Intrusion Detection Capability Research Articles

Radial Basis Function Neural Networks (RBFNN) for Secure Intrusion Detection in the Internet of Drones (IoD)

With the rapid rise of the Internet of Things (IoT), drones are being used in various applications such as surveillance and delivery services. Despite this, there are serious security threats as well. This study proposes an innovative secure intrusion detection platform for the Internet of Drones (IoD) framework in order to address this problem. We use Radial Basis Function Neural Networks (RBFNN) and Non-Linear Partial Differential Equations (NL-PDEs) technique to enhance the intrusion detection capabilities. In addition the incorporation of block-chain technology fortifies the security and transparency of the system, ensuring the integrity of captured intrusion data. The proposed technique has been rigorously tested and evaluated to determine its accuracy in identifying malicious attacks and unauthorized access scenarios. Through this methodology, the Internet of Drones (IoD) security framework is strengthened, thereby mitigating potential risks derived from their widespread use. The main objective of this study is to make it easier for drone technology to be adopted and used safely and securely in a variety of contexts and industries.

Survey on Federated Learning for Intrusion Detection System: Concept, Architectures, Aggregation Strategies, Challenges, and Future Directions

Intrusion Detection Systems (IDS) are essential for securing computer networks by identifying and mitigating potential threats. However, traditional IDS systems face challenges related to scalability, privacy, and computational demands as network data complexity increases. Federated Learning (FL) has emerged as a promising solution, enabling collaborative model training on decentralized data sources while preserving data privacy. Each participant retains local data repositories, ensuring data sovereignty and precluding data sharing. Leveraging the FL framework, participants locally train machine learning models on their respective datasets, subsequently transmitting model updates to a central server for aggregation. The central server then disseminates the aggregated model updates to individual participants, collectively striving to bolster intrusion detection capabilities. This paper presents a comprehensive survey of FL applications in IDS, covering core concepts, architectural approaches, and aggregation strategies. We evaluate the strengths and limitations of various FL methodologies for IDS, addressing privacy and security concerns and exploring privacy-preserving techniques and security protocols. Our examination of aggregation strategies within the FL framework for IDS aims to highlight their effectiveness, limitations, and potential enhancements.

A two stage lightweight approach for intrusion detection in Internet of Things

The prevalence of the Internet of Things (IoT) in people’s life has led to a significant rise in the amounts of breaches against different IoT devices. Given that IoT devices are typically installed in settings with constrained resources and limited processing power, and malicious traffic samples are difficult to collect, resulting in traditional deep learning algorithms that do not handle intrusion detection in IoT network well. In this work, we present a two-stage lightweight intrusion detection model based on self-supervised contrastive learning and self-knowledge distillation to reduce model’s over-reliance on labels, optimize the model’s capacity for generalization and significantly increase the IoT network’s intrusion detection speed while lowering the model’s complexity. The representations of the network traffic are extracted in the first step using self-supervised contrastive learning, and the representations learnt by the teacher model are transferred to the student model in the second stage using self-knowledge distillation. On the benchmark datasets KDD CUP99, NSL-KDD, UNSW-NB15, CIC IDS2017 and BoT-IoT, we carried out in-depth studies, and the experimental results demonstrate that our proposed model outperforms recent state-of-the-art models in addition to achieving superior intrusion detection capabilities. The code will be released at https://github.com/RicardoMLi/CL-SKD.

Securing Networks in the Digital Age: A Review of Intrusion Detection and Prevention Strategies

In today's interconnected world, billions of individuals rely on the internet for various activities, from communication and commerce to entertainment and education. However, this widespread connectivity also brings about an increased risk of cyber threats and malicious activities. In response to these challenges, intrusion detection technology has emerged as a vital component of modern cybersecurity strategies. This paper presents a comprehensive literature survey focusing on Internal Intrusion Detection Systems (IIDS) and traditional Intrusion Detection Systems (IDS). These systems utilize a diverse array of data mining and forensic techniques algorithms to monitor and analyze system activities in real-time, thereby detecting and preventing potential security breaches. Additionally, the paper explores the integration of data mining methods for cyber analytics, offering valuable insights into the development and enhancement of intrusion detection capabilities. Through a thorough examination of existing research and methodologies, this study aims to provide a deeper understanding of the evolving landscape of intrusion detection and contribute to the advancement of cybersecurity practices in an increasingly digitized world.

