based Optimisation regression algorithm (F-TLBO-ID) revolutionises the prediction of the required number of k-barriers for rapid IDP. To develop and validate our approach, we synthetically generated pertinent features using Monte-Carlo simulations. These features encompass essential parameters such as the concerned region’s area, effective transmission range, effective sensing range, number of sensor nodes, and the fading parameter. Training the F-TLBO-ID algorithm with these features yielded exceptional results, accurately predicting the required number of k-barriers with an impressive correlation coefficient (R = 0.99), minimal Root Mean Square Error (RMSE = 11.32), and negligible bias (−3.66). To benchmark the performance of our F-TLBO-ID algorithm, we conducted comprehensive comparisons with fine-tuned benchmark algorithms, including AutoML, GPR, GRNN, RF, RNN, SVM, and ANN. Additionally, we evaluated the algorithm against 11 different variants of nature-inspired algorithms. Remarkably, our F-TLBO-ID algorithm outperformed all these methods in terms of accuracy, firmly establishing its superiority. Finally, we validated the performance of the F-TLBO-ID algorithm using publicly available datasets. The results were highly satisfactory, exhibiting a strong correlation coefficient (R = 0.84), acceptable RMSE (36.24), and minimal bias (−7.17). This study offers a robust and reliable algorithm to predict the required barriers for fast IDP, surpassing the accuracy of existing benchmark algorithms. By implementing our proposed algorithm, the efficiency of IDP systems at international borders can be significantly improved, ultimately enhancing security and facilitating smooth border operations.

Security Methods to Improve Quality of Service

INTRODUCTION: Security and Quality of Service (QoS) are two of the most critical aspects of communication networks. Security measures are implemented to protect the network from unauthorized access and malicious attacks, whereas QoS measures are implemented to ensure that the network is reliable, efficient, and can meet the demands of users. 
 OBJECTIVES: This paper examines various methods of network security and their impact on the quality of service (QoS) in computer networks. The study analyses different types of network attacks, such as denial of service (DoS), distributed denial of service (DDoS), and intrusion attempts, and their impact on QoS. The paper also explores various security mechanisms, such as intrusion detection and prevention systems (IDPS), firewalls, virtual private networks (VPNs), and techniques for encryption, that can help mitigate network security threats while maintaining QoS.METHODS: The study evaluates the strengths and weaknesses of the security mechanisms in terms of their ability to provide protection against network attacks while minimizing the impact on QoS. 
 RESULTS: The paper provides recommendations for organizations to enhance their network security posture while improving the QoS, such as implementing robust network security policies, investing in advanced security tools, and training employees to recognize and respond to network security incidents.
 CONCLUSION: This paper offers a comprehensive analysis of network security methods and their impact on QoS, providing insights and recommendations for organizations to improve their network security posture and maintain a high level of QoS.hese are the conclusions of this paper.

An Efficient Intrusion Detection and Prevention System for DDOS Attack in WSN Using SS-LSACNN and TCSLR

Sensor Nodes (SNs) are utilized by Wireless Sensor Networks (WSNs) to recognize their environment; in addition, the WSN delivers data from sensing nodes to the sink. The WSNs are exposed to several security threats owing to the broadcast performance of transmission along with the increase in the growth of application regions. Countermeasures like Intrusion Detection and Prevention Systems (IDPS) should be adopted to overcome the aforementioned attacks. By implementing these systems, several intrusions can be detected in WSN; also, WSN can be prevented from various security attacks. Therefore, identifying the general attack that influences the SNs mentioned as Distributed Denial of Service (DDoS) attack and recuperating the data utilizing Soft Swish (SS)-Linear Scaling-centered Adam Convolution Neural Network (SS-LSACNN) along with Two’s Compliment Shift Reverse (TCSLR) operation are the intentions of this work. Firstly, for extracting the vital features, the data gathered as of the dataset are utilized. After that, the extracted features are pre-processed. It is then utilized for attack detection. The null features and the redundant data are removed in preprocessing. By employing the Correlation Coefficient-centered Synthetic Minority Oversampling Technique (CC-SMOTE) methodology, data separation regarding classes and data balancing was performed to prevent the imbalance issue. Subsequently, to provide the preprocessed data for attack detection, the Numeralization and feature scaling are executed. After that, by utilizing Chebyshev Distance (CD)-centric K-Means Algorithm (KMA), the real-time SNs are initialized as well as clustered. The data gathered as of the SNs are utilized for attack detection following the clustering phase. Following the detection phase, the data being attacked are amassed in the log file; similarly, the non-attacked data are inputted into the prevention phase. Next, the experiential analysis is carried out for examining the proposed system’s efficacy. The outcomes revealed that the proposed model exhibits 98.15% accuracy, 97.59% sensitivity, 95.72% specificity, and 95.48% F-measure, which displays the proposed model’s efficacy.

