Intrusion Detection Framework Research Articles

Deep learning approaches for protecting IoT devices in smart homes from MitM attacks

The primary objective of this paper is to enhance the security of IoT devices in Software-Defined Networking (SDN) environments against Man-in-the-Middle (MitM) attacks in smart homes using Artificial Intelligence (AI) methods as part of an Intrusion Detection and Prevention System (IDPS) framework. This framework aims to authenticate communication parties, ensure overall system and network security within SDN environments, and foster trust among users and stakeholders. The experimental analysis focuses on machine learning (ML) and deep learning (DL) algorithms, particularly those employed in Intrusion Detection Systems (IDS), such as Naive Bayes (NB), k-Nearest Neighbors (kNN), Random Forest (RF), and Convolutional Neural Networks (CNN). The CNN algorithm demonstrates exceptional performance on the training dataset, achieving 99.96% accuracy with minimal training time. It also shows favorable results in terms of detection speed, requiring only 1 s, and maintains a low False Alarm Rate (FAR) of 0.02%. Subsequently, the proposed framework was deployed in a testbed SDN environment to evaluate its detection capabilities across diverse network topologies, showcasing its efficiency compared to existing approaches.

Enhanced intrusion detection framework for securing IoT network using principal component analysis and CNN

ABSTRACT The Internet of Things (IoT) has transformed our world by connecting smart devices and enabling seamless interactions. This reliance, however, has led to new security issues and types of attacks. It is of the utmost importance to safeguard the security of IoT networks, with network intrusion detection systems (NIDS) having a significant impact. This paper proposes a novel approach integrating Principal Component Analysis (PCA), Pearson Correlation Coefficient (PCC), and Convolutional Neural Network (CNN) to overcome these security issues. Our innovative method reduces data dimensionality and selects highly correlated features using PCC and PCA, addressing overfitting and improving model performance while maintaining high computational speed and low costs. Our approach uniquely distinguishes between benign and threat packets by employing 1D-CNN, 2D-CNN, and 3D-CNN algorithms trained on Edge-IIoTset and NSL-KDD benchmark datasets. The findings from our experiments indicate that the proposed framework significantly enhances accuracy, precision, recall, and F1-score compared to existing models for both binary and multiclass classifications. Our binary classification models achieved exceptional performance, with an average accuracy of 99.76%, 99.79% precision, 99.89% recall, and 99.85% F1-score on the Edge-IIoTset dataset. On the NSL-KDD dataset, the models attained 99.20% accuracy, 98.07% precision, 97.95% recall, and 97.71% F1-score. For multiclass classification, the proposed model demonstrated an average accuracy of 99.41%, precision of 98.61%, recall of 98.49%, and an F1-score of 98.56% on the Edge-IIoTset dataset. On the NSL-KDD dataset, the model achieved 92.43% accuracy, 93.21% precision, 93.60% recall, and a 93.7% F1-score. Our research introduces a significant advancement that substantially improves NIDS capabilities, making IoT networks safer and more connected.

HIDIM: A novel framework of network intrusion detection for hierarchical dependency and class imbalance

Deep learning-based network intrusion detection has been extensively explored as a data-driven approach. Therefore, paying attention to the data’s characteristics is essential. By analyzing the attribute dependence and sample distribution of intrusion data, there are the following problems: “hierarchical dependency omission” and “decision boundary discontinuity.” The former means the previous attribute embedding models failed to incorporate network protocol hierarchy. The latter indicates that the small disjuncts distribution leads to sub-concept fragmentation, exacerbating the difficulty in handling class imbalance. To address these problems, we propose a novel detection framework for Hierarchical Dependency and Class Imbalance (HIDIM). First, we treat semantic attributes as words and introduce the protocol hierarchy of attributes into a paragraph embedding model. Second, we design a synthetic oversampling method. It adopts a mutual nearest neighbour approach to determine the boundaries of each disjunct. Then, it synthesizes high-quality samples within those boundary areas by crossing or mutating features based on their importance. The experimental results on multiple real-world datasets demonstrate that the proposed framework is superior to other state-of-the-art models in terms of accuracy, F1-score, and false negative rate by 2.23%, 2.12%, and 1.43% on average, respectively.

