Network Security Intrusion Detection Research Articles

Computer network big data detection based on internet of things technology

In order to solve the problems of traditional network security intrusion detection system in detection accuracy and missed detection rate, this paper proposes a computer network data detection based on Internet of things technology. This paper designs an intrusion detection system based on data clustering analysis algorithm. The hardware part of the intrusion detection system is composed of six parts: detection module, adaptive module, control management module, risk early warning module, control access module and data acquisition module. Each module is closely connected and updated with the rule base and database in real time; In the software flow design of the system, based on the data clustering analysis algorithm, the collected original data are classified and processed, and the Mings distance is determined, revealing the difference between normal data and abnormal data, and finally realizing the accurate detection of cloud computing network intrusion behavior. The experimental results show that the proposed intrusion detection system has a higher detection accuracy for malicious data, and the average missed detection rate can be controlled below 0.3 %. Conclusionthe detection system designed in this paper has more advantages in stability performance.

Predicting DoS and DDoS attacks in network security scenarios using a hybrid deep learning model

Abstract Network security faces increasing threats from denial of service (DoS) and distributed denial of service (DDoS) attacks. The current solutions have not been able to predict and mitigate these threats with enough accuracy. A novel and effective solution for predicting DoS and DDoS attacks in network security scenarios is presented in this work by employing an effective model, called CNN-LSTM-XGBoost, which is an innovative hybrid approach designed for intrusion detection in network security. The system is applied and analyzed to three datasets: CICIDS-001, CIC-IDS2017, and CIC-IDS2018. We preprocess the data by removing null and duplicate data, handling imbalanced data, and selecting the most relevant features using correlation-based feature selection. The system is evaluated using accuracy, precision, F1 score, and recall. The system achieves a higher accuracy of 98.3% for CICIDS-001, 99.2% for CICIDS2017, and 99.3% for CIC-ID2018, compared to other existing algorithms. The system also reduces the overfitting of the model using the most important features. This study shows that the proposed system is an effective and efficient solution for network attack detection and classification.

A comparative study of cyber security intrusion detection in healthcare systems

Due to the proliferation of network devices and the presence of sensitive information, healthcare systems have become prime targets for cyber attackers. Therefore, it is crucial to design an efficient and accurate intrusion detection system (IDS) specifically tailored for healthcare systems. In this regard, we conducted a comprehensive comparative study on network security intrusion detection in healthcare systems. In order to tackle the challenges arising from information redundancy and noise in feature selection, we developed the Maximum Information Coefficient (MIC) method to effectively analyse the nonlinear relationships among traffic features. This method was utilized in a comparative analysis involving ten models on three datasets. The experiments demonstrated that the detection models using MIC-based feature selection outperformed other feature selection approaches, especially when applied to the WUSTL-EHMS-2020 dataset, which includes patients' biometric features. The MIC-enhanced Extreme Gradient Boosting detection model achieved remarkable results, attaining an accuracy of 95.01%, precision of 94.94%, and recall of 95.01%. These findings underscore the efficacy of our comparative study in safeguarding healthcare systems against cyber attacks. Furthermore, our study highlights the importance of feature selection and the incorporation of patient biometric features in healthcare IDS. It is imperative for medical managers to consider these factors when making informed decisions regarding cyber security measures.

Red fox optimizer based feature selection with optimal deep learning based Intrusion detection for network security

Red fox optimizer based feature selection with optimal deep learning based Intrusion detection for network security

A Combined Multi-Classification Network Intrusion Detection System Based on Feature Selection and Neural Network Improvement

Feature loss in IoT scenarios is a common problem. This situation poses a greater challenge in terms of real-time and accuracy for the security of intelligent edge computing systems, which also includes network security intrusion detection systems (NIDS). Losing some packet information can easily confuse NIDS and cause an oversight of security systems. We propose a novel network intrusion detection framework based on an improved neural network. The new framework uses 23 subframes and a mixer for multi-classification work, which improves the parallelism of NIDS and is more adaptable to edge networks. We also incorporate the K-Nearest Neighbors (KNN) algorithm and Genetic Algorithm (GA) for feature selection, reducing parameters, communication, and memory overhead. We named the above system as Combinatorial Multi-Classification-NIDS (CM-NIDS). Experiments demonstrate that our framework can be more flexible in terms of the parameters of binary classification, has a fairly high accuracy in multi-classification, and is less affected by feature loss.