Feature selection using bio-inspired optimization for IoT intrusion detection and prevention system

Nowadays smart Internet of Things (IoT) devices are used briskly, and these devices communicate with each other via wireless medium. However, this increase in IoT devices has resulted in a rise of security issues associated with the IoT system. Therefore, an intrusion detection and prevention system (IDPS) is used to locate and report any malicious activity. The IDPS's feature selection (FS) task is necessary to improve the data quality and decrease the data used for classifying intrusive traffic. Therefore, this paper proposes a novel FS method that hybridizes improved salp swarm algorithm and harris hawk optimization algorithm. The XGBoost classifier is used for classifying reduced network traffic. Proposed system demonstrates high accuracy and low computation time, surpassing other related approaches used for the IDPS feature selection task.

INTRUSION DETECTION AND PREVENTION SYSTEM IN SME'S LOCAL NETWORK BY USING SURICATA

In the present era, Cybercriminals are increasingly focusing their attention on the local networks of SMEs. Due to the lack of resources and skilled workers in the cybersecurity field., SMEs struggle to prevent and detect fraudulent activities within their networks. To address this challenge, an Intrusion Detection and Prevention System (IDPS) is crucial for optimising network security in SMEs. This research paper explores the implementation of Suricata, an IDS/IPS tool, on a Raspberry Pi 2B embedded platform to create an effective IDPS for SMEs' the study demonstrates the viability of Suricata on low-budget IoT networks with low data traffic. Previous research has shown that Suricata outperforms other systems such as Snort in terms of accuracy and packet loss rate when running on multi-core configurations. The proposed solution offers real-time intrusion detection and prevention capabilities, protecting small business networks from unauthorised access and providing users with timely notifications of network attacks. With Suricata running on OPNsense, SMEs can enhance their network security and safeguard their valuable assets against intrusions.

An Efficient Security Model for Industrial Internet of Things (IIoT) System Based on Machine Learning Principles

This paper presents a security paradigm for edge devices to defend against various internal and external threats. The first section of the manuscript proposes employing machine learning models to identify MQTT-based (Message Queue Telemetry Transport) attacks using the Intrusion Detection and Prevention System (IDPS) for edge nodes. Because the Machine Learning (ML) model cannot be trained directly on low-performance platforms (such as edge devices),a new methodology for updating ML models is proposed to provide a tradeoff between the model performance and the computational complexity. The proposed methodology involves training the model on a high-performance computing platform and then installing the trained model as a detection engine on low-performance platforms (such as the edge node of the edge layer) to identify new attacks. Multiple security techniques have been employed in the second half of the manuscript to verify that the exchanged trained model and the exchanged data files are valid and undiscoverable (information authenticity and privacy) and that the source (such as a fog node or edge device) is indeed what it it claimed to be (source authentication and message integrity). Finally, the proposed security paradigm is found to be effective against various internal and external threats and can be applied to a low-cost single-board computer (SBC).

