Intrusion Detection Framework Research Articles

Network Database Security in Wireless Sensor Networks with Intellectual Access of using Outlier Detection Techniques

In the field of information mining, exceptions are likewise alluded to as outliers, variations from the norm, discordant perceptions, or freaks. Other application spaces may utilize terms like exceptions, amazements, or contaminants. Every one of these wordings is catching a deviation from an expected ordinary information demonstration. In this research work, another system that comprises of an Intelligent Agent Based Access Control subsystem and Intrusion Detection subsystem for securing the Web Database has been proposed and actualized. With a specific end goal to give a viable access control framework, new access control variable based math and new arrangements utilizing rules have been proposed and executed. Keeping in mind the end goal to perform interruption and outlier identification successfully, a half and half Intelligent Agent based Intrusion Detection framework has been proposed in this work which enhances the security of the network database.

An adaptive distributed Intrusion detection system architecture using multi agents

Intrusion detection systems are used for monitoring the network data, analyze them and find the intrusions if any. The major issues with these systems are the time taken for analysis, transfer of bulk data from one part of the network to another, high false positives and adaptability to the future threats. These issues are addressed here by devising a framework for intrusion detection. Here, various types of co-operating agents are distributed in the network for monitoring, analyzing, detecting and reporting. Analysis and detection agents are the mobile agents which are the primary detection modules for detecting intrusions. Their mobility eliminates the transfer of bulk data for processing. An algorithm named territory is proposed to avoid interference of one analysis agent with another one. A communication layout of the analysis and detection module with other modules is depicted. The inter-agent communication reduces the false positives significantly. It also facilitates the identification of distributed types of attacks. The co-ordinator agents log various events and summarize the activities in its network. It also communicates with co-ordinator agents of other networks. The system is highly scalable by increasing the number of various agents if needed. Centralized processing is avoided here to evade single point of failure. We created a prototype and the experiments done gave very promising results showing the effectiveness of the system.

DL‐IDS: a deep learning–based intrusion detection framework for securing IoT

AbstractThe Internet of Things (IoT) is comprised of numerous devices connected through wired or wireless networks, including sensors and actuators. Recently, the number of IoT applications has increased dramatically, including smart homes, vehicular ad hoc network (VANETs), health care, smart cities, and wearables. As reported in IHS Markit (see https://technology.ihs.com), the number of connected devices is projected to jump from approximately 27 billion in 2017 to 125 billion in 2030, an average annual increment of 12%. Security is a critical issue in today's IoT field because of the nature of the architecture, the types of devices, different methods of communication (mainly wireless), and the volume of data being transmitted over the network. Security becomes even more important as the number of devices connected to the IoT increases. To overcome the challenges of securing IoT devices, we propose a new deep learning–based intrusion detection system (DL‐IDS) to detect security threats in IoT environments. There are many IDSs in the literature, but they lack optimal features learning and data set management, which are significant issues that affect the accuracy of attack detection. Our proposed module combines the spider monkey optimization (SMO) algorithm and the stacked‐deep polynomial network (SDPN) to achieve optimal detection recognition; SMO selects the optimal features in the data sets and SDPN classifies the data as normal or anomalies. The types of anomalies detected by DL‐IDS include denial of service (DoS), user‐to‐root (U2R) attack, probe attack, and remote‐to‐local (R2L) attack. Extensive analysis indicates that the proposed DL‐IDS achieves better performance in terms of accuracy, precision, recall, and F‐score.

An Intelligent Game Theory based Intrusion Detection Framework and Enhanced Dolphin Swarm Algorithm (EDSA) based Cluster Head Election for Vehicle Security

An Intelligent Game Theory based Intrusion Detection Framework and Enhanced Dolphin Swarm Algorithm (EDSA) based Cluster Head Election for Vehicle Security

An intrusion detection framework for energy constrained IoT devices

• We present a novel intrusion detection framework for industrial IoT applications. • We investigate intrusion detection via collaboration between device and edge IoT. • A formal evaluation for security capabilities of proposed framework is presented. • Rigorous evaluation of proposed framework demonstrates its performance efficiency. Industrial Internet of Things (IIoT) exemplifies IoT with applications in manufacturing, surveillance, automotive, smart buildings, homes and transport. It leverages sensor technology, cutting edge communication and data analytics technologies and the open Internet to consolidate IT and operational technology (OT) aiming to achieve cost and performance benefits. However, the underlying resource constraints and ad hoc nature of such systems have significant implications especially in achieving effective intrusion detection. Consequently, contemporary solutions requiring a stable infrastructure and extensive computational resources are inadequate to fulfill these characteristics of an IIoT system. In this paper, we propose an intrusion detection framework for the energy-constrained IoT devices which form the foundation of an IIoT ecosystem. In view of the ad hoc nature of such systems as well as emerging complex threats such as botnets, we assess the feasibility of collaboration between the host (IoT devices) and the edge devices for effective intrusion detection whilst minimizing energy consumption and communication overhead. We implemented the proposed framework with Contiki operating system and conducted rigorous evaluation to identify potential performance trade-offs. The evaluation results demonstrate that the proposed framework can minimize energy and communication overheads whilst achieving an effective collaborative intrusion detection for IIoT systems.