A Comprehensive Examination of Literature Exploring the Implementation of Machine Learning to Network Security's Intrusion Detection Systems

The Internet and telecommunication technologies have developed quickly, the amount of data transferred has greatly increased. Attackers are continually devising new tactics to steal or modify these data because they are so highly desired. The threat these attacks pose to the security of our systems is growing. It is among the most tough issues to resolve for detection of intrusions. An idss is a programme that attempts to analyse network traffic in order to detect intrusions. Despite the fact that many researchers have examined and developed novel IDS systems, IDS even now must be enhanced in order to achieve satisfactory detection capability while reducing number of false alarms. Furthermore, numerous intrusion detection systems have difficulty detecting nil attacks. Machine learning techniques had also recently become popular among scholars as a quick and accurate method of detecting network infiltration. This article offers a taxonomy of machine learning approaches as well as an explanation of IDS. In addition to a list of current IDS that include machine learning and a discussion of the essential components for IDS analysis, this article also outlines the advantages and disadvantages of each machine learning approach. The veracity of the findings from the evaluated study is then discussed after specifics of the various datasets used in the studies are given. The preceding part looks at the results, study obstacles, and projected future trends.

Network Security Intrusion Detection Methods Combining Optimization Algorithms and Neural Networks

Due to the diverse and volatile nature of today's network attacks, it is difficult to achieve satisfactory results using a single detection method. This project plans to study the network intrusion detection algorithm based on Semi-Supervised Learning and active learning to improve its accuracy and effectively intercept various network attacks. First, network attack data is collected, attack characteristics are extracted, and Semi-Supervised Learning method is used to cluster attack data. Secondly, by studying the clustering data, a network intrusion detection classifier based on BP neural network was constructed, and the construction process of the classifier was improved. On this basis, the effectiveness of the algorithm was verified through simulation experiments using standard datasets. The experimental results show that the combination rate of the optimized algorithm for network intrusion detection and neural network methods is over 95%, which can meet the actual accuracy requirements of network security protection. This is because the method proposed by the author combines semi supervised technology with BP neural network, which can effectively identify different types of network intrusion behavior, thereby reducing the missed detection rate and false alarm rate of network intrusion detection, and has significant advantages.

Association Rule Mining Frequent-Pattern-Based Intrusion Detection in Network

In the network security system, intrusion detection plays a significant role. The network security system detects the malicious actions in the network and also conforms the availability, integrity and confidentiality of data information resources. Intrusion identification system can easily detect the false positive alerts. If large number of false positive alerts are created then it makes intrusion detection system as difficult to differentiate the false positive alerts from genuine attacks. Many research works have been done. The issues in the existing algorithms are more memory space and need more time to execute the transactions of records. This paper proposes a novel framework of network security Intrusion Detection System (IDS) using Modified Frequent Pattern (MFP-Tree) via K-means algorithm. The accuracy rate of Modified Frequent Pattern Tree (MFPT)-K means method in finding the various attacks are Normal 94.89%, for DoS based attack 98.34%, for User to Root (U2R) attacks got 96.73%, Remote to Local (R2L) got 95.89% and Probe attack got 92.67% and is optimal when it is compared with other existing algorithms of K-Means and APRIORI.

An trustworthy intrusion detection framework enabled by ex-post-interpretation-enabled approach

An enormous number of machine learning models have been recently proposed for intrusion detection. Among these models, the complex models stand out as a prominent approach for intrusion detection in network security. In contrast with the simple models, the complex models are powerful in that it learns the complex abstraction between input and output under the premise of the loss of the transparency. This lack of interpretability hinders the landing of the complex model in the field of intrusion detection. To balance the model interpretability and performance, a novel trustworthy intrusion detection framework (TIDF) combining machine learning and ex-post-interpretation method is proposed in this paper. The proposed framework TIDF achieves 82% prediction accuracy. In the contrast experiment, TIDF outperforms the junior Network Security Manages Engineer (NSME). With the proposed framework, we achieve a good prediction performance and improve the model interpretability in the intrusion detection. Thus, the proposed framework may act as a potential useful tool in the intrusion detection system.

