Intrusion Detection Applications Research Articles

A multi-strategy surrogate-assisted social learning particle swarm optimization for expensive optimization and applications

Evolutionary algorithms (EAs) require extensive fitness evaluations, which constitutes a barrier to solving computationally complex problems. In contrast, surrogate-assisted evolutionary algorithms (SAEAs) have the potential to solve complex expensive optimization problems. This paper proposes a surrogate-assisted social learning particle swarm optimization (SASLPSO) to handle expensive optimization problems. An adaptive local surrogate (ALS) strategy introduced in SASLPSO is introduced to accurately fit the landscape near the global optimum. ALS consists of two layers of surrogate, the part of the particles closest to the optimal particle and the closest to the optimal particle among the particles that have been eliminated historically. The proposed SASLPSO effectively combines global surrogate (GS) and adaptive local surrogate (ALS) to balance global exploration and local exploitation. Furthermore, a novel random group-based pre-screening (RGBPS) strategy is proposed to screen promising particles for real function evaluation. The proposed SASLPSO is compared with four other state-of-the-art SAEAs on 30D, 50D, and 100D benchmark functions. In addition, the significance of the SASLPSO algorithm was also verified using the Wilcoxon rank test. The test results on the benchmark function show that the SASLPSO algorithm performs better than other comparison algorithms, especially when dealing with high-dimensional benchmark functions. To further validate the effectiveness of the SASLPSO algorithm in solving expensive optimization problems, it was also applied to feature selection problems and real-world engineering problems. In addition, in the real application of node deployment in 3D wireless sensor networks, the highest coverage rate of the SASLPSO algorithm can reach 99.96%, confirming its performance advantages in solving real application problems. Finally, in the application of network intrusion detection, SASLPSO has shown more advantages in multiple metrics, proving its versatility.

Gigantic Data in Interruption Recognition Structures and Interruption Anticipation Structures

This document presents network attacks, intrusion detection systems, intrusion prevention systems, and intrusion detection methods, including signature-based detection and anomaly-based detection. Intrusion detection/prevention (ID/PS) system methods are compared. Some data mining and machine learning methods and their applications in intrusion detection are presented. Big data is introduced into intrusion detection systems, big data analysis for large volumes of data, heterogeneous resources, and real-time stream processing. It also discusses the challenges of intrusion detection systems and the challenges posed by processing huge streams of data in the systems.

DNN Surgery: Accelerating DNN Inference on the Edge Through Layer Partitioning

Recent advances in deep neural networks have substantially improved the accuracy and speed of various intelligent applications. Nevertheless, one obstacle is that DNN inference imposes a heavy computation burden on end devices, but offloading inference tasks to the cloud causes a large volume of data transmission. Motivated by the fact that the data size of some intermediate DNN layers is significantly smaller than that of raw input data, we designed the DNN surgery, which allows partitioned DNN to be processed at both the edge and cloud while limiting the data transmission. The challenge is twofold: (1) Network dynamics substantially influence the performance of DNN partition, and (2) State-of-the-art DNNs are characterized by a directed acyclic graph rather than a chain, so that partition is incredibly complicated. To solve the issues, We design a Dynamic Adaptive DNN Surgery(DADS) scheme, which optimally partitions the DNN under different network conditions. We also study the partition problem under the cost-constrained system, where the resource of the cloud for inference is limited. Then, a real-world prototype based on the selif-driving car video dataset is implemented, showing that compared with current approaches, DNN surgery can improve latency up to 6.45 times and improve throughput up to 8.31 times. We further evaluate DNN surgery through two case studies where we use DNN surgery to support an indoor intrusion detection application and a campus traffic monitor application, and DNN surgery shows consistently high throughput and low latency.