Comparative Study of Machine Learning Algorithms using the CICIOV2024 Dataset

Leveraging the CICIoV2024 dataset, this study evaluates the performance of different algorithms in accurately identifying and classifying intrusions in vehicular networks, specifically using LightGBM, XGBoost, CatBoost, and LCCDE algorithms. A comparative analysis conducted considered key performance metrics such as accuracy, precision, recall, and F1-score, shedding light on the strengths and limitations of each approach. Through rigorous experimentation and evaluation, the remarkable results demonstrated 100% accuracy, recall, precision, and F1-score across all models. These findings highlight the efficacy of employing advanced machine learning techniques for enhancing intrusion detection capabilities in IoV environments. The insights gained from this study can inform the development of highly accurate and reliable intrusion detection systems tailored to the unique challenges of vehicular networks.Keywords: CatBoost, CICIoV2024, IoV, LCCDE, LightGBM, XGBoost

Feature Engineering for a MIL-STD-1553B LSTM Autoencoder Anomaly Detector

The MIL-STD-1553B data bus protocol is used in both civilian and military aircraft to enable communications between subsystems. These interconnected subsystems are responsible for core services such as communications, flow of instrument data and aircraft control. With aircraft modernization, threat vectors are introduced through increased inter-connectivity internal and external to the aircraft. The resulting potential for exploitation introduces a requirement for an intrusion detection capability in order to maintain the integrity, availability and reliability of data transmitted using the MIL-STD-1553B protocol, safety of the aircraft and overall, to achieve mission assurance. Research in recent years has investigated signature, statistical and machine learning based solutions to detect attacks on MIL-STD-1553B buses. Of the different techniques, those based on machine learning have shown extremely good results. The aim of this research is to improve the performance of an existing Long Short-Term Memory Auto-Encoder by refining the feature engineering phase of its pipeline. The improvement in the detector’s overall effectiveness was accomplished through feature engineering focused on feature generation and selection. Five different attack datasets were used as the starting point, consisting of four different denial of service attacks and one data integrity attack. From initial feature extraction of 155 features, two feature generation techniques were employed to create over 38,000 features as a starting point. Using five different MIL-STD-1553B datasets and three feature selection techniques, fifteen different Long Short-Term Memory Auto-Encoder models were created, trained and evaluated using common performance metrics and compared to those of the original anomaly detector. This research demonstrated marked performance improvement achieved by the feature engineering refinements made in comparison to those of the original model. Equally important, this research also showed a significant reduction in the number of features required to achieve this performance gain. In the context of miliary air operations, the ability to improve detection capabilities with less data is important to the technical solutions that contribute to the achievement of cyber mission assurance.

Enhancing the Internet of Medical Things (IoMT) Security with Meta-Learning: A Performance-Driven Approach for Ensemble Intrusion Detection Systems.

This paper investigates the application of ensemble learning techniques, specifically meta-learning, in intrusion detection systems (IDS) for the Internet of Medical Things (IoMT). It underscores the existing challenges posed by the heterogeneous and dynamic nature of IoMT environments, which necessitate adaptive, robust security solutions. By harnessing meta-learning alongside various ensemble strategies such as stacking and bagging, the paper aims to refine IDS mechanisms to effectively counter evolving cyber threats. The study proposes a performance-driven weighted meta-learning technique for dynamic assignment of voting weights to classifiers based on accuracy, loss, and confidence levels. This approach significantly enhances the intrusion detection capabilities for the IoMT by dynamically optimizing ensemble IDS models. Extensive experiments demonstrate the proposed model's superior performance in terms of accuracy, detection rate, F1 score, and false positive rate compared to existing models, particularly when analyzing various sizes of input features. The findings highlight the potential of integrating meta-learning in ensemble-based IDS to enhance the security and integrity of IoMT networks, suggesting avenues for future research to further advance IDS performance in protecting sensitive medical data and IoT infrastructures.