Computer Network Intrusion Anomaly Detection Based on Rough Fourier Fast Algorithm

Since there is a close relationship between network information security attack events and time complexity, it is necessary to count the degree of correlation between the current connection record and the connection record within a certain period of time before. Only in this way can the relationship between network connection data and network information security attack events be better reflected. In this paper, a rough Fourier fast algorithm based on rough set theory is proposed. Based on the characteristic attributes of the intrusion detection data set with the most value of character attributes as the data division basis, the computer network intrusion anomaly detection data set is intelligently divided into small data sets, so as to carry out attribute reduction. The network intrusion detection rule update experiment adopts the misuse detection method, extracts some samples from the KDD99 data set for training, obtains the computer network intrusion detection rules in the hierarchical decision table, and uses the incremental learning algorithm to update the rules, compared with the intrusion detection rules expressed by the decision table to test the feasibility and effectiveness of the rule update, and compared with the improved RSDB, RE-RFE algorithm, and KNN algorithm to evaluate the effect of the rough Fourier fast detection model applied to the problem of network intrusion anomaly detection. Using the attribute subset reduced by the rough Fourier algorithm to perform classification and modeling of computer network intrusion anomaly detection is significantly reduced, and the average time is reduced by 0.09 seconds, and this paper lays a good foundation for the application of network security intrusion detection algorithm.

Electricity Network Security Monitoring Based on Bee Colony Algorithm

In order to effectively detect and discover network threats in the initial stage, this study proposes an electricity network security intrusion detection method based on feature selection. A heuristic feature selection algorithm based on the bee colony algorithm is proposed to overcome the shortcomings of existing feature evaluation methods. The algorithm uses average mutual information to measure the importance of features and more truly reflects the relationship between the selected features, the selected features, and the classification labels. Aiming at the problem that the algorithm is easy to fall into local optimization, a heuristic random search algorithm is proposed, which iteratively optimizes to generate smaller feature subsets, and improves the speed and accuracy of intrusion detection. The experimental results show that compared with the traditional algorithm, the proposed method can effectively evaluate the risk of attack path on the selected experimental data set, and the gap between the generation strategy and the optimal strategy is reduced by 71.3%, which enhances the practicability of the attack graph analysis method in a large-scale network environment. Conclusion. This method has good scalability and can be applied to large-scale network environments. It can effectively obtain attack paths that are more in line with the real threat situation in an acceptable time, so as to effectively find the network threats.

Research on Attributes Reduction Method of Intrusion Detection Data Based on Rough Set Theory

With the huge amount of network connection data, high data dimensions and complex attack types, it is difficult for traditional data analysis techniques to obtain satisfactory results in the Network Security Intrusion Detection System. This paper proposed a RSDB method based on the Rough Set Theory and the Data Deblock Thought, which can help us to reduce the data conditional attributes and remix the data. The method considers two factors: the relationship between conditional attributes and decision attribute, and the data integrity. Through the experiment, this method can solve these difficult above problems effetely, while ensuring the original data is not distorted. Through many experiments and their experimental results, RSDB can not only make the classification accuracy over than 90%, but also its average detection time is in the millisecond level.

In-Memory Computing with Memristor Content Addressable Memories for Pattern Matching.

The dramatic rise of data-intensive workloads has revived application-specific computational hardware for continuing speed and power improvements, frequently achieved by limiting data movement and implementing "in-memory computation". However, conventional complementary metal oxide semiconductor (CMOS) circuit designs can still suffer low power efficiency, motivating designs leveraging nonvolatile resistive random access memory (ReRAM), and with many studies focusing on crossbar circuit architectures. Another circuit primitive-content addressable memory (CAM)-shows great promise for mapping a diverse range of computational models for in-memory computation, with recent ReRAM-CAM designs proposed but few experimentally demonstrated. Here, programming and control of memristors across an 86 × 12 memristor ternary CAM (TCAM) array integrated with CMOS are demonstrated, and parameter tradeoffs for optimizing speed and search margin are evaluated. In addition to smaller area, this memristor TCAM results in significantly lower power due to very low programmable conductance states, motivating CAM use in a wider range of computational applications than conventional TCAMs are confined to today. Finally, the first experimental demonstration of two computational models in memristor TCAM arrays is reported: regular expression matching in a finite state machine for network security intrusion detection and definable inexact pattern matching in a Levenshtein automata for genomic sequencing.