An efficient feature selection and classification approach for an intrusion detection system using Optimal Neural Network

Network flaws are used by hackers to get access to private systems and data. This data and system access may be extremely destructive with losses. Therefore, this network intrusions detection is utmost significance. While investigating every feature set in the network, deep learning-based algorithms require certain inputs. That’s why, an Adaptive Artificial Neural Network Optimized with Oppositional Crow Search Algorithm is proposed for network intrusions detection (IDS-AANN-OCSA). The proposed method includes several phases, including feature selection, preprocessing, data acquisition, and classification. Here, the datas are gathered via CICIDS 2017 dataset. The datas are fed to pre-processing. During pre-processing, redundancy eradication and missing value replacement is carried out with the help of random forest along Local least squares for removing uncertainties. The pre-processed datas are fed to feature selection to select better features. The feature selection is accomplished under hybrid genetic algorithm together with particle swarm optimization technique (GPSO). The selected features are fed to adaptive artificial neural network (AANN) for categorization which categorizes the data as BENIGN, DOS Hulk, PortScan, DDoS, DoS Golden Eye. Finally, the hyper parameter of adaptive artificial neural network is tuned with Oppositional Crow Search Algorithm (OCSA) helps to gain better classification of network intrusions. The proposed approach is activated in Python, and its efficiency is evaluated with certain performance metrics, like accuracy, recall, specificity, precision, F score, sensitivity. The performance of proposed approach achieves better accuracy 99.75%, 97.85%, 95.13%, 98.79, better sensitivity 96.34%, 91.23%, 89.12%, 87.25%, compared with existing methods, like One-Dimensional Convolutional Neural Network Based Deep Learning for Network Intrusion Detection (IDS-CNN-GPSO), An innovative network intrusion detection scheme (IDS-CNN-LSTM) and Application of deep learning to real-time Web intrusion detection (IDS-CNN-ML-AIDS) methods respectively.

Hybrid Firefly and Black Hole Algorithm Designed for XGBoost Tuning Problem: An Application for Intrusion Detection

Computer networks have touched every aspect of human life, it cannot be overstated that cyber security is of great importance and significance. Intrusion detection techniques play an important role in the field of network security, but it also faces significant challenges. In this paper, we propose a Hybrid Firefly and Black Hole Algorithm (HFBHA) for parameter tuning of the XGBoost model and apply it to the study of intrusion detection systems. Firstly, the algorithm designs a double black hole mechanism by introducing the concept of the second black hole and adjusting the moving trajectory of the stars using the attraction of both black holes. Secondly, an improved initialization method of the stars is proposed, where a star that crosses the event horizon of the black hole has an opportunity to be replaced by a new star around the black hole. Finally, a combination of the firefly perturbation strategy and mutation operator is proposed to improve the global search capability of the algorithm. Both the effectiveness of the proposed method on the XBGoost parameter tuning problem and the feasibility of this strategy on intrusion detection applications are verified by comparison experiments based on the NSL-KDD dataset.

Applying modified golden jackal optimization to intrusion detection for Software-Defined Networking

<abstract> <p>As a meta-heuristic algorithm, the Golden Jackal Optimization (GJO) algorithm has been widely used in traditional network intrusion detection due to its ease of use and high efficiency. This paper aims to extend its application to the emerging field of Software-Defined Networking (SDN), which is a new network architecture. To adapt the GJO for SDN intrusion detection, a modified Golden Jackal Optimization (mGJO) is proposed to enhance its performance with the use of two strategies. First, an Elite Dynamic Opposite Learning strategy operates during each iteration to find solutions opposite to the current global optimal solutions, which increases population diversity. Second, an updating strategy based on the Golden Sine II Algorithm is utilized in the exploitation phase to update the position information of the golden jackal pairs, which accelerates the search for the best feature subset indexes. To validate the feasibility of the mGJO algorithm, this paper first assesses its optimization capability using benchmark test functions. Then, four UCI datasets and the NSL-KDD dataset are used to test the classification capability of the mGJO algorithm and its application in traditional network intrusion detection. Furthermore, the InSDN dataset is used to validate the feasibility of the mGJO algorithm for SDN intrusion detection. The experimental results show that, when the mGJO algorithm is applied to SDN for intrusion detection, the various indexes of classification and the selection of feature subsets achieve better results.</p> </abstract>

Energy consumption of on-device machine learning models for IoT intrusion detection