Security Information Event Management data acquisition and analysis methods with machine learning principles

In the face of increasing global disruptions, the cybersecurity field is confronting rising threats posed by offensive groups and individual hackers. Traditional security measures often fall short in detecting and mitigating these sophisticated attacks, necessitating advanced intrusion detection methods. The goal of our study is to develop robust network intrusion detection methods using machine learning techniques. In addition, we evaluate the effectiveness of various machine learning models in detecting network intrusions. Model performances are optimized through hyperparameter tuning and feature selection. A range of classification and clustering models have been employed. Data from SIEM systems capturing real-time statistics from cloud-hosted Windows virtual machines has been gathered and augmented with web attack logs from CICIDS2017, each comprising approximately fifteen thousand rows. Hyperparameter tuning, data normalization, standardization and feature selection techniques for model optimization have been used in our study. The research showcases the potential of machine learning in enhancing network intrusion detection capabilities. The findings underscore the effectiveness of the Random Forest Classifier (0.97) and highlight the importance of utilizing diverse datasets and advanced optimization techniques. This study offers valuable insights and sets a foundation for future advancements in cybersecurity strategies and intrusion detection systems.

Application of BukaGini algorithm for enhanced feature interaction analysis in intrusion detection systems

This article presents an evaluation of BukaGini, a stability-aware Gini index feature selection algorithm designed to enhance model performance in machine learning applications. Specifically, the study focuses on assessing BukaGini’s effectiveness within the domain of intrusion detection systems (IDS). Recognizing the need for improved feature interaction analysis methodologies in IDS, this research aims to investigate the performance of BukaGini in this context. BukaGini’s performance is evaluated across four diverse datasets commonly used in IDS research: NSLKDD (22,544 samples), WUSTL EHMS (16,318 samples), WSN-DS (374,661 samples), and UNSWNB15 (175,341 samples), amounting to a total of 588,864 data samples. The evaluation encompasses key metrics such as stability score, accuracy, F1-score, recall, precision, and ROC AUC. Results indicate significant advancements in IDS performance, with BukaGini achieving remarkable accuracy rates of up to 99% and stability scores consistently surpassing 99% across all datasets. Additionally, BukaGini demonstrates an average reduction in dimensionality of 25%, selecting 10 features for each dataset using the Gini index. Through rigorous comparative analysis with existing methodologies, BukaGini emerges as a promising solution for feature interaction analysis within cybersecurity applications, particularly in the context of IDS. These findings highlight the potential of BukaGini to contribute to robust model performance and propel intrusion detection capabilities to new heights in real-world scenarios.

Using Feature Selection Enhancement to Evaluate Attack Detection in the Internet of Things Environment

The rapid evolution of technology has given rise to a connected world where billions of devices interact seamlessly, forming what is known as the Internet of Things (IoT). While the IoT offers incredible convenience and efficiency, it presents a significant challenge to cybersecurity and is characterized by various power, capacity, and computational process limitations. Machine learning techniques, particularly those encompassing supervised classification techniques, offer a systematic approach to training models using labeled datasets. These techniques enable intrusion detection systems (IDSs) to discern patterns indicative of potential attacks amidst the vast amounts of IoT data. Our investigation delves into various aspects of supervised classification, including feature selection, model training, and evaluation methodologies, to comprehensively evaluate their impact on attack detection effectiveness. The key features selected to improve IDS efficiency and reduce dataset size, thereby decreasing the time required for attack detection, are drawn from the extensive network dataset. This paper introduces an enhanced feature selection method designed to reduce the computational overhead on IoT resources while simultaneously strengthening intrusion detection capabilities within the IoT environment. The experimental results based on the InSDN dataset demonstrate that our proposed methodology achieves the highest accuracy with the fewest number of features and has a low computational cost. Specifically, we attain a 99.99% accuracy with 11 features and a computational time of 0.8599 s.

An Enhanced Hybrid Deep Learning Model to Enhance Network Intrusion Detection Capabilities for Cybersecurity

