Intrusion Detection In Computer Networks Research Articles

INTRUSION DETECTION MODEL BASED ON IMPROVED TRANSFORMER

The object of the study is the process of identifying the state of a computer network. The subject of the study are the methods of identifying the state of computer networks. The purpose of the paper is to improve the efficacy of intrusion detection in computer networks by developing a method based on transformer models. The results obtained. The work analyzes traditional machine learning algorithms, deep learning methods and considers the advantages of using transformer models. A method for detecting intrusions in computer networks is proposed. This method differs from known approaches by utilizing the Vision Transformer for Small-size Datasets (ViTSD) deep learning algorithm. The method incorporates procedures to reduce the correlation of input data and transform data into a specific format required for model operations. The developed methods are implemented using Python and the GOOGLE COLAB cloud service with Jupyter Notebook. Conclusions. Experiments confirmed the efficiency of the proposed method. The use of the developed method based on the ViTSD algorithm and the data preprocessing procedure increases the model's accuracy to 98.7%. This makes it possible to recommend it for practical use, in order to improve the accuracy of identifying the state of a computer system.

Big data technology for computer intrusion detection

Abstract In order to improve the ability of computer network intrusion detection, the big data technology for computer intrusion detection was studied. This research uses big data technology to build a network intrusion detection model, using clustering algorithms, classification algorithms, and association rule algorithms in data mining to automatically identify the attack patterns in the network and quickly learn and extract the characteristics of network attacks. The experimental results show that the recognition effect of the classification algorithm is obviously better than that of the clustering algorithm and the association rule. With the increase in the proportion of abnormal commands, the accuracy rate can still be maintained at 90%. As a compromise between the classification algorithm and the clustering algorithm, the accuracy rate of the association rule algorithm is basically maintained at more than 75%. It is proved that the big data technology oriented to computer intrusion detection can effectively improve the detection ability of computer network intrusion.

A novel network intrusion detection method based on metaheuristic optimisation algorithms

The growing use of the Internet with its vulnerabilities has necessitated the adoption of Intrusion Detection Systems (IDS) to assure security. IDSs are protective systems that detect outsider infiltrations, unauthorised accesses and malfunctions occurring in computer networks. Intrusions can be detected and reported to the network administrator by IDSs using various pieces of information such as port scanning and irregular traffic detection. Intrusion detection is a classification problem, and identifying effective features is an essential aspect of classification methods. Standard methods used for classification are neural networks, fuzzy logic, data mining techniques and metaheuristics. One of the novel metaheuristic algorithms introduced to address optimisation problems is the Horse herd Optimisation Algorithm (HOA). This paper introduces a new approach on the basis of HOA for network intrusion detection. The new method uses horse behaviours in the herd to select effective features to detect intrusions and interactions between features. For the purpose of the new approach, HOA is first updated into a discrete algorithm using the floor function. The binarised algorithm is then converted into a quantum-inspired optimiser by integrating the concepts of quantum computing with HOA to improve the social behaviours of the horses in the herd. In quantum computing, Q-bit and Q-gate aid in striking a greater balance between the exploration and exploitation processes. The resulting algorithm is then converted into a multi-objective algorithm, where the objectives can be chosen from a set of optimal solutions. The new algorithm, MQBHOA, is then used for intrusion detection in computer networks, which is a multi-objective optimisation problem. For the classification, the K-Nearest Neighbour (KNN) classifier is applied. To evaluate the new algorithm’s performance, two data sets, NSL-KDD (Network Security Laboratory—Knowledge Discovery and Data Mining) and CSE-CIC-IDS2018, are employed in which the network packets are classified into five categories: normal packets plus four intrusions packet types of Denial of Service (DoS), User to Root (U2R), Remote to Local (R2L) and Probing (Prob). The new algorithm’s performance was evaluated and compared with other well-known metaheuristic algorithms, and the influence of the parameters of the algorithm on the degree of intrusion was investigated. The results show a 6% more success rate in the average size of feature selection and the accuracy of classification in comparison with other evaluated algorithms. It also demonstrates an accuracy of 99.8% in detecting network intrusions compared to other methods.