Recently, Smart Home Systems (SHSs) have gained enormous popularity with the rapid development of the Internet of Things (IoT) technologies. Besides offering many tangible benefits, SHSs are vulnerable to attacks that lead to security and privacy concerns for SHS users. Machine learning (ML)-based Intrusion Detection Systems (IDS) are proposed to address such concerns. Conventionally, ML models are trained and tested on computationally powerful platforms such as cloud services. Nevertheless, the data shared with the cloud is vulnerable to privacy attacks and causes latency, which decreases the performance of real-time applications like intrusion detection systems. Therefore, on-device ML models, in which the user data is kept locally, have emerged as promising solutions to ensure the security and privacy of the data for real-time applications. However, performing ML tasks requires high energy consumption. To the best of our knowledge, no study has been conducted to analyze the energy consumption of ML-based IDS. Therefore, in this paper, we perform a comparative analysis of on-device ML algorithms in terms of energy consumption for IoT intrusion detection applications. For a thorough analysis, we study the training and inference phases separately. For training, we compare the cloud computing-based ML, edge computing-based ML, and IoT device-based ML approaches. For the inference, we evaluate the TinyML approach to run the ML algorithms on tiny IoT devices such as Micro Controller Units (MCUs). Comparative performance evaluations show that deploying the Decision Tree (DT) algorithm on-device gives better results in terms of training time, inference time, and power consumption.

A Mechatronics System based on Feature Selection and AI for IoT Intrusion Detection Applications

In today's rapid development of the Internet, people's daily lives have become easier, but on the other hand, people's privacy is also faced with potential threats if necessary,security measures are not taken. To detect or stop cyberattacks in this area, network intrusion detection systems (IDS) can be equipped with machine learning algorithms to improve accuracy and speed. Recent research on intrusion and anomaly detection has shown that machine learning (ML) algorithms are widely used to detect maliciousweb traffic, using neural networks to learn models to visualize the sequence of connections between computers on a network. By analyzing and selecting the correct features, dense attacks can be detected more accurately, ultimately reducing misclassification rates and improving accuracy. In this study, we propose a Teacher-Student Feature Selection (TSFS) method that first uses the Isomap method to extract and select features in low dimensions and the best display, and then performs classification. The artificial neural MLP-Net for classification is used to minimize diagnostic errors. Although the teacher-student scheme is not new, to our knowledge, this is the first time this scheme has been used to select features in an intruder alert system. The proposed method can be used to select monitored and unmonitored features. The method is evaluated on different datasets and compared with the state-of-the-art feature selection methods available. The results show that the method performs better in classification, clustering, and error detection. Furthermore, experimental evaluations show that the method is less sensitive to parameter selection.

Adversarial examples for network intrusion detection systems

Machine learning-based network intrusion detection systems have demonstrated state-of-the-art accuracy in flagging malicious traffic. However, machine learning has been shown to be vulnerable to adversarial examples, particularly in domains such as image recognition. In many threat models, the adversary exploits the unconstrained nature of images–the adversary is free to select some arbitrary amount of pixels to perturb. However, it is not clear how these attacks translate to domains such as network intrusion detection as they contain domain constraints, which limit which and how features can be modified by the adversary. In this paper, we explore whether the constrained nature of networks offers additional robustness against adversarial examples versus the unconstrained nature of images. We do this by creating two algorithms: (1) the Adapative-JSMA, an augmented version of the popular JSMA which obeys domain constraints, and (2) the Histogram Sketch Generation which generates adversarial sketches: targeted universal perturbation vectors that encode feature saliency within the envelope of domain constraints. To assess how these algorithms perform, we evaluate them in a constrained network intrusion detection setting and an unconstrained image recognition setting. The results show that our approaches generate misclassification rates in network intrusion detection applications that were comparable to those of image recognition applications (greater than 95%). Our investigation shows that the constrained attack surface exposed by network intrusion detection systems is still sufficiently large to craft successful adversarial examples – and thus, network constraints do not appear to add robustness against adversarial examples. Indeed, even if a defender constrains an adversary to as little as five random features, generating adversarial examples is still possible.