Recently, we have noticed tremendous growth in the field of Information Technology. This increased growth has proliferated the use of new technologies and continued advancement of networking systems. These systems are widely adopted for real-time online and offline tasks. Due to this growth in information technology, maintaining security has gained huge attention as these systems are vulnerable to various attacks. In this context, an Intrusion Detection System (IDS) plays an important role in ensuring security by detecting and preventing suspicious activities within the network. However, as technology is overgrowing, malicious activities are also increasing. Moreover, legacy IDS methods cannot handle new threats, such as traditional signature-based methods requiring a predefined rule set to detect malicious activity. Also, several new methods have been proposed earlier to address security-related issues; however, the performance of these methods is limited due to poor attack detection accuracy and increased false positive rates. In this work, we propose and compare different deep-learning (DL) models that can be used to construct IDSs to provide network security. Details on convolutional neural networks (CNNs), Multilayer Perceptron (MLP), and long short-term memories (LSTMs) are introduced. A discussion of the outcomes achieved follows an assessment of the proposed DL model known as the FOA-CNN-LSTM technique. Comparisons are made between the suggested models and other machine-learning methods. This work presents a deep-learning approach based on hybrid CNN-LSTM with Fruit fly Optimization Algorithm (FOA) by ensemble techniques to distinguish between normal and abnormal behaviors.

Concept Drift–Based Intrusion Detection For Evolving Data Stream Classification In IDS: Approaches And Comparative Study

Abstract Static machine and deep learning algorithms are commonly used in intrusion detection systems (IDSs). However, their effectiveness is constrained by the evolving data distribution and the obsolescence of the static data sources used for model training. Consequently, static classifiers lose efficacy, necessitating expensive model retraining with time. The aim is to develop a dynamic and adaptable IDS that mitigates the limitations of static models, ensuring real-time threat detection and reducing the need for frequent, resource-intensive model retraining. This research proposes an approach that amalgamates the adaptive random forest (ARF) classifier with Hoeffding’s bounds and a moving average test for the early and accurate detection of network intrusions. The ARF can adapt in real time to shifting network conditions and evolving attack patterns, constantly refining its intrusion detection capabilities. Furthermore, the inclusion of Hoeffding’s bounds and the moving average test adds a dimension of statistical rigor to the system, facilitating the timely recognition of concept drift and distinguishing benign network variations from potential intrusions. The synergy of these techniques results in reduced false positives and false negatives, thereby enhancing the overall detection rate. The proposed method delivers outstanding results, with 99.95% accuracy and an impressive 99.96% recall rate on the latest CIC-IDS 2018 dataset, outperforming the results of existing approaches.

Firefly algorithm based WSN-IoT security enhancement with machine learning for intrusion detection

A Wireless Sensor Network (WSN) aided by the Internet of Things (IoT) is a collaborative system of WSN systems and IoT networks are work to exchange, gather, and handle data. The primary objective of this collaboration is to enhance data analysis and automation to facilitate improved decision-making. Securing IoT with the assistance of WSN necessitates the implementation of protective measures to confirm the safety and reliability of the interconnected WSN and IoT components. This research significantly advances the current state of the art in IoT and WSN security by synergistically harnessing the potential of machine learning and the Firefly Algorithm. The contributions of this work are twofold: firstly, the proposed FA-ML technique exhibits an exceptional capability to enhance intrusion detection accuracy within the WSN-IoT landscape. Secondly, the amalgamation of the Firefly Algorithm and machine learning introduces a novel dimension to the domain of security-oriented optimization techniques. The implications of this research resonate across various sectors, ranging from critical infrastructure protection to industrial automation and beyond, where safeguarding the integrity of interconnected systems are of paramount importance. The amalgamation of cutting-edge machine learning and bio-inspired algorithms marks a pivotal step forward in crafting robust and intelligent security measures for the evolving landscape of IoT-driven technologies. For intrusion detection in the WSN-IoT, the FA-ML method employs a support vector machine (SVM) machine model for classification with parameter tuning accomplished using a Grey Wolf Optimizer (GWO) algorithm. The experimental evaluation is simulated using NSL-KDD Dataset, revealing the remarkable enhancement of the FA-ML technique, achieving a maximum accuracy of 99.34%. In comparison, the KNN-PSO and XGBoost models achieved lower accuracies of 96.42% and 95.36%, respectively. The findings validate the potential of the FA-ML technique as an active security solution for WSN-IoT systems, harnessing the power of machine learning and the Firefly Algorithm to bolster intrusion detection capabilities.

