Intrusion Detection Framework Research Articles

A novel wide & deep transfer learning stacked GRU framework for network intrusion detection

With the increasing frequency, severity and complexity of recent cyber attacks around the world, network intrusion detection has become mandatory and highly sophisticated task. Achieving high performance in network intrusion detection by applying benchmark machine learning classifiers (including deep learning techniques) has become a major challenge in recent times. One of the biggest challenges is improving the memorization capacity and generalization ability of NIDS (Network Intrusion Detection Systems). In this paper, we propose a highly scalable novel wide & deep transfer learning (TL) based stacked GRU (Gated Recurrent Unit) model to deal with multi-dimensional point data and multi-variate time series regression and classification problems in network intrusion detection. The proposed model has the memorization capacity of linear regression model and the generalization ability of deep GRU model. The deep component consists of a transfer learning framework that pretrains a source model and then fine-tunes the whole source model on the same dataset multiple times until it gives peak performance. This method gives a multi-class evaluation accuracy of 99.92% on KDDCup 99(10%) dataset and 94.22% on UNSW-NB15 dataset respectively. Extensive experimentations and evaluations have been carried out by comparing it with other machine learning (including deep learning) network intrusion detection techniques. The proposed method outperforms most of the existing intrusion detection approaches.

A blockchain-based decentralized machine learning framework for collaborative intrusion detection within UAVs

UAVs have numerous emerging applications in various domains of life. However, it is extremely challenging to gain the required level of public acceptance of UAVs without proving safety and security for human life. Conventional UAVs mostly depend upon the centralized server to perform data processing with complex machine learning algorithms. In fact, all the conventional cyber attacks are applicable on the transmission and storage of data in UAVs. While their impact is extremely serious because UAVs are highly dependent on smart systems that extensively utilize machine learning techniques in order to take decisions in human absence. In this regard, we propose to enhance the performance of UAVs with a decentralized machine learning framework based on blockchain. The proposed framework has the potential to significantly enhance the integrity and storage of data for intelligent decision making among multiple UAVs. We present the use of blockchain to achieve decentralized predictive analytics and present a framework that can successfully apply and share machine learning models in a decentralized manner. We evaluate our system using collaborative intrusion detection as a case-study in order to highlight the feasibility and effectiveness of using blockchain based decentralized machine learning approach in UAVs and other similar applications.

HCRNNIDS: Hybrid Convolutional Recurrent Neural Network-Based Network Intrusion Detection System

Nowadays, network attacks are the most crucial problem of modern society. All networks, from small to large, are vulnerable to network threats. An intrusion detection (ID) system is critical for mitigating and identifying malicious threats in networks. Currently, deep learning (DL) and machine learning (ML) are being applied in different domains, especially information security, for developing effective ID systems. These ID systems are capable of detecting malicious threats automatically and on time. However, malicious threats are occurring and changing continuously, so the network requires a very advanced security solution. Thus, creating an effective and smart ID system is a massive research problem. Various ID datasets are publicly available for ID research. Due to the complex nature of malicious attacks with a constantly changing attack detection mechanism, publicly existing ID datasets must be modified systematically on a regular basis. So, in this paper, a convolutional recurrent neural network (CRNN) is used to create a DL-based hybrid ID framework that predicts and classifies malicious cyberattacks in the network. In the HCRNNIDS, the convolutional neural network (CNN) performs convolution to capture local features, and the recurrent neural network (RNN) captures temporal features to improve the ID system’s performance and prediction. To assess the efficacy of the hybrid convolutional recurrent neural network intrusion detection system (HCRNNIDS), experiments were done on publicly available ID data, specifically the modern and realistic CSE-CIC-DS2018 data. The simulation outcomes prove that the proposed HCRNNIDS substantially outperforms current ID methodologies, attaining a high malicious attack detection rate accuracy of up to 97.75% for CSE-CIC-IDS2018 data with 10-fold cross-validation.

Multi-Tenant Intrusion Detection Framework as a Service for SaaS

Information technology (IT) service providers are nowadays moving toward cloud computing. Software-as-a-service (SaaS) refers to cloud service-oriented web applications. As a result of computation outsourcing, a customer (tenant) can subscribe to a self-service SaaS and use it on a pay-per-use basis. To reduce resource costs, a single instance of SaaS serves multiple tenants (multi-tenancy). However, outsourcing and multi-tenancy bring about new security issues. Indeed, tenants lose control over the source code, databases and infrastructure and cannot deploy their own intrusion detection system (IDS). In this context, the provider must not only integrate their preferred IDS into a public cloud, but also protect the tenants according to their individual security requirements. We put forth a multi-tenant intrusion detection framework as a service for SaaS (MTIDaaS) to allow the provider to undertake such integration. Our MTIDaaS has been integrated and tested in a real public cloud environment. It provides security-as-a-service (SecaaS) for both provider and tenant with high levels of portability, flexibility and cost-effectiveness. The experimental results demonstrate that our MTIDaaS offers easy integration of IDS with little virtualization overhead and insignificant impact on HTTP response time.