A distributed intrusion detection framework for vehicular Ad Hoc networks via federated learning and Blockchain

The emergence of connected vehicles via Vehicular Ad Hoc Networks (VANETs) has revolutionized transportation but has also brought forth challenges in security and privacy due to their open architecture. Early detection of intrusions within VANETs is paramount for ensuring safe communication. This research presents an intelligent distributed approach that leverages federated learning (FL) and blockchain for intrusion detection in VANETs. Through FL, various neural network models were implemented to distribute model training among vehicles, thus preserving privacy. Quantitative evaluation metrics demonstrate the effectiveness of the proposed framework. For example, compared to a traditionally trained Stochastic Gradient Descent (SGD) model, the Federated Trained Model achieved higher precision across various attack types, ranging from 68 % to 94 %, and consistently outperformed in terms of recall, with rates ranging from 57 % to 88 %. These results highlight FL's superiority in detecting intrusions, evidenced by gains in accuracy, recall, and precision. Integration of FL with blockchain further strengthened security and privacy protection, ensuring data integrity during collaborative FL training across decentralized nodes. This novel framework addresses VANET vulnerabilities by facilitating privacy-preserving, collaborative anomaly monitoring in a trustworthy manner. Evaluations validate the performance advantages of FL for intrusion identification, supporting wider adoption of vehicular technologies. The study underscores the potential of combining FL and blockchain to enable robust, cooperative abnormality recognition crucial for maintaining reliability, safety, and trust in VANET operations.

Network Intrusion Detection Based on Convolutional Recurrent Neural Network, Random Forest, and Federated Learning

This paper presents a novel network intrusion detection framework that combines convolutional recurrent neural networks (CRNN) and random forest (RF) models within a federated learning setting. The proposed approach aims to address the challenges of data privacy, computational efficiency, and model generalization in traditional network intrusion detection methods. By leveraging the spatial feature extraction capabilities of CRNN and the feature selection and noise reduction properties of RF, the framework enhances the accuracy and robustness of attack detection. The integration of federated learning enables collaborative model training without compromising data privacy. Extensive experiments on benchmark datasets demonstrate the superiority of the proposed method compared to state-of-the-art techniques, achieving high performance metrics such as accuracy, precision, recall, F1 score, and AUC. The proposed framework offers a promising solution for secure and efficient network intrusion detection in real-world scenarios, contributing to the advancement of cybersecurity practices.

A Novel Hybrid Intrusion Detection Framework Leveraging Machine Learning and Flower Pollination Optimization

The exponential growth in technologies such as cloud computing, smart devices, virtualization, and the Internet of Things (IoT) has generated over four hundred zettabytes of network traffic data annually. This surge necessitates robust cybersecurity strategies to protect information from intrusions, which can result in significant financial losses. Reducing security risks requires the use of data analytics and machine learning to derive insights and make informed decisions based on network data. This study introduces the Flower Pollination Optimization (FPO) algorithm for feature selection to enhance the performance of several classifiers on the UNSW-NB15 dataset. We evaluated four classifiers: Linear Discriminant Analysis (LDA), Multi-Layer Perceptron (MLP), Quadratic Discriminant Analysis (QDA), and K-Nearest Neighbors (KNN) in two scenarios: without feature selection and with FPO-based feature selection. The results demonstrate significant improvements in classifier performance with FPO, with QDA achieving the highest accuracy of 99.16%. Comparative analysis with recent studies highlights the superior performance of our approach, setting a new benchmark in intrusion detection. This research underscores the essential role of effective feature selection in improving the accuracy and reliability of Intrusion Detection Systems (IDS), particularly in IoT environments.