Intrusion Detection System Performing a Distributed Novel Hybrid Intrusion Detection Framework

Intrusion detection is the one of the major problem in network security, as the use of computer system and network increases, securing data is one of the important in order to achieve secure data transmission without hacking. Intrusions are the activities that violate the security policy of system. The process used to identify intrusions. Today network securities are used in various applications like protect vital information while still allowing access to those who need Trade secrets, Medical records etc. In this paper proposed to a novel hybrid intrusion detection framework methodology and its four various level of phases.

Privacy-Preserving Ddos Attack Detection using Cross-Domain: Challenges and Research

In this paper, we present a review of on hand IDS (Intrusion Detection Techniques) for DDoS assaults. Interruption discovery framework is a well known and computationally costly task. We additionally clarify the essentials of interruption identification framework. We represent the present methodologies for Intrusion Detection framework. From the expansive assortment of proficient procedures that have been created we will look at the most significant ones. Their qualities and shortcomings are likewise researched. For reasons unknown, the conduct of the calculations is substantially more comparative as not out of the ordinary.

Trust-Evaluation-Based Intrusion Detection and Reinforcement Learning in Autonomous Driving

With ever-increasing penetration of autonomous driving vehicles (ADVs), security becomes of significant essence to autonomous vehicular networks (AVNs). On one hand, although cryptographic systems help deal with various attacks, they cannot resolve inside attacks from compromised or malfunctioning ADVs. On the other hand, ADVs with higher automated levels are easier to attack because the automated components onboard are vulnerable to inside attacks. These issues can be mitigated well by trust-based intrusion detection. Therefore,this article presents an efficient trust-based intrusion detection framework for AVNs. First, we propose a novel trust evaluation model for ADVs, in which all the trust evaluation information of a given ADV is utilized to compute its trust value. Then, based on the trust evaluation model, a two-level intrusion detection framework is presented. In the framework, the trustworthiness of an accident or attack warning is established not only based on trust evaluation with the coverage of a roadside unit (RSU), but also the information exchanged between RSUs through the cloud server. Afterward, we propose a reinforcement-learning-based incentive mechanism to stimulate ADVs to report warnings. Through the case study, the proposed framework outperforms the conventional mechanism and can reach a higher warnin

Data Mining based Framework for Effective Intrusion Detection using Hybrid Feature Selection Approach

Data Mining based Framework for Effective Intrusion Detection using Hybrid Feature Selection Approach

Power information network intrusion detection based on data mining algorithm

Intrusion detection technology plays an important role in ensuring information security. This paper briefly describes the intrusion detection technology and its development history. Based on the analysis of power information network structure and its security partition, this paper proposes a power information network intrusion detection framework for the intrusion attack problem of power information network and elaborates the implementation of each module. The association rule analysis algorithm and the association relationship between network data stream features can effectively detect the intrusion behaviour in the power information network. Experiments show that the intrusion detection system can effectively detect the intrusion attacks in the power information network and effectively protect the power information.

A novel approach to intrusion detection using SVM ensemble with feature augmentation

Network security has been a very important problem. Intrusion detection systems have been widely used to protect network security. Various machine learning techniques have been applied to improve the performance of intrusion detection systems, among which ensemble learning has received a growing interest and is considered as an effective method. Besides, the quality of training data is also an essential determinant that can greatly enhance the detection capability. Knowing that the marginal density ratios are the most powerful univariate classifiers. In this paper, we propose an effective intrusion detection framework based on SVM ensemble with feature augmentation. Specifically, the logarithm marginal density ratios transformation is implemented on the original features with the goal of obtaining new and better-quality transformed training data; SVM ensemble was then used to build the intrusion detection model. Experiment results show that our proposed method can achieve a good and robust performance, which possesses huge competitive advantages when compared to other existing methods in terms of accuracy, detection rate, false alarm rate and training speed.