Artificial intelligence driven Wi‐Fi CSI data mining: Focusing on the intrusion detection applications

SummaryIn the past several years, a series of breakthrough research advancements have been achieved by leveraging wireless signals such as Wi‐Fi in various emerging applications, including healthcare, behavior recognition, positioning, and target detection. Compared to traditional human behavior sensing methods, Wi‐Fi signals human behavior sensing technology has many advantages, including non‐line‐of‐sight, sensor device‐free sensing, passive sensing, ease of deployment, and no need for lights. Data mining undoubtedly plays a critical role in making Wi‐Fi‐based human behavior detection intelligent enough to facilitate convenient services and environments. We study Wi‐Fi signals mining using the data mining process and review the developmental process of Wi‐Fi data mining. This covers the methods of Wi‐Fi data mining, including signal acquisition, preprocessing, feature extraction to training, and classification. We then propose WHSecurity, a whole home intrusion detection and tracking system that is based on all of the methods covered above. Finally, WHSecurity includes a deep learning‐based data mining process called multiview learning for the decision‐making on intrusion detection and tracking. Experimental outcomes show that the WHSecurity approach performs superior in terms of intrusion detection and tracking performance.

Artificial immune algorithm-sparrow search algorithm and its application in network intrusion detection

In order to solve the problem that the population diversity of sparrow search algorithm (SSA) decreases and easily falls into the local optimal solution when it approaches the global optimal, an artificial immune algorithm-sparrow search algorithm (AIA-SSA) is proposed in this paper by combining artificial immune algorithm and sparrow search algorithm. This paper uses 10 benchmark functions for experimental simulation of AIA-SSA algorithm, and compares it with five widely used intelligent algorithms and SSA. Experimental results show that AIA-SSA overcomes the deficiency of SSA and improves the search accuracy, convergence speed and stability of the algorithm. Meanwhile, this paper applies AIA-SSA to network intrusion detection and constructs a network intrusion detection model based on support vector machine (SVM). After testing, the accuracy of AIA-SSA-SVM prediction for various network attacks has been greatly improved. It not only shows that AIA-SSA-SVM has a broad application prospect in the field of network security, but also verifies the feasibility and advanced nature of AIA-SSA in solving practical engineering problems.

An Analytical Model of Multi-intrusion Detection for Heterogeneous Wireless Sensor Networks Applied in the Monitoring Area

Aim: For a Wireless Sensor Network (WSN), the sensor node deployment is a critical issue since it reflects the coverage quality. It is the most fundamental issue in WSNs, and it has a great effect on the overall WSN application performance. When it is necessary to deploy randomly sensor nodes in a field of interest to form a WSN, ensuring a high coverage quality becomes difficult. In the random deployment scenario, the most difficult aspect of sensing coverage is to find how well the sensor nodes cover the field of interest. In this paper, we analyze the intrusion detection in a WSN which is defined as a mechanism for monitoring and detecting any intruder in a field of interest, with the objective of enhancing the detection quality in a random WSN. It is required to establish more specific measurements of node density and sensor range that impact the overall system performance especially in the intrusion detection application. To enhance the quality of intrusion detection, several probabilistic models are adopted for heterogeneous WSN in the random deployment scenario. Methods: Multi-intrusion detection model probability in a heterogeneous wireless sensor network for random deployment was used. Results and Discussion: In both homogeneous and heterogeneous WSNs, we analyzed our probabilistic model for multi-intrusion detection in single and multi-sensing detection. Conclusion: Our probabilistic models are useful in selecting the critical parameters of WSN in order to meet the detection quality requirement.

A Survey on Data-Driven Learning for Intelligent Network Intrusion Detection Systems

An effective anomaly-based intelligent IDS (AN-Intel-IDS) must detect both known and unknown attacks. Hence, there is a need to train AN-Intel-IDS using dynamically generated, real-time data in an adversarial setting. Unfortunately, the public datasets available to train AN-Intel-IDS are ineluctably static, unrealistic, and prone to obsolescence. Further, the need to protect private data and conceal sensitive data features has limited data sharing, thus encouraging the use of synthetic data for training predictive and intrusion detection models. However, synthetic data can be unrealistic and potentially bias. On the other hand, real-time data are realistic and current; however, it is inherently imbalanced due to the uneven distribution of anomalous and non-anomalous examples. In general, non-anomalous or normal examples are more frequent than anomalous or attack examples, thus leading to skewed distribution. While imbalanced data are commonly predominant in intrusion detection applications, it can lead to inaccurate predictions and degraded performance. Furthermore, the lack of real-time data produces potentially biased models that are less effective in predicting unknown attacks. Therefore, training AN-Intel-IDS using imbalanced and adversarial learning is instrumental to their efficacy and high performance. This paper investigates imbalanced learning and adversarial learning for training AN-Intel-IDS using a qualitative study. It surveys and synthesizes generative-based data augmentation techniques for addressing the uneven data distribution and generative-based adversarial techniques for generating synthetic yet realistic data in an adversarial setting using rapid review, structured reporting, and subgroup analysis.