A cloud‐based hybrid intrusion detection framework using XGBoost and ADASYN‐Augmented random forest for IoMT

AbstractInternet of Medical Things have vastly increased the potential for remote patient monitoring, data‐driven care, and networked healthcare delivery. However, the connectedness lays sensitive patient data and fragile medical devices open to security threats that need robust intrusion detection solutions within cloud‐edge services. Current approaches need modification to be able to handle the practical challenges that result from problems with data quality. This paper presents a hybrid intrusion detection framework that enhances the security of IoMT networks. There are three modules in the design. First, an XGBoost‐based noise detection model is used to identify data anomalies. Second, adaptive resampling with ADASYN is done to fine‐tune the class distribution to address class imbalance. Third, ensemble learning performs intrusion detection through a Random Forest classifier. This stacked model coordinates techniques that filter noise and preprocess imbalanced data, identifying threats with high accuracy and reliability. These results are then experimentally validated on the UNSW‐NB15 benchmark to demonstrate effective detection under realistically noisy conditions. The novel contributions of the work are a new hybrid structural paradigm coupled with integrated noise filtering, and ensemble learning. The proposed advanced oversampling with ADASYN gives a performance that surpasses all others with a reported 92.23% accuracy.

Selective Features Based Machine Learned Intrusion Detection Framework for Wireless Sensor Networks: A Need for Cryptographic Approach

Intruder attacks are a curse to wireless sensor network (WSN) nodes that affect their regular performance differently. The attacker cheats the cooperative characteristics of sensing elements pretending as a trustworthy node. Such intruders drastically degrade the WSN performance by affecting the sensing, collecting, processing, and transmitting capabilities of ideal nodes in the network. Due to their pretending behaviour, detecting such harmful nodes in the network is difficult since they are sometimes foes and other times friends. This paper introduces a selective feature-based machine-learning (SF-BML) framework that can detect an intruder node with a higher accuracy. The WSN-DS dataset constructed for four different attacks (Flooding, Blackhole, Grayhole, and Scheduling) is experimented with different feature attributes. The optimum features are found and tested for detection accuracy relating to all five categories. The experimental results using six significant features (SF) and a combination of eight other semi-significant features (SSF) showed that the normal-attacker node's detection accuracy increases with increasing features up to fourteen. The maximum training and test accuracy using fourteen features for the support vector machine (SVM) was 99.17% and 99.00% respectively.

Enhancing cybersecurity in cloud computing and WSNs: A hybrid IDS approach

The evolution of cloud computing has revolutionized how users access services, simplifying the development and deployment of applications across various industries. With its pervasive adoption, robust security measures become imperative. Integrating Intrusion Detection Systems (IDSs) into cloud computing and Wireless Sensor Networks (WSNs) addresses these challenges. IDSs serve as attentive protectors, monitoring network traffic and responding to breaches promptly, enhancing security across industries reliant on cloud services. Similarly, IDS integration in WSNs ensures the security of mission-critical operations, despite resource constraints and dynamic topologies, facilitated by cloud computing. This research proposes a hybrid IDS approach, leveraging the NSL-KDD dataset and methodologies like Intrusion Support Scalar Impact Rate (ISSIR), Optimized Support Vector Machine (OSVM), Extended Long-Short-Term Memory (ELSTM), and Multilayer Perceptron Neural Network (MLPNN), enhancing intrusion detection efficacy. ISSIR aids in feature selection, OSVM mitigates localization errors, ELSTM enables precise anomaly detection, and MLPNN provides robust defense mechanisms. Each method is integrated into a collaborative framework to address specific challenges in detecting intrusions with higher accuracy and reduced false positives. The interplay between these methodologies strengthens the overall intrusion detection framework, addressing the dynamic nature of cybersecurity threats. Results demonstrate the superior performance of MLPNN across various metrics, showcasing its effectiveness in accurately predicting outcomes compared to other models. The proposed MLPNN hybrid system achieves an accuracy of 99.9%, surpassing state-of-the-art methods. This study underscores the significance of advancing IDSs in cloud computing and WSNs, offering insights into enhancing security and mitigating vulnerabilities in an interconnected digital landscape.