A blockchain-based access control and intrusion detection framework for satellite communication systems

Recent works have shown great potentials for enhancing satellite communications (SATCOM) in terms of security and privacy from blockchains and smart contracts. However, smart contracts deployed on the blockchain also suffer from various attacks, e.g., illegal trigger and access, continuous intrusion, which causes critical threats toward blockchain-based SATCOM. In this paper, we first design a token-based access control mechanism for smart contracts with dynamic adjustment of the access control rules (ACRs), which guarantees that only authorized users can trigger and execute specific smart contracts. We then propose an intrusion detection mechanism for smart contracts to detect attacks against smart contracts in an effective and real-time way. Based on these mechanisms, we propose an access control and intrusion detection framework, dubbed ACID, to resist various attacks while remaining all characteristics and functionalities of the underlying blockchain-based SATCOM system. We conduct a comprehensive evaluation, which demonstrates that ACID is secure, feasible, and efficient.

Automatic Feature Selection and Ensemble Classifier for Intrusion Detection

Anomaly-based Intrusion Detection System (ADS) is one of the technologies widely used in network topology. Although many supervised and unsupervised learning methods in the field of machine learning have been used to improve the efficiency of ADS, achieving good performance is still a challenging problem for existing intrusion detection algorithms. Firstly, there are few public datasets available for evaluation. Secondly, a single classifier may not perform well in detecting each type of attack. Third, some of the existing schemes focus on feature subset selection, while ignoring the design of the classification decision algorithm, or focus on the classification decision algorithm. In order to address this issue, a new intrusion detection framework is proposed by comparing and studying various feature selection technologies and classification decision algorithms in this paper. An automatic parameter adjustment scheme is designed for feature selection and ensemble classification. It avoids the need to obtain the optimal parameters through manual experiments in advance, and can improve the robustness of the parameters and the model. We use the most classic NSL-KDD dataset and the latest CICIDS2018 dataset for comparative experiments. The experimental results demonstrate its efficiency in terms of Accuracy and False Positive Rate.

Forging a deep learning neural network intrusion detection framework to curb the distributed denial of service attack

Today’s popularity of the internet has since proven an effective and efficient means of information sharing. However, this has consequently advanced the proliferation of adversaries who aim at unauthorized access to information being shared over the internet medium. These are achieved via various means one of which is the distributed denial of service attacks-which has become a major threat to the electronic society. These are carefully crafted attacks of large magnitude that possess the capability to wreak havoc at very high levels and national infrastructures. This study posits intelligent systems via the use of machine learning frameworks to detect such. We employ the deep learning approach to distinguish between benign exchange of data and malicious attacks from data traffic. Results shows consequent success in the employment of deep learning neural network to effectively differentiate between acceptable and non-acceptable data packets (intrusion) on a network data traffic.

A flow-based intrusion detection framework for internet of things networks

The application of the Internet of Things concept in domains such as industrial control, building automation, human health, and environmental monitoring, introduces new privacy and security challenges. Consequently, traditional implementation of monitoring and security mechanisms cannot always be presently feasible and adequate due to the number of IoT devices, their heterogeneity and the typical limitations of their technical specifications. In this paper, we propose an IP flow-based Intrusion Detection System (IDS) framework to monitor and protect IoT networks from external and internal threats in real-time. The proposed framework collects IP flows from an IoT network and analyses them in order to monitor and detect attacks, intrusions, and other types of anomalies at different IoT architecture layers based on some flow features instead of using packet headers fields and their payload. The proposed framework was designed to consider both the IoT network architecture and other IoT contextual characteristics such as scalability, heterogeneity, interoperability, and the minimization of the use of IoT networks resources. The proposed IDS framework is network-based and relies on a hybrid architecture, as it involves both centralized analysis and distributed data collection components. In terms of detection method, the framework uses a specification-based approach drawn on normal traffic specifications. The experimental results show that this framework can achieve ≈ 100% success and 0% of false positives in detection of intrusions and anomalies. In terms of performance and scalability in the operation of the IDS components, we study and compare it with three different conventional IDS (Snort, Suricata, and Zeek) and the results demonstrate that the proposed solution can consume fewer computational resources (CPU, RAM, and persistent memory) when compared to those conventional IDS.