A Compact and Highly Sensitive Voice-Eavesdropping Microresonator

A compact cantilever-based voice-eavesdropping microresonator is proposed. The dynamic vibration of the cantilever-microresonator system induced by an applied acoustic pressure is converted into a modulation of the cavity resonances. Then, the resonance-shift-induced optical transmission change is utilized to detect the applied acoustic signals. The enhancement of both the vibration and optical response makes the proposed system highly sensitive and have better performance than many other optical acoustic sensors. The noise equivalent pressure of the proposed system at 900 Hz is 52 μPa/Hz <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1/2</sup> . The system has a favorable broad frequency response range covering 0∼6 kHz. Experimental results prove that the system can acquire and reconstruct a voice signal 7 m away with high sensitivity and reliability, which can meet a variety of needs, such as indoor eavesdropping. Furthermore, the system is easy to fabricate, has low power consumption and is fairly tunable in terms of the frequency response range and sensitivity. This microcavity-based novel acoustic sensor is promising for opening up new possibilities in intrusion detection, voice eavesdropping and many other vibro-acoustic analysis applications.

Enabling Intelligent Services at the Network Edge

The proliferation of novel mobile applications and the associated AI services necessitates a fresh view on the architecture, algorithms and services at the network edge in order to meet stringent performance requirements. Some recent work addressing these challenges is presented. In order to meet the requirement for low-latency, the execution of computing tasks moves form the cloud to the network edge, closer to the end-users. The joint optimization of service placement and request routing in dense mobile edge computing networks is considered. Multidimensional constraints are introduced to capture the storage requirements of the vast amounts of data needed. An algorithm that achieves close-to-optimal performance using a randomized rounding technique is presented. Recent advances in network virtualization and programmability enable realization of services as chains, where flows can be steered through a pre-defined sequence of functions deployed at different network locations. The optimal deployment of such service chains where storage is a stringent constraint in addition to computation and bandwidth is considered and an approximation algorithm with provable performance guarantees is proposed and evaluated. Finally the problem of traffic flow classification as it arises in firewalls and intrusion detection applications is presented. An approach for realizing such functions based on a novel two-stage deep learning method for attack detection is presented. Leveraging the high level of data plane programmability in modern network hardware, the realization of these mechanisms at the network edge is demonstrated.

K-Modes Clustering Algorithm Based on Weighted Overlap Distance and Its Application in Intrusion Detection

In order to better apply the K-modes algorithm to intrusion detection, this paper overcomes the problems of the existing K-modes algorithm based on rough set theory. Firstly, for the problem of K-modes clustering in the initial class center selection, an initial class center selection algorithm Ini_Weight based on weighted density and weighted overlap distance is proposed. Secondly, based on the Ini_Weight algorithm, a new K-modes clustering algorithm WODKM based on weighted overlap distance is proposed. Thirdly, the WODKM clustering algorithm is applied to intrusion detection to obtain a new unsupervised intrusion detection model. The model detects the intrusion by dividing the clusters in the clustering result into normal clusters and abnormal clusters and analyzing the weighted average density of the object x to be detected in each cluster and the weighted overlapping distance of x and each center point. We verified the intrusion detection performance of the model on the KDD Cup 99 dataset. The experimental results of the current study show that the proposed intrusion detection model achieves efficient results and solves the problems existing in the present-day intrusion detection system to some extent.