An adaptive detection framework based on artificial immune for IoT intrusion detection system

Given the continual evolution of new network attack methodologies, defenders face the imperative of constantly upgrading security defenses. Current security technologies, albeit effective against known threats, often fall short in handling the intricacies of diverse and novel attacks. Artificial immunity-based network anomaly detection offers a promising avenue by dynamically adapting to evolving threats. However, prevailing algorithms in this domain suffer from low detection rates, limited adaptability, and extended detector generation times. This study aims to tackle these challenges by introducing a high-efficiency network anomaly detection framework, emphasizing both high-dimensional feature selection and adaptive detector generation. Our approach begins with an enhanced dual-module hybrid high-dimensional feature selection method, leveraging evolutionary principles. Furthermore, we introduce a self-sample clustering algorithm based on fuzzy clustering during the tolerance stage, enhancing detector tolerance efficiency. Additionally, an adaptive detector generation scheme is devised. It divides the non-boundary sub-population based on non-self differences and evolution, while employing the red fox optimization algorithm in the boundary region. This adaptive approach dynamically adjusts detector positions and radii to derive optimal detectors. Through comprehensive validation using well-established IoT and network anomaly datasets, our proposed artificial immunity-based IoT intrusion detection framework exhibits superior performance. It achieves higher classification accuracy and lower error rates compared to current state-of-the-art machine learning and artificial immunity algorithms.

Review of intrusion detection system in cyber‐physical system based networks: Characteristics, industrial protocols, attacks, data sets and challenges

AbstractCyber‐Physical Systems (CPSs) provide critical infrastructure for the betterment of human lives thereby integrating cyber and physical components but the fusion of physical and digital components leads to an increase in the attack surface, which in turn provides opportunities for the attackers to intrude on these systems, which can affect the critical services like health care, water treatment facility, the electrical grid, hydropower plant, and so forth. The existing intrusion detection systems (IDSs) in CPSs are facing issues like poor detection accuracy, high false alarm rate and more computation time. Also, existing intrusion detection systems cannot identify new attacks that is, zero‐day assaults. Prerequisite exists for the design of the framework for detecting intrusions using artificial intelligence inspired approaches grounded on the principle of ensemble techniques. Intrusion detection framework assimilating ensemble‐based technique for CPS has been proposed. Since the proposed framework incorporates privileges of multiple techniques for intrusion detection and classification, hence the proposed framework may overcome the limitations of existing IDSs for CPS. Overview of cutting‐edge incursion identification methods for CPSs is presented. Several characteristics of CPS, industrial protocols, and anomaly detection techniques for intrusion detection are analyzed. Taxonomy of IDS for CPS has been proposed, taxonomy of attacks and threats on CPS has been intended. Research challenges for IDS in CPS are also uncovered from this review.

Deep intrusion net: an efficient framework for network intrusion detection using hybrid deep TCN and GRU with integral features

Deep intrusion net: an efficient framework for network intrusion detection using hybrid deep TCN and GRU with integral features

A Machine Learning Based Approach for the Detection of DDoS Attacks on Internet of Things Using CICDDoS2019 Dataset - PortMap

In today's technological era, the Internet has become ubiquitous, playing a vital role in our daily lives. With the exponential growth of IoT innovation, millions of interconnected IoT-enabled devices rely on cloud services to communicate over the Internet. However, this rapid development also exposes these devices to various threats, with DDoS (Distributed Denial of Service) and DoS (Denial of Service) attacks being particularly potent and destructive. DDoS attacks present a unique challenge as they are extremely difficult to detect using conventional intrusion detection frameworks and traditional methodologies. Fortunately, advancements in machine learning have provided a promising solution by enabling accurate differentiation between DDoS attacks and other forms of data. This study proposes a DDoS detection model based on machine learning algorithms. To conduct this study, we utilized the most recent and freely available online dataset called CICDDoS2019. Various machine learning-based techniques were explored, aiming to identify the characteristics associated with accurate classification. Among the algorithms tested, AdaBoost and XGBoost demonstrated exceptional performance. As part of future work, a hybrid approach will be incorporated into this model, further improving its capabilities. It is worth noting that this model will be continuously updated with new data on DDoS attacks, ensuring its relevance and effectiveness in combating emerging threats. By leveraging machine learning techniques, this approach enhances the detection of DDoS attacks on Internet of Things networks, safeguarding the integrity and security of connected devices and the overall IoT ecosystem.