A Novel Framework Design of Network Intrusion Detection Based on Machine Learning Techniques

Traditional machine learning-based intrusion detection often only considers a single algorithm to identify intrusion data, lack of the flexibility method, low detection rate, no handing high-dimensional data, and cannot solve these problems well. In order to improve the performance of intrusion detection system, a novel general intrusion detection framework was proposed in this paper, which consists of five parts: preprocessing module, autoencoder module, database module, classification module, and feedback module. The data processed by the preprocessing module are compressed by the autoencoder module to obtain a lower-dimensional reconstruction feature, and the classification result is obtained through the classification module. Compressed features of each traffic are stored in the database module which can both provide retraining and testing for the classification module and restore these features to the original traffic for postevent analysis and forensics. For evaluation of the framework performance proposed, simulation was conducted with the CICIDS2017 dataset to the real traffic of the network. As the experimental results, the accuracy of binary classification and multiclass classification is better than previous work, and high-level accuracy was reached for the restored traffic. At the last, the possibility was discussed on applying the proposed framework to edge/fog networks.

SeDID: An SGX-enabled decentralized intrusion detection framework for network trust evaluation

In order to evaluate network trust, different intrusion detection methods have been proposed. However, it is difficult for a single detection node to collect massive data and perform detection and evaluation in a large-scale network. In addition, disclosure of security-related data and detection pattern might weaken data provision incentives due to privacy concern, which could result in deliberately forging data to evade detection. Current literature still lacks a general framework to conduct decentralized intrusion detection towards network trust evaluation with privacy preservation. In this paper, we propose SeDID, a Software Guard Extension (SGX)-enabled decentralized intrusion detection framework for network trust evaluation based on blockchain. We design a novel consensus mechanism to avoid forking and guarantee high efficiency and real decentralization, where block creation is uniquely consented by miners and block creation difficulty is determined by the number of blocks previously created by a relative miner within a time window. The smaller the number, the easier the miner creates a new block. SeDID also offers incentives according to node contributions for motivating security-related data collection, intrusion detection and network trust evaluation. Additional employment of Intel SGX makes SeDID preserve both data and pattern privacy. We analyze SeDID’s efficacy in terms of incentive, privacy preservation and security. Its performance is further evaluated through simulations. In specific settings, its block creation time, task completion time and throughput are 19.61s, 44.55s and 224.47 transactions/s, respectively. Compared with state-of-the-art systems, SeDID offers better performance, which implies its potential to be applied in practice.

A New Efficient Method for the detection of intrusion in 5 G andbeyond Networks using Machine Learning

The 5G networks are very important to support complex application byconnecting different types of machines and devices, which provide the platform for differentspoofing attacks. Traditional physical layer and cryptography authentication methods arefacing problems in dynamic complex environment, including less reliability, securityoverhead also problem in predefined authentication system, giving protection and learn abouttime-varying attributes. In this paper, intrusion detection framework has been designed usingvarious machine learning methods with the help of physical layer attributes and to providemore efficient system to increase the security. Machine learning methods for the intelligentintrusion detection are introduced, especially for supervised and non-supervised methods.Our machine learning based intelligent intrusion detection technique for the 5G and beyondnetworks is evaluated in terms of recall, precision, accuracy and f-value are validated forunpredictable dynamics and unknown conditions of networks.

Internet of Things (IoT) based Network Integrated with Sensor Nodes for Intruder Detection and Low Energy Consumption

The applications in Internet of Things (IoT) for a large-scale Network which necessitates the storage resources and computing tasks, are gradually deployed in most of the wireless network environments. The computing model of traditional techniques when compared with features of cloud such as unlimited expansion, dynamic acquisition and payas-you-go are represented in different IoT architectures based on the conveniences of applications. Thus, one of the key challenges is to consider the service requirements when sensors are assigned to the tasks and the network performance is improved. In the presented work, the two-phase service system using Enhanced Bernoulli Vacation (EBV) scheduling algorithm and Intrusion Detection framework is proposed to minimize the energy consumed by the sensors while the service is provided. The performance variation of Virtual Machine (VM) and its achieved delay is considered, while first the tasks are divided into different tasks at different levels. The proposed work deals with a queuing system ‘M/G/1’ for Bernoulli Vacation scheduling model at one phase and intrusion detection technique at second phase. The sensing distance is also calculated with its density of network. The tasking scheduling algorithm is considered for execution cost and residual energy where the deadlines or threshold are proposed. The delay time, accuracy, detection rate and False Alarm Positive rate are evaluated during simulation time. Based on the work flows, experiments conducted are simulated for controlled tasks of IoT which demonstrates the algorithm achieving high success rate and that the network performs better when compared with the existing algorithms.

