Intrusion Detection Applications Research Articles

Research on Adaptive ISOMAP Algorithm and Application in Intrusion Detection

In view of the low accuracy and many redundant attributes in the detection algorithms, an intrusion detection algorithm based on adaptive Isomap is proposed. The algorithm uses the sparse representation theory to adaptively select the neighborhood of data points. Then the sparse coefficients are used as the distance weight to improve the data discrimination ability. Finally, the improved isometric feature mapping algorithm is introduced to the intrusion detection as the feature extraction module. The algorithm not only overcomes the difficulty of manual parameter adjustment, but also has strong robustness. Experimental results show that using this method to extract intrusion detection features can effectively improve the detection accuracy, and at the same time improve the detection accuracy of Probe, U2R, R2L.

Intrusion Detection for in-Vehicle Communication Networks: An Unsupervised Kohonen SOM Approach

The diffusion of embedded and portable communication devices on modern vehicles entails new security risks since in-vehicle communication protocols are still insecure and vulnerable to attacks. Increasing interest is being given to the implementation of automotive cybersecurity systems. In this work we propose an efficient and high-performing intrusion detection system based on an unsupervised Kohonen Self-Organizing Map (SOM) network, to identify attack messages sent on a Controller Area Network (CAN) bus. The SOM network found a wide range of applications in intrusion detection because of its features of high detection rate, short training time, and high versatility. We propose to extend the SOM network to intrusion detection on in-vehicle CAN buses. Many hybrid approaches were proposed to combine the SOM network with other clustering methods, such as the k-means algorithm, in order to improve the accuracy of the model. We introduced a novel distance-based procedure to integrate the SOM network with the K-means algorithm and compared it with the traditional procedure. The models were tested on a car hacking dataset concerning traffic data messages sent on a CAN bus, characterized by a large volume of traffic with a low number of features and highly imbalanced data distribution. The experimentation showed that the proposed method greatly improved detection accuracy over the traditional approach.

Research on the Detection of Network Intrusion Prevention With Svm Based Optimization Algorithm

Supp o rt vector machine ( SVM ) has a good application in intrusion detection, but its performance needs to be further improved. This study mainly analyzed the optimization algorithm of SVM . F irst ly, the principle of SVM was introduced , then SVM was improved using w hale o ptimization a lgorithm (WOA) , the WOA was improved , the intrusion detection method based on IW OA -SVM was analyzed , and experiments were carried out on KDD CUP99 to verify the effectiveness of the algorithm . The results show ed that the IWAO-SVM algorithm was more accurate in attack detection ; compared with SVM, PSO-SVM and ACO-SVM algorithms , the performance of the IWAO-SVM algorithm wa s better, the detection rate was 99.89%, the precision rat io wa s 99.92%, the accuracy rate wa s 99.86%, and the detection time wa s 192 s, showing that it had high precision in intrusion detection. The experimental results verify the reliability of the IWAO-SVM algorithm , and it can be promoted and applied in the detection of network intrusion prevention.

An Enhanced Design of Sparse Autoencoder for Latent Features Extraction Based on Trigonometric Simplexes for Network Intrusion Detection Systems

Despite the successful contributions in the field of network intrusion detection using machine learning algorithms and deep networks to learn the boundaries between normal traffic and network attacks, it is still challenging to detect various attacks with high performance. In this paper, we propose a novel mathematical model for further development of robust, reliable, and efficient software for practical intrusion detection applications. In this present work, we are concerned with optimal hyperparameters tuned for high performance sparse autoencoders for optimizing features and classifying normal and abnormal traffic patterns. The proposed framework allows the parameters of the back-propagation learning algorithm to be tuned with respect to the performance and architecture of the sparse autoencoder through a sequence of trigonometric simplex designs. These hyperparameters include the number of nodes in the hidden layer, learning rate of the hidden layer, and learning rate of the output layer. It is expected to achieve better results in extracting features and adapting to various levels of learning hierarchy as different layers of the autoencoder are characterized by different learning rates in the proposed framework. The idea is viewed such that every learning rate of a hidden layer is a dimension in a multidimensional space. Hence, a vector of the adaptive learning rates is implemented for the multiple layers of the network to accelerate the processing time that is required for the network to learn the mapping towards a combination of enhanced features and the optimal synaptic weights in the multiple layers for a given problem. The suggested framework is tested on CICIDS2017, a reliable intrusion detection dataset that covers all the common, updated intrusions and cyber-attacks. Experimental results demonstrate that the proposed architecture for intrusion detection yields superior performance compared to recently published algorithms in terms of classification accuracy and F-measure results.