MP-GUARD: A novel multi-pronged intrusion detection and mitigation framework for scalable SD-IoT networks using cooperative monitoring, ensemble learning, and new P4-extracted feature set

The ever-increasing complexity of the Internet of Things (IoT) environment demands robust and adaptable intrusion detection frameworks, as existing approaches struggle with real-time traffic analysis, limited scalability, and static feature sets. This paper introduces MP-GUARD, a novel framework that leverages Software-Defined Networking (SDN), machine learning (ML), and a multi-controller architecture to address these challenges. MP-GUARD tackles multi-pronged intrusion attacks in IoT networks by offering real-time intrusion detection, collaborative traffic monitoring, and multi-layered attack mitigation. It achieves this through two core modules: P4-Assisted Cooperative Traffic Monitoring (CTM-P4) and Multi-Pronged Intrusion Detection and Mitigation (MPIDM). CTM-P4 facilitates real-time communication among multiple controllers, enabling dynamic feature extraction leveraging the interconnected state tables within P4-enabled switches. This module introduces a new 22-feature set (12 extracted and 10 computed) for comprehensive network analysis. MPIDM leverages the detailed network insights from CTM-P4 for attack identification and prevention. It introduces Stacked Ensemble Learning with Dynamic P4-Based Feature Selection (SELDP4-FS), achieving exceptional performance with 99.32 % accuracy, 99.24 % F1-score, and 0.49 % false positive rate. Additionally, MPIDM boasts efficient response and detection times of 16ms and 11ms, respectively. Beyond accuracy, MP-GUARD demonstrates significant advantages in terms of scalability and efficiency. The multi-controller architecture offers a 65 % reduction in overhead compared to single-controller setups. Furthermore, this work introduces the Mean Accuracy Steadiness Level (MASL) metric to assess model stability under varying traffic conditions. By combining P4-based feature extraction, dynamic feature selection, cooperative monitoring, ensemble learning, and a multi-controller architecture, MP-GUARD presents a significant contribution to IoT security, offering a scalable and adaptable solution for securing future SD-IoT deployments against evolving threats.

Unified Intrusion Detection Framework: Predictive Analysis of Intrusions in Sensor Networks

Unified Intrusion Detection Framework: Predictive Analysis of Intrusions in Sensor Networks

Nelder-Mead Optimized Weighted Voting Ensemble Learning for Network Intrusion Detection

The rise in internet usage and data transfer rates has led to numerous anomalies. Hence, anomaly-based intrusion detection systems (IDS) are essential in cybersecurity because of their ability to identify unknown cyber-attacks, especially zero-day attacks that signature-based IDS cannot detect. This study proposes an ensemble classification for intrusion detection using a weighted soft voting system with KNN, XGBoost, and Random Forest base models. The base model weights are optimized using the Nelder-Mead simplex method to improve the overall ensemble performance. We propose a robust intrusion detection framework that uses soft-voting classifier-level weights optimized using the Nelder-Mead algorithm and feature selection. We evaluated the system's performance using the KDD99 and UNSW-NB15 datasets, which demonstrated that the proposed approach exceeded other existing methods in respect of accuracy and provided comparable results with fewer features. The proposed system and its hyperparameter optimization technique were compared with other cyber threat detection and mitigation systems to determine their relative effectiveness and efficiency.

Attenuating majority attack class bias using hybrid deep learning based IDS framework