Conditional Variational Auto-Encoder and Extreme Value Theory Aided Two-Stage Learning Approach for Intelligent Fine-Grained Known/Unknown Intrusion Detection

Promptly discovering unknown network attacks is critical for reducing the risk of major loss imposed on organizations and information infrastructure. This paper aims at developing an intelligent intrusion detection system capable of classifying known attacks as well as inferring unknown ones. To achieve this, we formulate the problem of fine-grained known/unknown intrusion detection as a two-stage minimization problem, where the first stage is to seek a score measure for minimizing the empirical risk of misclassifying the known attacks, while the second stage is to find another score measure for minimizing the identification risk of inferring unknown attacks. The hierarchical nature of problem formulation allows us to employ the class conditioned auto-encoders to construct a hierarchical intrusion detection framework. Since the reconstruction errors of unknown attacks are generally higher than that of the known attacks, we further employ extreme value theory in the second stage to model the distribution of reconstruction errors for differentiating known/unknown attack. To further reduce the false positive rate, we add a benign clustering module for learning the multimodal distribution of benign traffic. We conduct an experiment on two widely used datasets for assessing intrusion detection. The results show that the proposed method improves the detection rate of unknown attacks while keeping a low false positive rate.

An effective intrusion detection approach using SVM with naïve Bayes feature embedding

Network security has become increasingly important in recent decades, while intrusion detection system plays a critical role in protecting it. Various machine learning techniques have been applied to intrusion detection, among which SVM has been considered as an effective method. However, existing studies rarely take the data quality into consideration, which is essential for constructing a well-performed intrusion detection system beyond machine learning techniques. In this paper, we propose an effective intrusion detection framework based on SVM with naïve Bayes feature embedding. Specifically, the naïve Bayes feature transformation technique is implemented on the original features to generate new data with high quality; then, an SVM classifier is trained using the transformed data to build the intrusion detection model. Experiments on multiple datasets in intrusion detection domain validate that the proposed detection method can achieve good and robust performances, with 93.75% accuracy on UNSW-NB15 dataset, 98.92% accuracy on CICIDS2017 dataset, 99.35% accuracy on NSL-KDD dataset and 98.58% accuracy on Kyoto 2006+ dataset. Furthermore, our method possesses huge advantages in terms of accuracy, detection rate and false alarm rate when compared to other methods.

Detecting impersonation attacks in cloud computing environments using a centric user profiling approach

Cloud computing has become the most needed technology for the IT industry. Impersonation attacks are among the most dangerous threats that Clouds face. In this paper, we present an approach to detect masquerade attacks in Clouds. The efficient detection of these attacks should correlate user behaviors in distinct environments and also should apply to several deployment models. We present and evaluate three approaches to detect Impersonation and masquerade attacks. The first approach analyzes sequences of correlated system calls from the VMs operating systems, while the second analyzes the NetFlow data from the network environment. The third approach integrates these two approaches by using a neural network that will produce better detections than any of the first two approaches. To simplify the testing and the evaluation of the three methods, the Cloud Intrusion Detection Dataset (CIDD) is used as a source for cloud audits data. The evaluation has considered alternative deployment models through our two intrusion detection frameworks, CIDS and CIDS-VIRT. The paper also shows that the proposed detection approaches are more accurate and outperform the SWAD-MMD, a recent masquerade detection framework that works in the cloud computing systems. Furthermore, the paper details our experimental results and evaluates the computational performance and the detection accuracy of these approaches.

Editorial for special issue on security, trust, and privacy in internet of things: Challenges and solutions

Editorial for special issue on security, trust, and privacy in internet of things: Challenges and solutions

A Secure Method for Managing Data in Cloud Storage using Deduplication and Enhanced Fuzzy Based Intrusion Detection Framework

Cloud services increase data availability so as to offer flawless service to the client. Because of increasing data availability, more redundancies and more memory space are required to store such data. Cloud computing requires essential storage and efficient protection for all types of data. With the amount of data produced seeing an exponential increase with time, storing the replicated data contents is inevitable. Hence, using storage optimization approaches becomes an important pre-requisite for enormous storage domains like cloud storage. Data deduplication is the technique which compresses the data by eliminating the replicated copies of similar data and it is widely utilized in cloud storage to conserve bandwidth and minimize the storage space. Despite the data deduplication eliminates data redundancy and data replication; it likewise presents significant data privacy and security problems for the end-user. Considering this, in this work, a novel security-based deduplication model is proposed to reduce a hash value of a given file size and provide additional security for cloud storage. In proposed method the hash value of a given file is reduced employing Distributed Storage Hash Algorithm (DSHA) and to provide security the file is encrypted by using an Improved Blowfish Encryption Algorithm (IBEA). This framework also proposes the enhanced fuzzy based intrusion detection system (EFIDS) by defining rules for the major attacks, thereby alert the system automatically. Finally the combination of data exclusion and security encryption technique allows cloud users to effectively manage their cloud storage by avoiding repeated data encroachment. It also saves bandwidth and alerts the system from attackers. The results of experiments reveal that the discussed algorithm yields improved throughput and bytes saved per second in comparison with other chunking algorithms.