A Review of Intrusion Detection and Blockchain Applications in the Cloud: Approaches, Challenges and Solutions

This paper reviews the background and related studies in the areas of cloud systems, intrusion detection and blockchain applications against cyber attacks. This work aims to discuss collaborative anomaly detection systems for discovering insider and outsider attacks from cloud centres, including the technologies of virtualisation and containerisation, along with trusting intrusion detection and cloud systems using blockchain. Moreover, the ability to detect such malicious attacks is critical for conducting necessary mitigation, at an early stage, to minimise the impact of disruption and restore cloud operations and their live migration processes. This paper presents an overview of cloud architecture and categorises potential state-of-the-art security events based on their occurrence at different cloud deployment models. Network Intrusion Detection Systems (NIDS) in the cloud, involving types of classification and common detection approaches, are also described. Collaborative NIDSs for cloud-based blockchain applications are also explained to demonstrate how blockchain can address challenges related to data privacy and trust management. A summary of the research challenges and future research directions in these fields is also explained.

Heuristics of Machine Learning for Home Intrusion Detection Application

Security has become a very vital role in present modern world. We need security for various applications and for our data. In particular security in home application is very crucial. So to serve this purpose in an efficient and easy manner we developed an intrusion system where in HOG (Histogram of Oriented Gradients) algorithm is used to detect person and an API to give alerts for intrusion. HOG is the Machine Learning (ML) algorithm used particularly for the person detection. The API used here is TWILIO which is the most suitable API for sending messages within seconds and accurately. Since every system is becoming automated we focused more on implementing the HOG and making the system to learn by itself and perform accurate results. In this paper we explained how HOG algorithm is implemented to detect the person entering the house and send the alerts as the person is detected. The accuracy of the model along with further developments that can be possible is given in detail.

Reflectometric and interferometric fiber optic sensor’s principles and applications

Fiber optic sensors have been widely used and studied in recent times. This paper presents operating principles and applications of fiber optic sensors namely reflectometric and interferometric fiber optic sensors. Majority of optical fiber sensors fall under these two broad categories. Both interferometric and reflectometric fiber optic sensors are becoming popular for their ease of use, flexibility, long distance sensing, and potentially noise free detection. Also, these sensors can easily be used in various applications such as structural health monitoring, perimeter intrusion detection, temperature monitoring, and other numerous applications. This paper broadly classifies fiber optic sensors into two subtypes. The paper further highlights different sensors based on their sensing resolution, range, spatial advantages, and applications.

DIFFERENT INTRUSION AND ITS DETECTION OF WIRELESS SENSOR NETWORK: A REVIEW

Wireless Sensor Network (WSN) has become an emerging technology of wireless communication and computing. Wireless Sensor Network is a self-configured, infrastructure-less wireless network which comprises of a few to large number of spatially distributed autonomous sensor nodes and a base station. The function of the base station is to interface user and network. A sensor node combines hardware and software. The main deployment of sensor network is sensing, data processing and transmitting data. WSN has different application in enemy intrusion detection in the battlefield in the military application, medical field, atmospheric disaster, agricultural and industrial applications. In Wireless sensor network each node is a battery-operated low power device and operated in ad-hoc principle, which indicates network power is mainly dependent on rate of energy consumption. Ad-hoc networking nature of WSN allows the attacker for different types of attacks from passive eavesdropping to active attacks. As WSN requires hop by hop routing to transport the packets to the destination, any intermediate node acting maliciously can drop, modify or misguide the traffic traversing through it. Confidentiality, authenticity, integrity, data freshness and quality of service (QoS) are the most important issues for wireless sensor nodes. An attacker may collect and destroy sensitive information if the transmission is not properly encrypted. However, avoiding collision and providing cooperation among the nodes during the transmission are done by using medium access control protocols. This paper focuses on the security threats on the resource restricted design and deployment characteristics along with the requirements to design a secured WSN system. In this paper wormhole attacks, black hole attacks, Sybil attacks, hello flood attack, denial of service attacks and private attacks are investigated. In this paper different link layer attacks are also discussed. Not only does this document about the popular attacks in different layers of WSN, but also provides some remedies against these attacks