In real-time application domains, like finance, healthcare and defence, delay in service or stealing information may lead to unrecoverable consequences. So, early detection of intrusion is important to prevent security breaches. In recent days, anomaly-based intrusion detection using Hybrid Deep Learning approaches are becoming more popular. The most used benchmark datasets in the literature are NSL-KDD and UNSW-NB15, and these datasets are imbalanced. The models built on imbalanced datasets may lead to biased results towards majority classes by neglecting the minority class, even though they are equally important. In many cases, high accuracy is achieved for majority classes in the imbalanced datasets. But, the class-level performances are poor with respect to the minority class. The class balancing will also play an important role in attenuating the bias in prediction for imbalanced datasets. In this paper, a Hybrid Deep Learning Based Intrusion Detection (HDLBID) framework is proposed with CNN-BiLSTM combination. The four techniques, namely, Random Oversampling (ROS), ADASYN, SMOTE, and SMOTE-Tomek, are used for class balancing in the proposed HDLBID framework. The proposed HDLBID with SMOTE-Tomek achieves an overall accuracy of 99.6% with NSL-KDD and 89.02% for UNSW-NB15. It results in an improvement of 13.67% for NSL-KDD and 10.62% for UNSW-NB15 over the existing recent related models. In the proposed HDLBID, in addition to overall accuracy, the class-level F1 score is also calculated. A comparative study is presented to show the effectiveness of balancing dataset compared to imbalanced dataset, and observed that the SMOTE-Tomek class balancing comparatively performed well. An improvement of 37.43% is observed in the U2R class of the NSL-KDD dataset and 61.65% improvement is seen in the Worms class of the UNSW-NB15 dataset, both with SMOTE-Tomek class balancing. Therefore, the proposed HDLBID with SMOTE-Tomek class balancing reports the best results in terms of overall accuracy compared to existing recent related approaches. Also, in terms of class-level analysis, HDLBID reports best results with SMOTE-Tomek over imbalanced version of datasets.

IoV-BCFL: An intrusion detection method for IoV based on blockchain and federated learning

In recent years, Internet of Vehicles (IoV) is in a booming stage. But at the same time, the methods of attack against IoV such as Denial of Service (DoS) and deception are great threats to personal and social security. Traditional IoV intrusion detection usually adopts a centralized detection model, which has the disadvantages of untimely detection results and is difficult to protect vehicle privacy in practical applications. Meanwhile, centralized computation requires a large amount of vehicle data transmission, which overloads the wireless bandwidth. Combined the distributed computing resources of Federated Learning (FL) and the decentralized features of blockchain, an IoV intrusion detection framework named IoV-BCFL is proposed, which is capable of distributed intrusion detection and reliable logging with privacy protection. FL is used for distributing training on vehicle nodes and aggregating the training models at Road Side Unit (RSU) to reduce data transmission, protect the privacy of training data, and ensure the security of the model. A blockchain-based intrusion logging mechanism is presented, which enhances vehicle privacy protection through Rivest-Shamir-Adleman (RSA) algorithm encryption and uses Inter Planetary File System (IPFS) to store the intrusion logs. The intrusion behavior can be faithfully recorded by logging smart contract after detecting the intrusion, which can be used to track intruders, analyze security vulnerabilities, and collect evidence. Experiments based on different open source datasets show that FL achieves a high detection rates on intrusion data and effectively reduce the communication overhead, the smart contract performs well on evaluation indicators such as sending rate, latency, and throughput.

HEN: a novel hybrid explainable neural network based framework for robust network intrusion detection

HEN: a novel hybrid explainable neural network based framework for robust network intrusion detection

A Deep Intelligent Hybrid Intrusion Detection Framework with LIME

Network security has grown to be a major issue as a result of the development of Internet of Things (IoT) devices. Attacks known as Distributed Denial of Service (DDoS) can overwhelm and impair networks. In order to identify DDoS and other network intrusion threats in real-time, accurately, and with justification, this study suggests a unique deep learning-driven fog computing architecture named as Deep Intelligent Hybrid Intrusion Detection Framework with LIME (DIHIF-LIME). The main advancement is the creation of a hybrid intrusion detection system that integrates randomness measurements taken from network traffic with a K-Nearest Neighbor (KNN) machine learning classifier. The justification for predictions is explained using Local Interpretable Model-Agnostic Explanations (LIME), which promotes explainability. Using datasets including network assaults, Long-Short-Term Memory (LSTM) neural networks are created and compared. Utilizing 5-fold cross-validation, LSTM outperformed benchmarks with the maximum accuracy of 99.97%. In conclusion, the proposed fog computing intrusion detection framework with LIME explainability offers a rapid, precise, scalable, and interpretable end-to-end solution from IoT devices to the cloud. A thorough test shows that the method is effective in protecting IoT networks from DDoS and other assaults. The two main advances th­­at are presented are hybrid detection and LIME explainability.