Intrusion Detection Framework Research Articles

A Network Intrusion Detection Framework based on Bayesian Network using Wrapper Approach

A Network Intrusion Detection Framework based on Bayesian Network using Wrapper Approach

Intrusion Detection and Ejection Framework Against Lethal Attacks in UAV-Aided Networks: A Bayesian Game-Theoretic Methodology

Advances in wireless communications and microelectronics have spearheaded the development of unmanned aerial vehicles (UAVs), which can be used to augment a ground network composed of sensors and/or vehicles in order to increase coverage, enhance the end-to-end delay, and improve data processing. While UAV-aided networks can potentially find applications in many areas, a number of issues, particularly security, have not been readily addressed. The intrusion detection system is the most commonly used technique to detect attackers. In this paper, we focus on addressing two main issues within the context of intrusion detection and attacker ejection in UAV-aided networks, namely, activation of the intrusion monitoring process and attacker ejection. In fact, when a large number of nodes activate their monitoring processes, the incurred overhead can be substantial and, as a consequence, degrades the network performance. Therefore, a tradeoff between the intrusion detection rate and overhead is considered in this work. It is not always the best strategy to eject a node immediately when it exhibits a bad sign of malicious activities since this sign could be provisional (the node may switch to a normal behavior in the future) or be simply due to noise or unreliable communications. Thus, a dilemma between detection and false positive rates is taken into account in this paper. We propose to address these two security issues by a Bayesian game model in order to accurately detect attacks (i.e., high detection and low false positive rates) with a low overhead. Simulation results have demonstrated that our proposed security game framework does achieve reliable detection.

Attack Classification Schema for Smart City WSNs.

Urban areas around the world are populating their streets with wireless sensor networks (WSNs) in order to feed incipient smart city IT systems with metropolitan data. In the future smart cities, WSN technology will have a massive presence in the streets, and the operation of municipal services will be based to a great extent on data gathered with this technology. However, from an information security point of view, WSNs can have failures and can be the target of many different types of attacks. Therefore, this raises concerns about the reliability of this technology in a smart city context. Traditionally, security measures in WSNs have been proposed to protect specific protocols in an environment with total control of a single network. This approach is not valid for smart cities, as multiple external providers deploy a plethora of WSNs with different security requirements. Hence, a new security perspective needs to be adopted to protect WSNs in smart cities. Considering security issues related to the deployment of WSNs as a main data source in smart cities, in this article, we propose an intrusion detection framework and an attack classification schema to assist smart city administrators to delimit the most plausible attacks and to point out the components and providers affected by incidents. We demonstrate the use of the classification schema providing a proof of concept based on a simulated selective forwarding attack affecting a parking and a sound WSN.

Hybrid of anomaly-based and specification-based IDS for Internet of Things using unsupervised OPF based on MapReduce approach

Internet of Things (IoT) is a novel paradigm in computer networks in which resource-constrained objects connect to unreliable Internet by using a wide range of technologies. The insecure nature of the Internet and wireless sensor networks, that are the main components of IoT, make IoT vulnerable to different attacks, especially routing attacks (as insider attacks). A novel real-time hybrid intrusion detection framework is proposed in this study that consists of anomaly-based and specification-based intrusion detection modules for detecting two well-known routing attacks in IoT called sinkhole and selective-forwarding attacks. For this purpose, the specification-based intrusion detection agents, that are located in the router nodes, analyze the behavior of their host nodes and send their local results to the root node through normal data packets. In addition, an anomaly-based intrusion detection agent, that is located in the root node, employs the unsupervised optimum-path forest algorithm for projecting clustering models by using incoming data packets. This agent, which is based on the MapReduce architecture, can work in a distributed platform for projecting clustering models and consequently parallel detecting of anomalies as a global detection approach. The proposed method makes decision about suspicious behavior by using a voting mechanism. Notably, the proposed method is also extended to detect wormhole attack. The deployment of the hybrid proposed model is investigated in a smart-city scenario by an existing platform, as well. The free network's scale and the ability to identify malicious nodes are two key features of the proposed framework that are evaluated through different experiments in this study. The experimental results of simulated scenarios showed that the proposed hybrid method can achieve true positive rate of 76.19% and false positive rate of 5.92% when both sinkhole and selective-forwarding attacks were launched simultaneously. These rates in detecting wormhole attack are 96.02% and 2.08%, respectively.