Hybrid Features-Based Intrusion Detection for The Internet of Vehicles using Dynamic Adaptation

Abstract: The evolving landscape of the Internet of Vehicles (IoV) has brought to the forefront a discernible array of challenges about network security. In response, this study delves into applying deep learning-based intrusion detection techniques to fortify the IoV against potential network threats. Notably, prevailing approaches often rely on a singular deep learning model for either temporal or spatial feature extraction, with a serial sequence of spatial feature extraction followed by temporal feature extraction. Such methodologies tend to exhibit shortcomings in adequately capturing the Spatiotemporal intricacies inherent in IoV dynamics, thereby adversely impacting intrusion detection efficacy, and contributing to an elevated false-positive rate. To address these challenges, this research proposes an innovative intrusion detection method tailored for the IoV, premised on the parallel analysis of Hybrid features. The methodology commences with the construction of an optimal feature subset based on inter-feature correlations within IoV traffic. Subsequently, a parallelized application of Temporal Convolutional Network (TCN) and Long Short-Term Memory (LSTM) architectures is employed to extract spatio-temporal features from IoV traffic. In acknowledgment of the dynamic nature of IoV environments, a novel Dynamic Adaptation Mechanism is introduced. This mechanism continuously monitors the real-time IoV traffic, detecting feature drifts and triggering adaptations in the spatiotemporal feature extraction process. The adaptation requirements are then seamlessly communicated to the intrusion detection model through a Feedback Loop for Model Updating, ensuring that the model remains adept at discerning emerging network threats. The culmination of this process involves the fusion of parallelly extracted spatiotemporal features, facilitated by the self-attention mechanism. Subsequently, intrusion detection is executed utilizing a Multilayer Perceptron, providing a comprehensive framework that dynamically adapts to the evolving IoV environment. Empirical assessments utilizing the NSLKDD dataset demonstrate the efficacy of the proposed method, manifesting in a notable 2.05% reduction in the false-positive rate. Additionally, the proposed method surpasses baseline performance metrics, including accuracy and F1 score, thereby affirming its proficiency in enhancing intrusion detection capabilities within the Internet of Vehicles paradigm, especially in the context of the introduced Dynamic Adaptation Mechanism.

Artificial Immune Systems in Local and Network Cybersecurity: An Overview of Intrusion Detection Strategies

In this paper, an overview of artificial immune systems (AIS) used in intrusion detection systems (IDS) is provided, along with a review of recent efforts in this field of cybersecurity. In particular, the focus is on the negative selection algorithm (NSA), a popular, prominent algorithm of the AIS domain based on the human immune system. IDS offer intrusion detection capabilities, both locally and in a network environment. The paper offers a review of recent solutions employing AIS in IDS, capable of detecting anomalous network traffic/breaches and operating system file infections caused by malware. A discussion regarding the reviewed research is presented with an analysis and suggestions for further research, and then the work is concluded.

Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security

Log lines consist of static parts that characterize their structure and enable assignment of event types, and event parameters, i.e., variable parts that provide specific information on system processes, such as host and user names, IP addresses, and file operations. Many detection approaches only focus on anomalous event type occurrences, i.e., they parse log lines to derive unique event identifiers and subsequently detect anomalies in event sequences or event count vectors, but neglect variable parts of log lines entirely during analysis. This is especially problematic, when monitoring strongly structured log data that contains only a small number of distinct event types, for example, logs that consist of strict key value pairs, i.e., parameters that occur consistently throughout all log lines, such as it is case in access and audit logs. Thus, novel approaches are required, which focus on analysis of log lines' variable parts. In this paper, we propose the variable type detector (VTD), a novel unsupervised approach that autonomously analyzes variable log line parts to enable anomaly detection. It assigns data types to each variable, which also include probability distributions for discrete and continuous variables. The VTD raises an alarm if a variable's data type changes. Furthermore, it implements a robust indicator function that reduces false positives by tracking the data type history of each variable and reports only significant data type changes. Additionally, an event indicator enables event-based anomaly detection by taking into account the data types of all variables of a single event type. The evaluation conducted on open-source log data, demonstrates the effectiveness of the VTD compared to conventional anomaly detection approaches, such as time series analysis and PCA. Consequently, the VTD acts as a solution that extends the intrusion detection capabilities of security information and event management (SIEM) and integrates with modern concepts of endpoint detection and response (EDR) and extended detection and responses (XDR), while simultaneously serving as an asset for process monitoring that supports user and entity behavior analytics (UEBA).