Trace-Length Independent Runtime Monitoring of Quantitative Policies

Metric linear-time logic (MTL) has been widely used to specify runtime policies. Traditionally this use of MTL is to capture the qualitative aspects of the monitored systems, but recent developments in its extensions with aggregate operators allow some quantitative policies to be specified. Our interest in MTL-based policy languages is driven by applications in runtime malware or intrusion detection in platforms like Android and autonomous vehicles, which requires the monitoring algorithm to be independent of the length of the system event traces so that its performance does not degrade as the traces grow. We propose a policy language based on a past-time variant of MTL, extended with an aggregate operator called the metric temporal counting quantifier to specify a policy based on the number of times some sub-policies are satisfied in the specified past time interval. We show that a broad class of policies, but not all policies, specified with our language can be monitored in a trace-length independent way, and provide a concrete algorithm to do so. We implement and test our algorithm in both an existing Android monitoring framework and an autonomous vehicle simulation platform, and show that our approach can effectively specify and monitor quantitative policies drawn from real-world studies.

Random Partitioning Forest for Point-Wise and Collective Anomaly Detection—Application to Network Intrusion Detection

In this paper, we propose DiFF-RF, an ensemble approach composed of random partitioning binary trees to detect point-wise and collective (as well as contextual) anomalies. Thanks to a distance-based paradigm used at the leaves of the trees, this semi-supervised approach solves a drawback that has been identified in the isolation forest (IF) algorithm. Moreover, taking into account the frequencies of visits in the leaves of the random trees allows to significantly improve the performance of DiFF-RF when considering the presence of collective anomalies. DiFF-RF is fairly easy to train, and excellent performance can be obtained by using a simple semi-supervised procedure to setup the extra hyper-parameter that is introduced. We first evaluate DiFF-RF on a synthetic data set to i) verify that the limitation of the IF algorithm is overcome, ii) demonstrate how collective anomalies are actually detected and iii) to analyze the effect of the meta-parameters it involves. We assess the DiFF-RF algorithm on a large set of datasets from the UCI repository, as well as two benchmarks related to intrusion detection applications. Our experiments show that DiFF-RF almost systematically outperforms the IF algorithm, but also challenges the one-class SVM baseline and a deep learning variational auto-encoder architecture. Furthermore, our experience shows that DiFF-RF can work well in the presence of small-scale learning data, which is conversely difficult for deep neural architectures. Finally, DiFF-RF is computationally efficient and can be easily parallelized on multi-core architectures.

FAST-ODT: A Lightweight Outlier Detection Scheme for Categorical Data Sets

Outlier detection is a key data analysis technique that aims to find unusual data objects in a data set. It has been widely used in varied areas, including communication networks, finance, medicine, environmental studies, etc. Many applications in these areas involve categorical data. For example, the data set used in the application of intrusion detection normally includes a group of captured packets, which tend to have categorical attributes such as “protocol”. Although there are many outlier detection algorithms for applications involving numerical data, only a few existing schemes can handle categorical data. And the schemes designed for categorical data seriously suffer from two problems: low detection precision and high time complexity. In this paper, we present two novel outlier detection algorithms for categorical data sets. First of all, we describe a simple scheme based on entropy, Outlier Detection Tree (ODT). With ODT, a classification tree is constructed to classify the data set into two classes: a normal class and an abnormal class. Thereafter, each data object is identified as an outlier or a normal one using the if-then rules in the tree. Furthermore, we propose an advanced outlier detection algorithm, FAST-ODT, which achieves both high detection accuracy and low time complexity. Our experimental results indicate that FAST-ODT outperforms the existing algorithms in terms of outlier detection precision and computational complexity.

Research on Adaptive ISOMAP Algorithm and Application in Intrusion Detection

In view of the low accuracy and many redundant attributes in the detection algorithms, an intrusion detection algorithm based on adaptive Isomap is proposed. The algorithm uses the sparse representation theory to adaptively select the neighborhood of data points. Then the sparse coefficients are used as the distance weight to improve the data discrimination ability. Finally, the improved isometric feature mapping algorithm is introduced to the intrusion detection as the feature extraction module. The algorithm not only overcomes the difficulty of manual parameter adjustment, but also has strong robustness. Experimental results show that using this method to extract intrusion detection features can effectively improve the detection accuracy, and at the same time improve the detection accuracy of Probe, U2R, R2L.