Multi-level host-based intrusion detection system for Internet of things

The growth of the Internet of things (IoT) has ushered in a new area of inter-connectivity and innovation in the home. Many devices, once separate, can now be interacted with remotely, improving efficiency and organization. This, however, comes at the cost of rising security vulnerabilities. Vendors are competing to create and release quickly innovative connected objects, without focusing on the security issues. As a consequence, attacks involving smart devices, or targeting them, are proliferating, creating threats to user’s privacy and even their physical security. Additionally, the heterogeneous technologies involved in IoT make attempts to develop protection on smart devices much harder. Most of the intrusion detection systems developed for those platforms are based on network activity. However, on many systems, intrusions cannot easily or reliably be detected from network traces. We propose a novel host-based automated framework for intrusion detection. Our work combines user space and kernel space information and machine learning techniques to detect various kinds of intrusions in smart devices. Our solution use tracing techniques to automatically get devices behavior, process this data into numeric arrays to train several machine learning algorithms, and raise alerts whenever an intrusion is found. We implemented several machine learning algorithms, including deep learning ones, to achieve high detection capabilities, while adding little overhead on the monitored devices. We tested our solution within a realistic home automation system with actual threats.

HFFPNN classifier: a hybrid approach for intrusion detection based OPSO and hybridization of feed forward neural network (FFNN) and probabilistic neural network (PNN)

Quick increase in web and system advancements has prompted significant increase in number of attacks and intrusions. Identification and prevention of these attacks has turned into an important part of security. Intrusion detection framework is one of the vital approaches to accomplish high security in computer systems and used to oppose attacks. Intrusion detection frameworks have reviled of dimensionality which tends to build time complexity and reduce resource use. Therefore, it is desirable that critical components of information must be examined by interruption detection framework to decrease dimensionality. These reduced features are then fed to a HFFPNN for training and testing on NSL-KDD dataset. HFFPNN is the hybridization of feed forward neural network (FFNN) and probabilistic neural network (PNN). Pre-processing of NSL-KDD dataset has been done to convert string attributes into numeric attributes before training. Comparisons with recent and relevant approaches are also tabled. Experimental results show the prominence of HFFPNN technique over the existing techniques in terms of intrusion detection classification. Therefore, the scope of this study has been expanded to encompass hybrid classifiers.

HDMI-Watch: Smart Intrusion Detection System Against HDMI Attacks

The High Definition Multimedia Interface (HDMI) is the backbone and the de-facto standard for Audio/Video connections between video-enabled devices. Today, nearly ten billion HDMI devices are used to distribute A/V signals in homes, offices, concert halls, and sporting events. An important component in HDMI is the Consumer Electronics Control (CEC) protocol, which allows HDMI devices to share an HDMI distribution to communicate and interact with each other. In this work, we identify security and privacy issues in HDMI networks by taping into CEC protocol vulnerabilities, using them to implement realistic proof-of-work attacks on HDMI distribution networks. We study how current insecure CEC protocol practices and carelessly implemented HDMI distributions may grant an adversary a novel attack surface for HDMI devices, otherwise thought to be unreachable through traditional network means. We first present HDMI-Walk , a novel attack vector, that can be used by an attacker to gain arbitrary control of HDMI devices and perform malicious analysis of devices, eavesdropping, Denial-of-Service attacks, targeted device attacks, and even facilitate other well-known existing attacks through HDMI. To defend against these new HDMI-based threats on a smart network system, we further propose HDMI-Watch, a novel intrusion detection system to detect unexpected CEC-based activity within an HDMI distribution. HDMI-Watch operates as a standalone smart intrusion detection framework within an HDMI distribution, passively monitoring and thus imposing no additional overhead to CEC communication. To test HDMI-Watch 's performance, we evaluated our system in a realistic HDMI testbed with a variety of consumer HDMI-enabled devices. Our extensive evaluation results show that the proposed system achieves an average 98% accuracy in classifying unexpected CEC behavior and identifies attacks occurring without any form of modification required to existing devices in an HDMI distribution.