Application of Multi-objective Differential Evolution Algorithm in Computer Network Intrusion Detection System

With the rise and development of computer networks, network security has become a major issue, and intrusion detection has emerged as a crucial aspect of network security. However, traditional intrusion detection methods suffer from issues like slow detection rates and low accuracy. This necessitates the exploration and development of optimized algorithms for improving intrusion detection efficiency and accuracy. Recently, the multi-objective differential evolution algorithm has shown promising results in the field of intrusion detection. This paper explored the application of the multi-objective differential evolution algorithm in computer network intrusion detection systems. The experimental results on the KDDCUP'99 dataset demonstrated that the algorithm delivers high levels of precision and recall, outperforming other intrusion detection methods. Therefore, combining the multi-objective differential evolution algorithm with traditional intrusion detection methods can lead to significant improvements in intrusion detection efficiency and accuracy. Further optimization of this algorithm can be required to meet complex intrusion detection requirements. The multi-objective differential evolution algorithm presents exciting prospects, which can help enhance the efficiency and accuracy of intrusion detection, and provide strong technical support for ensuring network security and preventing cyber-attacks.

Computer Network Intrusion Anomaly Detection Based on Rough Fourier Fast Algorithm

Since there is a close relationship between network information security attack events and time complexity, it is necessary to count the degree of correlation between the current connection record and the connection record within a certain period of time before. Only in this way can the relationship between network connection data and network information security attack events be better reflected. In this paper, a rough Fourier fast algorithm based on rough set theory is proposed. Based on the characteristic attributes of the intrusion detection data set with the most value of character attributes as the data division basis, the computer network intrusion anomaly detection data set is intelligently divided into small data sets, so as to carry out attribute reduction. The network intrusion detection rule update experiment adopts the misuse detection method, extracts some samples from the KDD99 data set for training, obtains the computer network intrusion detection rules in the hierarchical decision table, and uses the incremental learning algorithm to update the rules, compared with the intrusion detection rules expressed by the decision table to test the feasibility and effectiveness of the rule update, and compared with the improved RSDB, RE-RFE algorithm, and KNN algorithm to evaluate the effect of the rough Fourier fast detection model applied to the problem of network intrusion anomaly detection. Using the attribute subset reduced by the rough Fourier algorithm to perform classification and modeling of computer network intrusion anomaly detection is significantly reduced, and the average time is reduced by 0.09 seconds, and this paper lays a good foundation for the application of network security intrusion detection algorithm.

A novel method for intrusion detection in computer networks by identifying multivariate outliers and ReliefF feature selection

A novel method for intrusion detection in computer networks by identifying multivariate outliers and ReliefF feature selection

Computer Network Intrusion Anomaly Detection with Recurrent Neural Network

Network intrusion anomaly detection technique has been widely employed in computer network environments as a highly effective security prevention method. As network technology and network applications have advanced at a rapid pace, so too has network data traffic, resulting in an increase in virus and attack kinds. In the face of large-scale traffic and characteristic information, traditional intrusion detection will have problems such as low detection accuracy, high false negatives, and reliance on dimensionality reduction algorithms. Therefore, it is particularly important to establish a fast and efficient network intrusion anomaly detection method to deal with the current complex network environment. This work designs a computer network intrusion detection model with a recurrent neural network in order to explore a new intrusion detection method. The main purpose of this article include the following: (1) design a network security emergency response system architecture with the recurrent neural network model. This system consists of a management center module, a knowledge database module, a data acquisition module, a risk detection tool module, a risk analysis and processing module, a data protection module, and a remote connection auxiliary module. The modules cooperate with each other to complete system functions. (2) Aiming at the risk analysis and processing module, a network intrusion detection model combining bidirectional long short-term memory (BiLSTM) and deep neural network (DNN) is designed. In view of the lack of consideration of the before-and-after relevance of intrusion data features and the multifeature problem in existing models, the use of BiLSTM to extract the relevance between features and the use of DNN to extract deeper features are proposed. Aiming at the problem that the model lacks consideration of the importance of features, it is proposed to embed an attention mechanism into the network to increase consideration for the importance of features. (3) Massive experiments have verified the reliability and effectiveness of the method proposed in this work.