An efficient intrusion detection and prevention framework for ad hoc networks

Purpose Wireless multi-hop ad hoc networks are becoming very attractive and widely deployed in many kinds of communication and networking applications. However, distributed and collaborative routing in such networks makes them vulnerable to various security attacks. This paper aims to design and implement a new efficient intrusion detection and prevention framework, called EIDPF, a host-based framework suitable for mobile ad hoc network’s characteristics such as high node’s mobility, resource-constraints and rapid topology change. EIDPF aims to protect an AODV-based network against routing attacks that could target such network. Design/methodology/approach This detection and prevention framework is composed of three complementary modules: a specification-based intrusion detection system to detect attacks violating the protocol specification, a load balancer to prevent fast-forwarding attacks such as wormhole and rushing and adaptive response mechanism to isolate malicious node from the network. Findings A key advantage of the proposed framework is its capacity to efficiently avoid fast-forwarding attacks and its real-time detection of both known and unknown attacks violating specification. The simulation results show that EIDPF exhibits a high detection rate, low false positive rate and no extra communication overhead compared to other protection mechanisms. Originality/value It is a new intrusion detection and prevention framework to protect ad hoc network against routing attacks. A key strength of the proposed framework is its ability to guarantee a real-time detection of known and unknown attacks that violate the protocol specification, and avoiding wormhole and rushing attacks by providing a load balancing route discovery.

Hybrid Intrusion Detection Framework for Ad hoc networks

In this paper, a cluster-based hybrid security framework called HSFA for ad hoc networks is proposed and evaluated. The proposed security framework combines both specification and anomaly detection techniques to efficiently detect and prevent wide range of routing attacks. In the proposed hierarchical architecture, cluster nodes run a host specification-based intrusion detection system to detect specification violations attacks such as fabrication, replay, etc. While the cluster heads run an anomaly-based intrusion detection system to detect wormhole and rushing attacks. The proposed specification-based detection approach relies on a set of specifications automatically generated, while anomaly-detection uses statistical techniques. The proposed security framework provides an adaptive response against attacks to prevent damage to the network. The security framework is evaluated by simulation in presence of malicious nodes that can launch different attacks. Simulation results show that the proposed hybrid security framework performs significantly better than other existing mechanisms.

A new ontology‐based multi agent framework for intrusion detection

SummaryOntologies play an essential role in knowledge sharing and exploration, especially in multiagent systems. Intrusion is an unauthorized activity in a network, which is achieved by either active manner (information gathering) or passive manner (harmful packet forwarding). Most of the existing intrusion detection system (IDS) suffers from the following issues: it is usually adjusted to detect known service level network attacks and leaves from vulnerable to original and novel malicious attacks. Thus, it provides low accuracy and detection rate, which are the important problems of existing IDS. To overwhelm these drawbacks, an ontology‐based multiagent IDS framework is developed in this work for intrusion detection. The main intention of this work is to detect the network attacks with the help of multiple detection agents. In this analysis, there are 3 different types of agents, ie, IDS broker, deputy commander, and response agent, which are used to prevent and detect the attacks in a network. The novel concept of this work is based on the concept of signature matching; it identifies and detects the attackers with the help of multiple agents.

Virtualization layer security challenges and intrusion detection/prevention systems in cloud computing: a comprehensive review

Virtualization plays a vital role in the construction of cloud computing. However, various vulnerabilities are existing in current virtualization implementations, and thus there are various security challenges at virtualization layer. In this paper, we investigate different vulnerabilities and attacks at virtualization layer of cloud computing. We examine the proposals of cloud intrusion detection system (IDS) and intrusion detection and prevention system frameworks. We recommend the cloud IDS requirements and research scope to achieve desired level of security at virtualization layer of cloud computing.