A Semi-Boosted Nested Model With Sensitivity-Based Weighted Binarization for Multi-Domain Network Intrusion Detection

Effective network intrusion detection techniques are required to thwart evolving cybersecurity threats. Historically, traditional enterprise networks have been researched extensively in this regard. However, the cyber threat landscape has grown to include wireless networks. In this article, the authors present a novel model that can be trained on completely different feature sets and applied to two distinct intrusion detection applications: traditional enterprise networks and 802.11 wireless networks. This is the first method that demonstrates superior performance in both aforementioned applications. The model is based on a one-versus-all binary framework comprising multiple nested sub-ensembles. To provide good generalization ability, each sub-ensemble contains a collection of sub-learners, and only a portion of the sub-learners implement boosting. A class weight based on the sensitivity metric (true-positive rate), learned from the training data only, is assigned to the sub-ensembles of each class. The use of pruning to remove sub-learners that do not contribute to or have an adverse effect on overall system performance is investigated as well. The results demonstrate that the proposed system can achieve exceptional performance in applications to both traditional enterprise intrusion detection and 802.11 wireless intrusion detection.

Mitigation of multipath fading in indoor radiometric fingerprinting systems

Wireless sensor network technology offers endless possibilities for innovative solutions for different security and intrusion detection and recognition applications. By distributing multiple clusters of preconfigured wireless sensor network detection nodes, a widely monitored area can be consistently checked for intruders. These systems are simple, easy to install and reliable in detecting intruders automatically. This paper presents the utilization of a wireless sensor network as a non-invasive human identification system for smart homes and security applications. The proposed scheme analyzes the effect of individuals moving into a monitored area, where the 2.4 GHz wireless sensor network has been installed. It is imperative to comprehend the critical impact caused by different human bodies on multiple readings of Received Signal Strength Indicator collected at different levels for individuals at the same recording position. Multiple experiments were performed by utilizing the wireless sensor network nodes on different individuals at different positions. The paper particularly studies the effect of filtration and change of filtering parameters used to mitigate the multipath effect on the accuracy and detection capacity of the presented IEEE802.15.4-based radiometric human identification scheme.

Real-time feature selection technique with concept drift detection using adaptive micro-clusters for data stream mining

Data streams are unbounded, sequential data instances that are generated with high Velocity. Classifying sequential data instances is a very challenging problem in machine learning with applications in network intrusion detection, financial markets and applications requiring real-time sensor-networks-based situation assessment. Data stream classification is concerned with the automatic labelling of unseen instances from the stream in real-time. For this the classifier needs to adapt to concept drifts and can only have a single pass through the data if the stream is fast moving. This research paper presents work on a real-time pre-processing technique, in particular feature tracking. The feature tracking technique is designed to improve Data Stream Mining (DSM) classification algorithms by enabling and optimising real-time feature selection. The technique is based on tracking adaptive statistical summaries of the data and class label distributions, known as Micro-Clusters. Currently the technique is able to detect concept drifts and identify which features have been influential in the drift.

Performance comparison of intrusion detection systems and application of machine learning to Snort system

This study investigates the performance of two open source intrusion detection systems (IDSs) namely Snort and Suricata for accurately detecting the malicious traffic on computer networks. Snort and Suricata were installed on two different but identical computers and the performance was evaluated at 10 Gbps network speed. It was noted that Suricata could process a higher speed of network traffic than Snort with lower packet drop rate but it consumed higher computational resources. Snort had higher detection accuracy and was thus selected for further experiments. It was observed that the Snort triggered a high rate of false positive alarms. To solve this problem a Snort adaptive plug-in was developed. To select the best performing algorithm for Snort adaptive plug-in, an empirical study was carried out with different learning algorithms and Support Vector Machine (SVM) was selected. A hybrid version of SVM and Fuzzy logic produced a better detection accuracy. But the best result was achieved using an optimised SVM with firefly algorithm with FPR (false positive rate) as 8.6% and FNR (false negative rate) as 2.2%, which is a good result. The novelty of this work is the performance comparison of two IDSs at 10 Gbps and the application of hybrid and optimised machine learning algorithms to Snort.