A Hybrid Multistage DNN-Based Collaborative IDPS for High-Risk Smart Factory Networks

New industrial control systems (ICSs) that have been modernized with the industrial internet of things (IIoT) are exposed to cyber-attacks that exploit IIoT vulnerabilities. Numerous intrusion detection systems (IDSs) have therefore been proposed to secure ICSs, many of which are based on machine learning, specifically deep neural networks (DNNs). Most of the proposed DNN-based solutions rely on single deep learning models and could be less costly in terms of ICS latency. However, they might have difficulties understanding the increasingly complex data distribution of intrusion patterns. Moreover, single deep learning models may not be effective in capturing the specific patterns of minority classes in highly imbalanced datasets, which is usually the case in cyber-security. Therefore, this paper proposes a novel hybrid multistage DNN-based intrusion detection and prevention system (IDPS) with better accuracy for critical ICSs that cannot afford to compromise on security to improve latency. The proposed approach sequentially learns the decision boundaries of the data that were misclassified or classified with low confidence by previous DNNs. Moreover, it incorporates a collaborative intrusion prevention system (IPS) with an emergency response schema that automatically mitigates attacks as soon as anomalies are detected. The results of experimental evaluations performed on different datasets demonstrate the effectiveness of the proposed solution.

Comparative Evaluation of AI-Based Techniques for Zero-Day Attacks Detection

Many intrusion detection and prevention systems (IDPS) have been introduced to identify suspicious activities. However, since attackers are exploiting new vulnerabilities in systems and are employing more sophisticated advanced cyber-attacks, these zero-day attacks remain hidden from IDPS in most cases. These features have incentivized many researchers to propose different artificial intelligence-based techniques to prevent, detect, and respond to such advanced attacks. This has also created a new requirement for a comprehensive comparison of the existing schemes in several aspects ; after a thorough study we found that there currently exists no detailed comparative analysis of artificial intelligence-based techniques published in the last five years. Therefore, there is a need for this kind of work to be published, as there are many comparative analyses in other fields of cyber security that are available for readers to review.In this paper, we provide a comprehensive review of the latest and most recent literature, which introduces well-known machine learning and deep learning algorithms and the challenges they face in detecting zero-day attacks. Following these qualitative analyses, we present the comparative evaluation results regarding the highest accuracy, precision, recall, and F1 score compared to different datasets.

An embedded intrusion detection and prevention system for home area networks in advanced metering infrastructure

AbstractWith the widespread adoption of smart metres in the power sector, anomaly detection has become a critical tool for analysing customers' unusual consumption patterns and network traffic. Detecting anomalies in power consumption and communication is primarily a real‐time big data analytics issue regarding data mining along with a vast number of parallel streaming data from smart metres. In this study, an embedded Intrusion Detection and Prevention System (IDPS) is proposed as a Wifi‐based smart metre for Home Area Networks (HANs) in the Advanced Metering Infrastructure (AMI) network. So, the proposed system employs one machine learning model based on IDPS to guard the HAN network from various attacks that utilise the Message Queueing Telemetry Transport protocol between the smart metre and IoT sensors. Also, it uses two machine learning models to detect the abnormality in periodic and daily data metering respectively. So, multiple algorithms have been used to find the suitable algorithm for each of the three anomaly detection models. These models have been evaluated and tested using real data sets regarding resources usage and detection performance to demonstrate the efficiency and effectiveness of using machine learning algorithms in the built anomaly detection models. The experiments show that the anomaly detection models performed well for various abnormalities.