Long Short-Term Memory (LSTM) Deep Learning Method for Intrusion Detection in Network Security

Long Short-Term Memory (LSTM) Deep Learning Method for Intrusion Detection in Network Security

Network Intrusion Monitoring Technology Based on Decision Tree Method

In order to solve the problem of poor real-time network security intrusion detection, this paper proposes a network intrusion monitoring technology based on decision tree method. Firstly, the network intrusion monitoring module is set up in the existing network topology model, then the network information collection, information processing and information analysis modules are combined. Finally, the decision tree method is used to identify the abnormal data, effectively realize different types of abnormal data monitoring, and finally realize the network intrusion monitoring. Experimental results show that the proposed intrusion monitoring method can better monitor network intrusion behavior, and has higher monitoring accuracy than other methods.

Network Intrusion Detection with Threat Agent Profiling

With the increase in usage of computer systems and computer networks, the problem of intrusion detection in network security has become an important issue. In this paper, we discuss approaches that simplify network administrator’s work. We applied clustering methods for security incident profiling. We considerK-means, PAM, and CLARA clustering algorithms. For this purpose, we used data collected in Warden system from various security tools. We do not aim to differentiate between normal and abnormal network traffic, but we focus on grouping similar threat agents based on attributes of security events. We suggest a case of a fine classification and a case of a coarse classification and discuss advantages of both cases.

Intrusion Detection in Networks Security: A New Proposed Min-Min Algorithm

We propose a method to detect intrusions in computer network security. The main idea is to reuse the already available system information that is generated at various layers of a network stack. To the best of our knowledge, this is the first such approach for intrusion detection in computer network security. Wireless Sensor Network consists of large number of nodes, which will be in distributed nature. Security is a very important consideration while designing a Wireless Sensor Network. So, an Advanced Intrusion Detection System has been proposed where the Heterogeneous Hybrid Intrusion Detection System (H-HIDS), Intrusion Detection Prediction based are implemented in various stages in order to assure maximum possible security from the Intrusions. Keywords:intrusion detection, network security, anomaly, Min-Min algorithm, Neural network.

V-Detector-Based Immune Negative Intrusion Detection Algorithm

Research the problem of intrusion detection in network security. For the defects that existing intrusion detection system can't recognize unknown attacks, to improve the detection efficiency and reduce false alarm rate, this paper basing on V-detector immunity negative intrusion detection algorithm, bring up an adaptive variable radius detector. In the training stage, randomly generate candidate detector with different detection threshold. In the testing stage, according to the size of hole and detection accuracy automatically adjust the radius of the detector. The experiment and the data of KDDCUP1999 show: under the circumstance of the same number of detector, compared with V-detector, this detector has higher coverage, less hole.

Campus Network Security Program Based on Snort Network Security Intrusion Detection System

This paper studies the security problems of campus network and summarizes the current on the current security risks and threats that campus network faces, focusing on analysis of attack-defense strategies on DOS network layer, proposing the security program of campus network which uses firewall as well as network security intrusion detection system snort. This paper analyzes the functional advantages of the program and presents in details the setup deployment and collocation methods of network security intrusion detection system based on snort in the campus network, and its application results are also summarized.

A Studying on Implementation of NIDS Pattern Matching Based on FPGA

Intrusion detection for network security is an application area demanding high throughput. The pattern matching in intrusion detection requires extremely high performance to process string matching. Most of pattern matching using software has many time complexities and cannot reach the requirements of high throughput. The pattern matching using hardware considerably improves the speed of matching and has several other advantages. This paper describes a FPGA-based pattern matching architecture, using hashing method called XOR Hashing. The proposed method updates new patterns without reconfiguration and processes the collision and has high matching performance. The proposed system implements the pattern matching by using Snort rule-set, an open source Network Intrusion Detection and has simulation processing on PC. Compared with existing hardware method, the results explained that our method has relatively high performance for the pattern matching and can else process the pattern matching with high performance on low–cost FPGA device.