Intrusion Detection System to Overcome a Novel Form of Replay Attack (Data Replay) in Wireless Sensor Networks

Wireless Sensor Networks (WSNs) are widely and successfully employed in various application domains. They are easily deployed to collect valuable information and monitor potential environmental phenomena. However, the special nature of WSNs as well as their severe constraints and resource limitations make them vulnerable to various types of threats. Replay attack, is one example. According to this attack, the adversary intercepts and replays several times the same (old) message leading either to missed alerts or to false alerts. Many solutions have been proposed to mitigate message replay attack. However, all these solutions are of cryptographic natures and consider only external attacks exercising a trivial scenario of replay attack. In fact, the attacker could be a lot smarter, and in this case, it replays only the data field in the message while keeping the remaining fields updated. This novel form of replay attack is much more dangerous and difficult to be detected. We call this attack variant by data replay attack. As sensor nodes may be easily captured and compromised, the worst scenario occurs if data replay attack is performed by an internal intruder. In this paper we propose an efficient intrusion detection framework to overcome data replay attack in WSNs. The proposed intrusion detection system is named DR-IDS (Data Replay Intrusion Detection System). The performance evaluations performed under NS2 simulator show that the proposed solution is sufficiently robust.

An effective intrusion detection framework based on MCLP/SVM optimized by time-varying chaos particle swarm optimization

Many organizations recognize the necessities of utilizing sophisticated tools and systems to protect their computer networks and reduce the risk of compromising their information. Although many machine-learning-based data classification algorithm has been proposed in network intrusion detection problem, each of them has its own strengths and weaknesses. In this paper, we propose an effective intrusion detection framework by using a new adaptive, robust, precise optimization method, namely, time-varying chaos particle swarm optimization (TVCPSO) to simultaneously do parameter setting and feature selection for multiple criteria linear programming (MCLP) and support vector machine (SVM). In the proposed methods, a weighted objective function is provided, which takes into account trade-off between the maximizing the detection rate and minimizing the false alarm rate, along with considering the number of features. Furthermore, to make the particle swarm optimization algorithm faster in searching the optimum and avoid the search being trapped in local optimum, chaotic concept is adopted in PSO and time varying inertia weight and time varying acceleration coefficient is introduced. The performance of proposed methods has been evaluated by conducting experiments with the NSL-KDD dataset, which is derived and modified from well-known KDD cup 99 data sets. The empirical results show that the proposed method performs better in terms of having a high detection rate and a low false alarm rate when compared with the obtained results using all features.

A Heterogeneous Framework to Detect Intruder Attacks in Wireless Sensor Networks

Wireless sensor network (WSN) has been broadly implemented in real world applications, such as monitoring of forest fire, military targets detection, medical and/or science areas and above all in our daily home life as well. Nevertheless, WSNs are effortlessly compromised by adversaries due to their broadcast transmission medium as a means of communication which are lacking in tamper resistance. Consequently, an intruder can over hear all traffic, replay previous messages, inject malicious data packets, or can compromise a node. Commonly, sensor nodes are very much vulnerable of two main issues in security aspect that are node authentication and compromising a node. In this paper, a heterogeneous framework of node capture and intrusion detection for WSNs is proposed. This framework efficiently detects the captured nodes by using a novel technique, embedded with an Intrusion Detection mechanism which aggregates Signature and Anomaly based approach with Neural Network Multi-Layer Perceptron (MLP) classification in a clustering environment. Moreover, the proposed framework achieves efficiency at reasonable computation and communication costs and it can be a security shield to real WSN applications.

Advocating for Hybrid Intrusion Detection Prevention System and Framework Improvement

The network systems of the world are fragile, and can come under attack from any source. The attack can be a denial-of-service (DoS) state or another type of threat. What keep the networks safe are the intrusion detection and prevention systems (IDPS). They constantly monitor network traffic and if a malicious threat is detected, the threat is blocked and reported for further analysis. However, every defensive system must always have some type of weakness. False negatives and false positives are some examples of how IDPS can fail to protect the network. In another instance, a skilled attacker may employ Direct Kernel Object Modification (DKOM) to trick the IDPS into detecting no malicious activities. The IDPS is strong, yet not strong enough. This paper presents a hybrid solution that incorporates both signature and anomaly based systems to detect and prevent more malicious attacks by intensifying what is cataloged to include common anomalies to the baselines used by the signature based systems. We also propose an improvement in the framework to current Host IDPS/Network using signature and anomaly based methodologies by implementing a hybrid VMM-based Honeypot into a theorized self-healing hybrid IDPS to further boost their advantages in efficiency and accuracy.