Intelligent software defined networking: Long short term memory‐graded rated unit enabled block‐attack model to tackle distributed denial of service attacks

AbstractSoftware defined networking (SDN) is the next‐generation network. SDN enhances the programming flexibility, speed and automation to improve the network's performance. In recent times SDN has played a vital role in networking technology. It communicates with underlying hardware infrastructure and directs traffic on a network. The most complicated issue in SDN is the control plane's single point of failure (SPF). The main reason for raising the SPF problem in SDN by distributed denial of service (DDoS) attacks. The network collapses during failures in SDN, and the control plane is considered a management controller. Therefore, a novel intrusion detection and prevention system (IDPS) is proposed in the proposed approach to address SDN's problems mentioned above. In the proposed approach, a long short term memory (LSTM) and graded rated unit (GRU) deep learning model is proposed as the “Block‐Attack” model. The main objective of using LSTM and GRU in the proposed approach is to enhance the rate of accuracy in detecting DDoS attacks in an SDN environment. The CICDDoS2019 dataset is used for experimental result analysis in the proposed approach. Initially, the dataset is fed into the preprocessing stage. Using the K‐medoid technique, raw datasets are preprocessed to reduce the model's sensitivity to low density. In the proposed approach, the support vector machine based machine learning (SVM‐ML) technique is utilized to prevent DDoS attacks in a Mininet‐based emulation. Then, LSTM and GRU deep learning (DL) techniques are used to define the block‐attack model to enhance the detection performance. The experimental results of the proposed approach “Block‐Attack” model attain 98.5% of accuracy to detect and prevent the DDoS attacks and 95.5% of accuracy for SVM based method.

Beholder – A CEP-based intrusion detection and prevention systems for IoT environments

IoT devices are vulnerable to security threats. The connectivity among such devices presents opportunities for cybercriminals to perform different types of attacks. In IoT, application layer protocols play an important role. They form the basis of communications between applications and services. Security is an optional design aspect in application layer protocols, leading developers to neglect these security settings, or others may lack security mechanisms in their standard configuration. This paper introduces Beholder, an Intrusion Detection and Prevention System (IDPS) to prevent attacks that exploit the vulnerabilities in the MQTT (Message Queue Telemetry Transport) and CoAP (Constrained Application Protocol) protocols. Most IoT systems adopt MQTT or CoAP. Beholder exploits the Complex Event Processing (CEP) technology to analyze data streams and detect attacks on IoT applications that use the MQTT and CoAP protocols. Beholder is the first IDS that relies on CEP technology to detect attacks on MQTT and CoAP protocols in IoT environments to the best of our knowledge. This work introduces a real scenario for the evaluation process, performing attacks on a smart home. Initially, we validated the quality of our IDS, comparing it against the well-known Snort IDS. Since Snort can only handle attacks on TCP, we restricted the experiment to attacks on this protocol. Results demonstrated that Snort achieved three 9s of precision, while Beholder reached a precision of four 9s. The experiment to evaluate Beholder’s precision for the MQTT and CoAP protocols revealed that Beholder obtained 100% precision for High QoS Flood (MQTT) and the Error Flood(CoAP).

Which open-source IDS? Snort, Suricata or Zeek

Driven by the high and diverse network traffic and increase in the number of active attackers, nearly every organization including government institutions and enterprises are forced to deploy Network Intrusion Detection and Prevention Systems (NIDPS). It becomes a challenging task for NIDPS to process high-speed traffic that results in packet drops and consequently leads to degraded system performance. Thus, necessitating the requirement to assess the NIDPS performance in terms of various parameters such as resource consumption, packet processing, packet drop rate, throughput, and latency. In this study, we scrutinized three Open-Source Intrusion Detection and Prevention Systems (IDPS) Snort (both variants: single-threaded and multi-threaded), Suricata, and Zeek; while, using similar performance parameters normally used to evaluate commercial IDPS solutions. Such a comprehensive performance review has not been considered in the prior works. We considered typical NIDPS deployment in Small and Medium-sized Enterprises (SMEs) and conducted system assessment by using variations of various factors such as packet capturing modules, detection engine algorithms, packet size, and ruleset size. Such a thorough analysis is expected to be of great value for both the practitioners and the researchers in the selection and further enhancement of optimum IDPS configuration as per their requirements.