An Efficient Network Intrusion Detection and Classification System

Intrusion detection in computer networks is of great importance because of its effects on the different communication and security domains. The detection of network intrusion is a challenge. Moreover, network intrusion detection remains a challenging task as a massive amount of data is required to train the state-of-the-art machine learning models to detect network intrusion threats. Many approaches have already been proposed recently on network intrusion detection. However, they face critical challenges owing to the continuous increase in new threats that current systems do not understand. This paper compares multiple techniques to develop a network intrusion detection system. Optimum features are selected from the dataset based on the correlation between the features. Furthermore, we propose an AdaBoost-based approach for network intrusion detection based on these selected features and present its detailed functionality and performance. Unlike most previous studies, which employ the KDD99 dataset, we used a recent and comprehensive UNSW-NB 15 dataset for network anomaly detection. This dataset is a collection of network packets exchanged between hosts. It comprises 49 attributes, including nine types of threats such as DoS, Fuzzers, Exploit, Worm, shellcode, reconnaissance, generic, and analysis Backdoor. In this study, we employ SVM and MLP for comparison. Finally, we propose AdaBoost based on the decision tree classifier to classify normal activity and possible threats. We monitored the network traffic and classified it into either threats or non-threats. The experimental findings showed that our proposed method effectively detects different forms of network intrusions on computer networks and achieves an accuracy of 99.3% on the UNSW-NB15 dataset. The proposed system will be helpful in network security applications and research domains.

Effect of Balancing Data Using Synthetic Data on the Performance of Machine Learning Classifiers for Intrusion Detection in Computer Networks

Attacks on computer networks have increased significantly in recent days, due in part to the availability of sophisticated tools for launching such attacks as well as the thriving underground cyber-crime economy to support it. Over the past several years, researchers in academia and industry used machine learning (ML) techniques to design and implement Intrusion Detection Systems (IDSes) for computer networks. Many of these researchers used datasets collected by various organizations to train ML classifiers for detecting intrusions. In many of the datasets used in training ML classifiers in such systems, data are imbalanced (i.e., not all classes had equal number of samples). ML classifiers trained with such imbalanced datasets may produce unsatisfactory results. Traditionally, researchers used over-sampling and under-sampling for balancing data in datasets to overcome this problem. In this work, in addition to random over-sampling, we also used a synthetic data generation method, called Conditional Generative Adversarial Network (CTGAN), to balance data and study their effect on the performance of various widely used ML classifiers. To the best of our knowledge, no one else has used CTGAN to generate synthetic samples to balance intrusion detection datasets. Based on extensive experiments using widely used datasets NSL-KDD and UNSW-NB15, we found that training ML classifiers on datasets balanced with synthetic samples generated by CTGAN increased their prediction accuracy by up to 8% and improved their MCC score by up to 13%, compared to training the same ML classifiers over imbalanced datasets. We also show that this approach consistently performs better than some of the recently proposed state-of-the-art IDSes on both datasets. Our experiments also demonstrate that the accuracy of some ML classifiers trained over datasets balanced with random over-sampling decline compared to the same ML classifiers trained over original imbalanced dataset.

Random Forests for Online Intrusion Detection in Computer Networks

Random Forests for Online Intrusion Detection in Computer Networks

Application of Bioinformatics Algorithms for 3RO\PRUSKLF Cyberattacks Detection

The functionality of any system can be represented as a set of commands that lead to a change in the state of the system. The intrusion detection problem for signature-based intrusion detection systems is equivalent to matching the sequences of operational commands executed by the protected system to known attack signatures. Various mutations in attack vectors (including replacing commands with equivalent ones, rearranging the commands and their blocks, adding garbage and empty commands into the sequence) reduce the effectiveness and accuracy of the intrusion detection. The article analyzes the existing solutions in the field of bioinformatics and considers their applicability for solving the problem of identifying polymorphic attacks by signature-based intrusion detection systems. A new approach to the detection of polymorphic attacks based on the suffix tree technology applied in the assembly and verification of the similarity of genomic sequences is discussed. The use of bioinformatics technology allows us to achieve high accuracy of intrusion detection at the level of modern intrusion detection systems (more than 0.90), while surpassing them in terms of cost-effectiveness of storage resources, speed and readiness to changes in attack vectors. To improve the accuracy indicators, a number of modifications of the developed algorithm have been carried out, as a result of which the accuracy of detecting attacks increased by up to 0.95 with the level of mutations in the sequence up to 10%. The developed approach can be used for intrusion detection both in conventional computer networks and in modern reconfigurable network infrastructures with limited resources (Internet of Things, networks of cyber-physical objects, wireless sensor networks).