A Cooperative and Hybrid Network Intrusion Detection Framework in Cloud Computing Based on Snort and Optimized Back Propagation Neural Network

Cloud computing provides a framework for supporting end users easily attaching powerful services and applications through Internet. To give secure and reliable services in cloud computing environment is an important issue. Providing security requires more than user authentication with passwords or digital certificates and confidentiality in data transmission, because it is vulnerable and prone to network intrusions that affect confidentiality, availability and integrity of Cloud resources and offered services. To detect DoS attack and other network level malicious activities in Cloud, use of only traditional firewall is not an efficient solution. In this paper, we propose a cooperative and hybrid network intrusion detection system (CH-NIDS) to detect network attacks in the Cloud environment by monitoring network traffic, while maintaining performance and service quality. In our NIDS framework, we use Snort as a signature based detection to detect known attacks, while for detecting network anomaly, we use Back-Propagation Neural network (BPN). By applying snort prior to the BPN classifier, BPN has to detect only unknown attacks. So, detection time is reduced. To solve the problem of slow convergence of BPN and being easy to fall into local optimum, we propose to optimize the parameters of it by using an optimization algorithm in order to ensure high detection rate, high accuracy, low false positives and low false negatives with affordable computational cost. In addition, in this framework, the IDSs operate in cooperative way to oppose the DoS and DDoS attacks by sharing alerts stored in central log. In this way, unknown attacks that were detected by any IDS can easily be detected by others IDSs. This also helps to reduce computational cost for detecting intrusions at others IDS, and improve detection rate in overall the Cloud environment.

A NOVEL DISTRIBUTED INTRUSION DETECTION FRAMEWORK FOR NETWORK ANALYSIS

Computer networks are used to transfer information between different types of computer devices. Due to rapid development in internet technologies, network users and communication increases day by day. Hence there is a need for huge data analysis, but a currently available tool has been facing a bottleneck. The volume of data along with the speed it generates makes it difficult for the current available tools to handle big data. To overcome this situation, big data packet analysis can be performed through a cloud computing platform for distributed storage (HDFS) and distributed processing (map reduce). However, with the extensive use of cloud computing, security issues arise. With increase of networks, security methods also need to be increased day by day. Hence, intrusion detection system (IDS) are essential components in secure network environment monitors network traffic and allows early detection attacks and alerts the system. Snort is most commonly used IDS available under GPL, which allows pattern search. Hence, there is an urgent need to intelligent intrusion detection systems (IDSs) to detect intrusions automatically. The functionality of Snort IDS can be extended by integrating anomaly preprocessor to detect new attacks. This paper provides a novel distributed Intrusion detection framework for network analysis using snort and Hadoop.

An Efficient Approach for Dynamic Distributed Network Intrusion Detection using Online Adaboost-based Parameterized Methods

Modern network intrusion detection systems are short of flexibility to the frequently altering network surroundings. Additionally, intrusion detection in the new distributed architectures is now a major requirement. In this paper, we propose online Adaboost-based intrusion detection algorithms. In an enhanced algorithm online Adaboost process and online Gaussian mixture models (GMMs) are used as weak classifiers. We further propose a distributed intrusion detection framework, in which a local parameterized detection model is created in each node using the online Adaboost algorithm. A global detection model is constructed in each node by merging the local parametric models using a small number of samples in the node. This combination is accomplished using an algorithm based on particle swarm optimization (PSO) and support vector machines. The global model in each node is used to detect intrusions. Investigational results show that the enhanced online Adaboost process with GMMs gets a superior detection rate and a lower false alarm rate than the traditional online Adaboost process that uses decision stumps. Both the algorithms outperform existing intrusion detection algorithms. It is also shown that our PSO, and SVM-based algorithm efficiently merge the local detection models into the global model in each node; the global model in a node can handle the intrusion categories that are found in other nodes, without distribution the samples of these intrusion types. General Terms GMM Gaussian Mixture Model, PSO SVM.

Host-based Implementation of NICE-A in Cloud Computing's Virtual Network

To ride the tide of change which is inevitable, innovations are necessary. By using the concept of virtualization most of enterprises are trying to reduce their computing cost. This demand of reducing the computing cost has led to the innovation of Cloud Computing. Nowadays organizations recognized cloud for it different attractive property such as economically attractive and use it to host their services. So that their services available easily and economically to their users. But also many organization put security in their top concern before adopting the cloud service. One of the most significant problem that associated with cloud computing is cloud security that drawn a lot of analysis and research within past few years. Inside the cloud system, especially the Infrastructure-as-a-Service (IaaS) clouds, the actual prognosis associated with zombie exploration problems is exceedingly hard. This is because cloud users might deploy somewhat insecure purposes on the exclusive products. NICE is a Network Intrusion detection and Countermeasure selection in virtual network systems (NICE) design to establish an intrusion detection framework which is defense-in-depth in nature. Into the intrusion detection processes an attack graph analytical procedures is incorporated by NICE for better attack detection. In this paper we proposed to implement NICE-A as a host based agent instead network based so the data delivery time between sender and intended destination is saved as NICE-A is implemented in destination (which is cloud server in our case) and for large amount of data this definitely shows improvement in computation time. Moreover as NICE-A is implemented as host based so CPU utilization is also improved.