Context aware intrusion detection for building automation systems

The Internet of Things (IoT) will connect not only computers and mobile devices, but also smart cities, buildings, and homes, as well as electrical grids, gas, and water networks, automobiles, airplanes, etc. IoT will lead to extensive interconnection between Building Automation Systems (BAS) communication protocols and the Internet. The connection to Internet and public networks increases significantly the risk of the BAS networks being attacked, since there's a significant lack of detection and defensive mechanisms for BAS networks. In this paper, we present a framework for a context-aware intrusion detection of a widely deployed Building Automation and Control network. We developed runtime models for service interactions and functionality patterns by modeling the heterogeneous information that is continuously acquired from building assets into a novel BAS context aware data structure. Our IDS performs anomaly based behavior analysis to accurately detect anomalous events triggered by cyber-attacks or any functional failure. An attack classification and severity analysis of detected attacks allow our IDS to automatically launch protective countermeasures. We evaluate our approach in the Smart Building testbed developed at the University of Arizona Center for Cloud and Autonomic Computing, by launching several cyber-attacks that exploit the generic vulnerabilities of BACnet protocol.

A Multi-Source Data Oriented Network Intrusion Detection Framework Based on Rough Set

Network Intrusion Detection System (IDS) plays an important role in defending against more and more network malicious attacks. As the structure of IDS is growing more and more complex, both the varieties and quantities of the network security devices in IDS are constantly growing, and the size of data that need to process in IDS is also growing rapidly. As a result, there is a need for a framework that can detect network attacks accurately and effectively, while can process multi-source data at the same time. In this paper, we propose a new multi-source data oriented framework based on Rough Set for network intrusion detection. The experimental results show the proposed framework reduces the false alarm rate and improves overall detection accuracy. Furthermore, practical applications show that the framework can handle a large size of data in a complex IDS.

A Detailed Description on Unsupervised Heterogeneous Anomaly Based Intrusion Detection Framework

Observing network traffic flow for anomalies is a common method in Intrusion Detection. More effort has been taken in utilizing the data mining and machine learning algorithms to construct anomaly based intrusion detection systems, but the dependency on the learned models that were built based on earlier network behaviour still exists, which restricts those methods in detecting new or unknown intrusions. Consequently, this investigation proposes a structure to identify an extensive variety of abnormalities by analysing heterogeneous logs, without utilizing either a prepared model of system transactions or the attributes of anomalies. To accomplish this, a current segment (clustering) has been used and a few new parts (filtering, aggregating and feature analysis) have been presented. Several logs from multiple sources are used as input and this data are processed by all the modules of the framework. As each segment is instrumented for a particular undertaking towards a definitive objective, the commitment of each segment towards abnormality recognition is estimated with various execution measurements. Ultimately, the framework is able to detect a broad range of intrusions exist in the logs without using either the attack knowledge or the traffic behavioural models. The result achieved shows the direction or pathway to design anomaly detectors that can utilize raw traffic logs collected from heterogeneous sources on the network monitored and correlate the events across the logs to detect intrusions.

Intrusion detection in smart cities using Restricted Boltzmann Machines

Smart cities have received greater attention over the recent years. Despite its popularity, unsecured smart city networks have become potential back door entry points. Distributed Denial of Service (DDoS) attacks are one of the most widespread threats to smart city infrastructure. In this paper, a smart city intrusion detection framework based on Restricted Boltzmann Machines (RBMs) is proposed. RBMs are applied due to their ability to learn high-level features from raw data in an unsupervised way and handle real data representation generated from smart meters and sensors. On top of these extracted features, different classifiers are trained. The performance of the proposed methodology is tested and benchmarked using a dataset from a smart water distribution plant. The results show the efficiency of the proposed methodology in attack detection with high accuracy. In addition, the proposed methodology outperforms the classification model applied without features learning step.

High-speed railway perimeter intrusion detection approach based on Internet of Things

Efficient perimeter intrusion detection approach is vital to safety management of China high-speed railway. In this article, for high-speed railway perimeter intrusion detection problem, a perimeter intrusion detection framework based on Internet of Things is designed to integrate different detection sensors. A data fusion algorithm was proposed to fuse multisensor data for improving detection precision. Computational results of normal condition and severe weather environment show our approach is effective and efficient for high-speed railway perimeter intrusion detection under Internet of Things, and is significant for safety management of China high-speed railway.