Intrusion detection in computer networks using a cost sensitive ensemble classifier

The growing use of Internet technology and the attack on computer networks have made intrusion detection systems an essential part of computer security. Conventional intrusion control methods such as firewalls or access control systems are no longer alone able to withstand attacks. Therefore, the need to detect new attacks and anomalies is inevitable. The dataset used in this paper is called NSL-KDD which includes 5 classes: one of them is normal and the other four classes are attacks. In the presented work, an ensemble classifier based on the mean probability of attacks is adopted. The true detection rate of the proposed system is $99.89%$ which is more than other competing methods. Moreover, the ensemble classifier achieved an F1-measure of $92.48%$. To improve the F1 measure, we used a meta-classifier called meta-cost which incorporates a cost matrix to transform the original classifier into a cost-sensitive classifier. By this idea, we achieved an F1-measure of $94.1%$ which outperforms than non-cost sensitive ensemble classifier. These results show that the proposed system can be used as a suitable defence tool to detect intrusion against cyber-attacks.

Research on Intrusion Detection Technology Based on Computer Network

After entering the 21st century, with the continuous progress and development of China’s social economy, China’s science and technology has also been rapid development, computer in this context, has gradually spread to people’s daily life and work, people are increasingly inseparable from the use of computer. However, due to the existence of computer network security performance risks, and criminals want to use these loopholes for illegal activities, so computer network security has become a focus of increasing concern, related to all aspects of people’s daily life. The purpose of this paper is to discuss and study the role and significance of computer network intrusion detection technology, introduce network intrusion methods, and put forward relevant measures and methods to improve computer network security.

Research on Computer Network Technology System Based on Artificial Intelligence Technology

This article introduces computer network intrusion detection systems and their classification based on artificial intelligence technology, and points out the challenges that intrusion detection systems (IDS) are facing in wireless sensor computer networks. On this basis, a hierarchical multi-layer wireless sensor network intrusion detection system and technology based on artificial intelligence technology Agent is proposed, and its network structure, working principle and performance are analysed.

Cyber Situation Awareness Perception Model for Computer Network

With the increase in cyber threats, computer network security has raised a lot of issues among various companies. In order to guide against all these threats, a formidable Intrusion Detection System (IDS) is needed. Various Machine Learning (ML) algorithms such as Artificial Neural Network (ANN), Decision Tree (DT), Support Vector Machine (SVM), Naïve Bayes, etc. has been used for threat detection. In light of the novel threats, there is a need to use a combination of tools to accurately enhance intrusion detection in computer networks, this is because intruders are gaining ground in the cyber world and the side effects on organizations cannot be quantified. The aim of this work is to provide an enhanced model for the detection of threats on the computer network. The combination of DT and ANN is proposed to accurately predict threats. With this model, a network administrator will be rest assured to some extent based on the prediction of the model. Two different supervised machine algorithms were hybridized in this research. NSL-KDD dataset was deployed for the simulation process in WEKA environment. The proposed model gave 0.984 precision, 0.982 sensitivity and 0.987 accuracy.

A Machine Learning-based Approach for Intrusion Detection and Prevention in Computer Networks

The potential of cyberattacks and network penetration has increased due to modern enterprises' increasing reliance on computer networks. Such attacks are detected and prevented by intrusion detection and prevention systems (IDPS), although conventional rule-based solutions have difficulties identifying unidentified attacks. Due to its capacity to learn from data and spot patterns of assault that conventional methods could miss, machine learning (ML) techniques have been gaining prominence in IDPS. This article provides a thorough analysis of the several ML methods utilized in IDPS, including supervised, unsupervised, and hybrid techniques. Also, a hybrid ML-based IDPS that combines the advantages of several methodologies for better performance is proposed. Furthermore, covered are the difficulties with ML-based IDPS and potential solutions. It is demonstrated how ML-based IDPS may be applied in real-world situations, emphasizing the advantages of applying ML to intrusion detection and prevention. In conclusion, this study offers insights into the most recent methods for ML-based IDPS and their potential to enhance network security.