Big Data in Intrusion Detection Systems and Intrusion Prevention Systems

This paper introduces network attacks, intrusion detection systems, intrusion prevention systems, and intrusion detection methods including signature-based detection and anomaly-based detection. Intrusion detection/prevention system (ID/PS) methods are compared. Some data mining and machine learning methods and their applications in intrusion detection are introduced. Big data in intrusion detection systems and Big Data analytics for huge volume of data, heterogeneous features, and real-time stream processing are presented. Challenges of intrusion detection systems and challenges posed by stream processing of big data in the systems are also discussed.

Models and performance evaluation of event goodput in sensor platforms

Despite the introduction of novel energy harvesting technologies, the lifetime of a sensor platform remains one of its most important performance metrics. Performance, however, may also be assessed in terms of the fraction of events which may successfully/unsuccessfully be detected and reported within a time interval of interest, i.e., mission time. Such a performance metric, here termed event goodput, is key for all random event-driven networks, ranging from surveillance and intrusion detection applications operating in time critical scenarios, to mobile and wearable crowd-sensed ecosystems, where mobile sensors are utilized by a number of different applications. When reporting the appearance of a series of possible, but unknown, phenomena, predicting which event goodput may be obtained during the planned mission time is challenging. In this paper, we address this issue by reducing the network-wide problem to the analysis of the performance of individual nodes, in terms of their capability of handling given fractions of event arrivals under fixed probabilistic guarantees. This is obtained as a function of mission time, event arrival and energy consumption models of different, detection and communication schemes, all realistic.

Data Mining Usage in Corporate Information Security: Intrusion Detection Applications

Abstract Background: The globalization era has brought with it the development of high technology, and therefore new methods of preserving and storing data. New data storing techniques ensure data are stored for longer periods of time, more efficiently and with a higher quality, but also with a higher data abuse risk. Objective: The goal of the paper is to provide a review of the data mining applications for the purpose of corporate information security, and intrusion detection in particular. Methods/approach: The review was conducted using the systematic analysis of the previously published papers on the usage of data mining in the field of corporate information security. Results: This paper demonstrates that the use of data mining applications is extremely useful and has a great importance for establishing corporate information security. Data mining applications are directly related to issues of intrusion detection and privacy protection. Conclusions: The most important fact that can be specified based on this study is that corporations can establish a sustainable and efficient data mining system that will ensure privacy and successful protection against unwanted intrusions.

Practical Implementation of an Adaptive Detection-Defense Unit against Link Layer DoS Attacks for Wireless Sensor Networks

Wireless sensor networks (WSNs) have become a very popular subject in both industrial and academic fields of study due to the fact that they can operate on their own, do not require extra maintenance, and can be utilized in a wide variety of applications. In addition, the sensor nodes having limited hardware resources and power units cause certain security problems awaiting to be resolved. The Denial-of-Service (DoS) attacks, which cause disrupts in the communication of sensor nodes or abnormal situations, thus resulting in the decrease of the lifespan of the network, constitute a serious threat against the WSN security. Especially in military applications in which security is the most important design criterion, the WSN used in chemical and biological intrusion detection applications must be resistant against all forms of attacks. In this study, an adaptive detection-defense unit has been developed against the DoS attacks (packet collision, exhaustion, and unfairness) which occur in the data link layer. The developed unit has also been implemented on the TelosB nodes. Due to the new unit that was designed the lifespan of the nodes has been extended without the need for additional hardware by making them more secure against DoS attacks in the data link layer of the WSN.

State Preserving Extreme Learning Machine: A Monotonically Increasing Learning Approach

Extreme Learning Machines (ELM) has been introduced as a new algorithm for training single hidden layer feedforward neural networks instead of the classical gradient-based approaches. Based on the consistency property of data, which enforces similar samples to share similar properties, ELM is a biologically inspired learning algorithm that learns much faster with good generalization and performs well in classification tasks. However, the stochastic characteristics of hidden layer outputs from the random generation of the weight matrix in current ELMs leads to the possibility of unstable outputs in the learning and testing phases. This is detrimental to the overall performance when many repeated trials are conducted. To cope with this issue, we present a new ELM approach, named State Preserving Extreme Leaning Machine (SPELM). SPELM ensures the overall training and testing performance of the classical ELM while monotonically increases its accuracy by preserving state variables. For evaluation, experiments are performed on different benchmark datasets including applications in face recognition, pedestrian detection, and network intrusion detection for cyber security. Several popular feature extraction techniques, namely Gabor, pyramid histogram of oriented gradients, and local binary pattern are also incorporated with SPELM. Experimental results show that our SPELM algorithm yields the best performance on tested data over ELM and RELM.