ML-Based IDPS Enhancement With Complementary Features for Home IoT Networks

The Internet of Things (IoT) networks are obstructed by security vulnerabilities that hackers can leverage to operate intrusions in many environments, such as smart homes, smart factories, and smart healthcare systems. To overcome this obstruction, researchers have come up with different intrusion detection and prevention systems (IDPSs). Out of all the implemented technologies, Machine Learning (ML) has emerged as the most promising approach. Therefore, to improve the detection accuracy, most ML-based intrusion detection solutions focus only on investigating appropriate ML algorithms. Yet, the limitations in terms of detection accuracy in various attacks are often caused by lack of appropriate detection features. Moreover, the majority of the previous works lack intrusion prevention mechanisms and deployment architectures. Thus, in this research, we study the properties of different smart home security attacks and the quality of the features that can be brought out and employed in ML algorithms to detect each of these attacks efficiently. Furthermore, this research proposes effective intrusion prevention mechanisms and a Software-Defined Networking (SDN) based deployment architecture of the IDPSs within home networks. Experimental evaluations of the proposed solution are provided using different feature sets and various ML models. The contributions and advancements discussed in this paper will upgrade future research and engineering works on IDPSs for IoT.

Modeling, Detecting, and Mitigating Threats Against Industrial Healthcare Systems: A Combined Software Defined Networking and Reinforcement Learning Approach

The rise of the Internet of Medical Things introduces the healthcare ecosystem in a new digital era with multiple benefits, such as remote medical assistance, real-time monitoring, and pervasive control. However, despite the valuable healthcare services, this progression raises significant cybersecurity and privacy concerns. In this article, we focus our attention on the IEC 60 870-5-104 protocol, which is widely adopted in industrial healthcare systems. First, we investigate and assess the severity of the IEC 60 870-5-104 cyberattacks by providing a quantitative threat model, which relies on Attack Defence Trees and Common Vulnerability Scoring System v3.1. Next, we introduce an intrusion detection and prevention system (IDPS), which is capable of discriminating and mitigating automatically the IEC 60 870-5-104 cyberattacks. The proposed IDPS takes full advantage of the machine learning (ML) and software defined networking (SDN) technologies. ML is used to detect the IEC 60 870-5-104 cyberattacks, utilizing 1) Transmission Control Protocol/Internet Protocol network flow statistics and 2) IEC 60 870-5-104 payload flow statistics. On the other side, the automated mitigation is transformed into a multiarmed bandit problem, which is solved through a reinforcement learning method called Thomson sampling and SDN. The evaluation analysis demonstrates the efficiency of the proposed IDPS in terms of intrusion detection accuracy and automated mitigation performance. The detection accuracy and the F1 score of the proposed IDPS reach 0.831 and 0.8258, respectively, while the mitigation accuracy is calculated at 0.923.

Intrusion Detection and Prevention against Cyber Attacks for an Energy Management System

Industrial Microgrids (IμG) are the large-scale buildings fortified with onsite Distributed Generations (DGs), energy storage, and demand response strategies. For optimal handling of these energy resources, storages, and loads to better match the power demand with the generation, a management system is developed termed as Industrial Energy Management System (IEMS). The optimal operation of IEMS depends on the accuracy of information flowing through the communication links between user and IEMS as well as the IEMS and utility grid. Communication links have some associated cybersecurity issues such as unauthorized access, data modification, and disrupt disclosure to change the operating conditions in today’s era of computation. The main goal of this paper is to devise a technique to efficiently detect and prevent internal as well as external apparition attempts. For this purpose, an Intrusion Detection and Prevention System (ID/PS) against cyberattacks is developed using a Linux operating system based on Smooth-sec software. The proposed ID/PS would continuously monitor and record the traffic within the local IμG network to distinguish a legal command from a real attack by decoding the attack packets to create its templates with defined ID/PS rules to take prevention measures and triggered an alert, alarm or Splunk for the security administrator. The devised novel approach significantly contributes to intrusion attention to vulnerabilities and security analysis of cyber secured equipped IEMS for an IμG.