A collaborative framework for intrusion detection in mobile networks

Mobile devices are becoming the most popular way of connection, but protocols supporting mobility represent a serious source of concerns because their initial design did not enforce strong security. This paper introduces a novel class of stealth network attacks, called mobility-based evasion, where an attacker splits a malicious payload in such a way that no part can be recognized by existing defensive mechanisms including the most modern network intrusion detection systems operating in stateful mode. We propose an original cooperative framework for intrusion detection that can prevent mobility-based evasion. The viability and performance of the proposed solution is shown through a prototype applied to Mobile IPv4, Mobile IPv6 and WiFi protocols.

An accurate and efficient collaborative intrusion detection framework to secure vehicular networks

The advancement of wireless communication leads researchers to develop and conceive the idea of vehicular networks, also known as vehicular ad hoc networks (VANETs). Security in such network is mandatory due to a vital information that are managed by the vehicle. Therefore, in this paper we design and implement an accurate and lightweight intrusion detection framework, called AECFV, that aims to protect the network against the most dangerous attacks that could occur on such network. AECFV is suitable for VANET’s characteristics such as high node’s mobility and rapid topology change. This is achieved with a help of the proposed secured clustering algorithm that considers both node’s mobility and network vulnerability during cluster formation. Clusters are constructed with a high stability and good connectivity. Cluster-Heads (CHs) are elected based on both node’s mobility and the vehicle’s trust-level. The simulation performed using NS-3 simulator shows, AECFV exhibits a high detection rate, low false positive rate, faster attack detection, and lower communication overhead compared to current detection frameworks.

A Novel and Advanced Data Mining Model based Hybrid Intrusion Detection Framework

An Intrusion can be defined as any practice or act that attempt to crack the integrity, confidentiality or availability of a resource. This may contain of a deliberate unauthorized attempt to access the information, manipulate the data, or make a system unreliable or unusable. With the expansion of computer networks at an alarming rate during the past decade, security has become one of the serious issues of computer systems. IDS, is a detection mechanism for detecting the intrusive activities hidden among the normal activities. The revolutionary establishment of IDS has attracted analysts to work dedicatedly enabling the system to deal with technological advancements. Hence, in this regard, various beneficial schemes and models have been proposed in order to achieve enhanced IDS. This paper proposes a novel hybrid model for intrusion detection. The proposed framework in this paper may be expected as another step towards advancement of IDS. The framework utilizes the crucial data mining classification algorithms beneficial for intrusion detection. The Hybrid framework would henceforth, will lead to effective, adaptive and intelligent intrusion detection. DOI: http://dx.doi.org/10.11591/telkomnika.v13i2.7045

Evasion Streamline Intruders Using Graph Based Attacker model Analysis and Counter measures In Cloud Environment

Network Intrusion detection and Countermeasure Election in virtual network systems (NICE) are used to establish a defense-in-depth intrusion detection framework. For better attack detection, NICE incorporates attack graph analytical procedures into the intrusion detection processes. We must note that the design of NICE does not intend to improve any of the existing intrusion detection algorithms; indeed, NICE employs a reconfigurable virtual networking approach to detect and counter the attempts to compromise VMs, thus preventing zombie VMs. NICE includes two main phases: deploy a lightweight mirroring-based network intrusion detection agent (NICE-A) on each cloud server to capture and analyze cloud traffic. A NICE-A periodically scans the virtual system vulnerabilities within a cloud server to establish Scenario Attack Graph (SAGs), and then based on the severity of identified vulnerability toward the collaborative attack goals, NICE will decide whether or not to put a VM in network inspection state. Once a VM enters inspection state, Deep Packet Inspection (DPI) is applied, and/or virtual network reconfigurations can be deployed to the inspecting VM to make the potential attack behaviors prominent.