Incremental semi-supervised kernel construction with self-organizing incremental neural network and application in intrusion detection

The semi-supervised learning (SSL) problems are often solved by graph based algorithms, semi-definite program- mings etc. These methods always require high space complexities, and thus are not efficient for network intrusion detection systems. Apart from the space complexity challenge, a network intrusion detection system should be able to handle the distribution drifting of data flow as well. A common solution for this concept drift problem is by SSL. In this paper, an incre- mental SSL training framework is proposed to combine the low space complexity advantage of topology learning and SSL for network intrusion detection. First, the unsupervised self-organizing incremental neural network is extended to process labeled and unlabeled information incrementally. Second, a kernel function is constructed from the training results of the previous step. Finally, a kernel machine is trained with the constructed kernel function. The proposed method reduces the space complexity of SSL to the magnitude similar to supervised learning. The experiments are carried out on the NSL-KDD datasets, and the results show that the proposed method outperforms the mainstream methods such as Transductive Support Vector Machine and Label Propagation.

Evaluating Feature Selection Methods for Network Intrusion Detection with Kyoto Data

Considering the large quantity of the data flowing through the network routers, there is a very high demand to detect malicious and unhealthy network traffic to provide network users with reliable network operation and security of their information. Predictive models should be built to identify whether a network traffic record is healthy or malicious. To build such models, machine learning methods have started to be used for the task of network intrusion detection. Such predictive models must monitor and analyze a large amount of network data in a reasonable amount of time (usually real time). To do so, they cannot always process the whole data and there is a need for data reduction methods, which reduce the amount of data that needs to be processed. Feature selection is one of the data reduction methods that can be used to decrease the process time. It is important to understand which features are most relevant to determining if a network traffic record is malicious and avoid using the whole feature set to make the processing time more efficient. Also it is important that the simple model built from the reduced feature set be as effective as a model which uses all the features. Considering these facts, feature selection is a very important pre-processing step in the detection of network attacks. The goal is to remove irrelevant and redundant features in order to increase the overall effectiveness of an intrusion detection system without negatively affecting the classification performance. Most of the previous feature selection studies in the area of intrusion detection have been applied on the KDD 99 dataset. As KDD 99 is an outdated dataset, in this paper, we compare different feature selection methods on a relatively new dataset, called Kyoto 2006+. There is no comprehensive comparison of different feature selection approaches for this dataset. In the present work, we study four filter-based feature selection methods which are chosen from two categories for the application of network intrusion detection. Three filter-based feature rankers and one filter-based subset evaluation technique are compared together along with the null case which applies no feature selection. We also apply statistical analysis to determine whether performance differences between these feature selection methods are significant or not. We find that among all the feature selection methods, Signal-to-Noise (S2N) gives the best performance results. It also outperforms no feature selection approach in all the experiments.

Efficient deployment quality analysis for intrusion detection in wireless sensor networks

The intrusion detection in a Wireless Sensor Network is defined as a mechanism to monitor and detect any intruder in a sensing area. The sensor deployment quality is a critical issue since it reflects the cost and detection capability of a wireless sensor network. The quality of deterministic deployment can be determined sufficiently by a rigorous analysis before the deployment. However, when random deployment is required, determining the deployment quality becomes challenging. In the intrusion detection application, it is necessary to define more precise measures of sensing range, transmission range, and node density that impact overall system performance. The major question is centred around the quality of intrusion detection in WSN, how we can guarantee that each point of the sensing area is covered by at least one sensor node, and what a sufficient condition to guarantee the network connectivity? In this paper, we propose an appropriate probabilistic model which provides the coverage and connectivity in k-sensing detection of a wireless sensor network. We have proved the capability of our approach using a geometric analysis and a probabilistic model.