$Deep-Full-Range$ : A Deep Learning Based Network Encrypted Traffic Classification and Intrusion Detection Framework

With the rapid evolution of network traffic diversity, the understanding of network traffic has become more pivotal and more formidable. Previously, traffic classification and intrusion detection require a burdensome analyzing of various traffic features and attack-related characteristics by experts, and even, private information might be required. However, due to the outdated features labeling and privacy protocols, the existing approaches may not fit with the characteristics of the changing network environment anymore. In this paper, we present a light-weight framework with the aid of deep learning for encrypted traffic classification and intrusion detection, termed as deep-full-range (DFR). Thanks to deep learning, DFR is able to learn from raw traffic without manual intervention and private information. In such a framework, our proposed algorithms are compared with other state-of-the-art methods using two public datasets. The experimental results show that our framework not only can outperform the state-of-the-art methods by averaging 13.49% on encrypted traffic classification's F1 score and by averaging 12.15% on intrusion detection's F1 score but also require much lesser storage resource requirement.

A Framework for Intrusion Detection Based on Workflow Mining

Information systems handle large amount of data within enterprises by offering the possibility to collect, treat, keep and make information available. To achieve this, it is crucial to secure data from intrusion that disturb confidentiality, availability, and integrity of data. This integrity must follow the strategic alignment of the considered enterprise. Unfortunately, the goal of attackers is to affect the resources present in the system. Research in intrusion detection field is still in search of proposals to relevant problems. Many solutions exist supporting machine learning and datamining models. Nevertheless, these solutions based on signature and behavior approaches of intrusion detection, are more interested in data and have not a global view of processes. The aim of this paper is to use workflow mining for a Host-based intrusion detection by monitoring workflow event logs related to resources. With workflow mining, process execution are stored in event logs and the detection of intrusion can be realized by their analysis on the basis of a well-defined security policy. To achieve our goal, step by step, we start by the specification of different concepts manipulated. Afterwards, we provide a model of security policy and a model of intrusion detection that enables us to have a low rate of false alerts. Finally, we implement the solution via a prototype to observe how it can work.

COLIDE: a collaborative intrusion detection framework for Internet of Things

Internet of Things (IoT) represent a network of resource-constrained sensor devices connected through the open Internet, susceptible to misuse by intruders. Traditional standalone intrusion detection systems (IDS) are tasked with monitoring device behaviours to identify malicious activities. These systems not only require extensive network and system resources but also cause delays in detecting a malicious actor due to unavailability of a comprehensive view of the intruder's activities. Collaboration among IoT devices enables considering knowledge from a collection of host and network devices to achieve improved detection accuracy in a timely manner. However, collaboration introduces the challenge of energy efficiency and event processing which is particularly significant for resource-constrained devices. In this paper, we present a collaborative intrusion detection framework (COLIDE) for IoT leveraging collaboration among resource-constrained sensor and border nodes for effective and timely detection of intruders. The paper presents a detailed formal description of the proposed framework along with analysis to assess its effectiveness for a typical IoT system. We implemented the COLIDE framework with Contiki OS and conducted thorough experimentation to evaluate its performance. The evaluation demonstrates efficiency of COLIDE framework with respect to energy and processing overheads achieving effectiveness within an IoT system.

HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems

Critical infrastructures, e.g., electricity generation and dispersal networks, chemical processing plants, and gas distribution, are governed and monitored by supervisory control and data acquisition systems (SCADA). Detecting intrusion is a prevalent area of study for numerous years, and several intrusion detection systems have been suggested in the literature for cyber-physical systems and industrial control system (ICS). In recent years, the viruses seismic net, duqu, and flame against ICS attacks have caused tremendous damage to nuclear facilities and critical infrastructure in some countries. These intensified attacks have sounded the alarm for the security of the ICS in many countries. The challenge in constructing an intrusion detection framework is to deal with unbalanced intrusion datasets, i.e. when one class is signified by a lesser amount of instances (minority class). To this end, we outline an approach to deal with this issue and propose an anomaly detection method for the ICS. Our proposed approach uses a hybrid model that takes advantage of the anticipated and consistent nature of communication patterns that occur among ground devices in ICS setups. First, we applied some preprocessing techniques to standardize and scale the data. Second, the dimensionality reduction algorithms are applied to improve the process of anomaly detection. Third, we employed an edited nearest-neighbor rule algorithm to balance the dataset. Fourth, by using the Bloom filter, a signature database is created by noting the system for a specific period lacking the occurrence of abnormalities. Finally, to detect new attacks, we combined our package contents-level detection with another instance-based learner to make a hybrid method for anomaly detection. The experimental results with a real large-scale dataset generated from a gas pipeline SCADA system show that the proposed approach HML-IDS outperforms the benchmark models with an accuracy rate of 97%.