Laser Based Short Range Multipurpose Security System

Abstract: This paper presents an IoT-based Laser Security System (IoT-LSS) designed to enhance perimeter security and intrusion detection capabilities. Traditional security systems often rely on cameras and motion sensors, which can be susceptible to false alarms and environmental limitations. The proposed IoT-LSS addresses these challenges by leveraging laser technology, IoT devices The interruption of the laser beam caused by an intruder's movement triggers an alert. IoT integrated with the laser pairs collect real-time data and transmit it to a central control unit. This control unit acts as the brain of the system, making intelligent decisions based on the incoming data stream. Control unit identifies object and differentiation between human movement and other environmental disturbances. The implementation of the IoT LSS demonstrates its effectiveness in reducing false alarms and providing reliable intrusion detection. The fusion of IoT and laser technology not only enhances security but also minimizes maintenance efforts compared to traditional systems. By harnessing the power of IoT, laser technology, the proposed Laser Security System showcases a promising solution for modern security challenges, contributing to a safer and more connected world.

Optimized machine learning enabled intrusion detection 2 system for internet of medical things

This research paper proposes an intrusion detection system that combines particle swarm optimization and AdaBoost algorithms to classify and detect malware-related records in innovative health app platforms. The research employs the NSL KDD dataset, consisting of 125,973 instances and 41 features, with data split into training (20 %) and testing (80 %) sets. A feature selection process using Particle Swarm Optimization identifies 12 relevant features for intrusion detection. The intrusion detection system effectively categorizes various attack types, including Denial of Service (DoS), User-to-root (U2R), Root-to-local (R2L), and Probe attacks. Regarding classifier performance, AdaBoost exhibits the highest recall value (0.966667), highlighting its strong intrusion detection capabilities. The experimental results demonstrate that the PSO-AdaBoost approach achieves superior accuracy, precision, and recall in intrusion detection. By integrating machine learning-based intrusion detection systems into smart health apps, healthcare providers can enhance patient care, reduce costs, and ensure the confidentiality of sensitive medical information. This research highlights the potential of ML-IDSs in strengthening the security infrastructure surrounding medical IoT devices and improving patient outcomes in the interconnected world of the Internet of Medical Things.

Lightweight Intrusion Detection Method of Vehicle CAN Bus under Computational Resource Constraints

In order to improve the security protection performance of the vehicle Controller Area Network (CAN) bus, the research builds an adaptive lightweight intrusion detection algorithm based on the limited computing and storage resources of the on-board ECU environment and the message cycle characteristics to supervise and detect the vehicle CAN bus intrusion. The results showed that the message cycle-based adaptive intrusion detection algorithm had high accuracy and recall rate, and fast computational search efficiency, with a stable detection time of less than 3 seconds. The intrusion detection capability is continuously optimized as the training time increases, and after stabilization, the resource utilization rate reaches over 95% with a throughput of 100Mb/s. The algorithm has strong protection capabilities. The average vehicle CPU usage of the algorithm is only 4.76%, which is 10.17% lower than the intrusion detection algorithm based on support vector machines. It can effectively prevent interference with the normal operation of the vehicle CAN bus. The algorithm has high detection accuracy for interrupt type attacks, and there are no false positives or missed alarms. For injection type attacks, the probability of missed alarms is less than 1%. The intrusion detection of vehicle CAN bus based on the message cycle characteristics provides technical reference for the safety and stability of the vehicle network, and has important practical value for the intelligent and networked development of the automobile industry.

Secure routing in the Internet of Things (IoT) with intrusion detection capability based on software-defined networking (SDN) and Machine Learning techniques

Routing and security are the two main prerequisites for ensuring the correct operation of wireless networks. The importance of these cases doubles in wide networks such as IoT. This paper presents an algorithm to improve Secure Routing in IoT called SRAIOT. This algorithm uses a hierarchical structure to determine the connections between network components and data transfer routing. In SRAIOT, the network structure is managed hierarchically and through SDN. For this purpose, the IoT network is first divided into a set of subnets using the SDN solution, communication control and authentication are managed using the controller nodes of each subnet. The communication between two objects (located in different subnets) will be possible if their identity is confirmed through the controller nodes related to them. On the other hand, in order to identify the sources of attacks and network security threats, the controller nodes in each subnet monitor the network traffic pattern using an ensemble learning model and identify possible attacks in their subnet. The performance of SRAIOT was tested in the simulation, and the results were compared with previous methods. The results of these tests show that SRAIOT improves network performance regarding routing and detecting attacks.