An intrusion detection system for packet and flow based networks using deep neural network approach

Study on deep neural networks and big data is merging now by several aspects to enhance the capabilities of intrusion detection system (IDS). Many IDS models has been introduced to provide security over big data. This study focuses on the intrusion detection in computer networks using big datasets. The advent of big data has agitated the comprehensive assistance in cyber security by forwarding a brunch of affluent algorithms to classify and analysis patterns and making a better prediction more efficiently. In this study, to detect intrusion a detection model has been propounded applying deep neural networks. We applied the suggested model on the latest data set available at online, formatted with packet based, flow based data and some additional metadata. The data set is labeled and imbalanced with 79 attributes and some classes having much less training samples compared to other classes. The proposed model is build using Keras and Google Tensorflow deep learning environment. Experimental result shows that intrusions are detected with the accuracy over 99% for both binary and multi-class classification with selected best features. Receiver operating characteristics (ROC) and precision-recall curve average score is also 1. The outcome implies that Deep Neural Networks offers a novel research model with great accuracy for intrusion detection model, better than some models presented in the literature.

Extra-adaptive robust online subspace tracker for anomaly detection from streaming networks

Anomaly detection in time-evolving networks has many applications, for instance, traffic analysis in transportation networks and intrusion detection in computer networks. One group of popular methods for anomaly detection from evolving networks are robust online subspace trackers. However, these methods suffer from problem of insensitivity to drastic changes in the evolving subspace. In order to solve this problem, we propose a new robust online subspace and anomaly tracker, which is more adaptive and robust against sudden drastic changes in the subspace. More accurate estimation of low rank and sparse components by this tracker leads to more accurate anomaly detection. We evaluate the accuracy of our method with real-world dynamic network data sets with varying sparsity levels. The result is promising and our method outperforms the state-of-the-art.

Application of deep learning to enhance the accuracy of intrusion detection in modern computer networks

Application of deep learning to enhance the accuracy of intrusion detection in modern computer networks were studied in this paper. The identification of attacks in computer networks is divided in to two categories of intrusion detection and anomaly detection in terms of the information used in the learning phase. Intrusion detection uses both routine traffic and attack traffic. Abnormal detection methods attempt to model the normal behavior of the system, and any incident that violates this model is considered to be a suspicious behavior. For example, if the web server, which is usually passive, tries to There are many addresses that are likely to be infected with the worm. The abnormal diagnostic methods are Statistical models, Secure system approach, Review protocol, Check files, Create White list, Neural Networks, Genetic Algorithm, Vector Machines, decision tree. Our results have demonstrated that our approach offers high levels of accuracy, precision and recall together with reduced training time. In our future work, the first avenue of exploration for improvement will be to assess and extend the capability of our model to handle zero-day attacks.

Enhance Intrusion Detection in Computer Networks Based on Deep Extreme Learning Machine

Networks provide a significant function in everyday life, and cybersecurity therefore developed a critical field of study. The Intrusion detection system (IDS) becoming an essential information protection strategy that tracks the situation of the software and hardware operating on the network. Notwithstanding advancements of growth, current intrusion detection systems also experience dif- ficulties in enhancing detection precision, growing false alarm levels and identifying suspicious activities. In order to address above mentioned issues, several researchers concentrated on designing intrusion detection systems that rely on machine learning approaches. Machine learning models will accurately identify the underlying variations among regular information and irregular information with incredible efficiency. Artificial intelligence, particularly machine learning methods can be used to develop an intelligent intrusion detection framework. There in this article in order to achieve this objective, we propose an intrusion detection system focused on a Deep extreme learning machine (DELM) which first establishes the assessment of safety features that lead to their prominence and then constructs an adaptive intrusion detection system focusing on the important features. In the moment, we researched the viability of our suggested DELMbased intrusion detection system by conducting dataset assessments and evaluating the performance factors to validate the system reliability. The experimental results illustrate that the suggested framework outclasses traditional algorithms. In fact, the suggested framework is not only of interest to scientific research but also of functional importance.