Intrusion Detection Mechanism Research Articles

Common criteria for security evaluation and malicious intrusion detection mechanism of dam supervisory control and data acquisition system

Common criteria for security evaluation and malicious intrusion detection mechanism of dam supervisory control and data acquisition system

Smart Irrigation with Intrusion Detection

This paper proposes a comprehensive approach to smart irrigation by integrating intrusion detection mechanisms. By combining the functionalities of smart irrigation systems with intrusion detection systems (IDS), the proposed framework offers enhanced security and reliability in agricultural water management. The system employs a network of sensors weather, and soil moisture levels patterns, and other relevant parameters to optimize irrigation scheduling. Concurrently, it utilizes intrusion detection algorithms to identify and respond to unauthorized access attempts or anomalous behaviors within the irrigation infrastructure. The proposed approach represents a noteworthy advancement in the direction of sustainable and secure management of water in agriculture, contributing to improved crop yields, resource conservation, and overall perseverance in the face of emerging challenges. Additionally, by incorporating machine learning algorithms into the intrusion detection system, the framework is able to change and grow over time, enhancing its capacity to identify and neutralize possible threats. Furthermore, the system can more accurately predict when irrigation is needed by utilizing real-time data analysis and predictive modeling approaches. This maximizes water usage efficiency while reducing waste. This all-encompassing strategy encourages a more ecologically sustainable method of managing water resources while also strengthening the resilience of farming operations. Furthermore, the framework enables farmers to take educated decisions in real-time, maximizing productivity and lowering risks, by giving them actionable insights and alerts about security breaches and irrigation needs.

Hierarchical multistep approach for intrusion detection and identification in IoT and Fog computing-based environments

Special security techniques, such as intrusion detection mechanisms, are indispensable in modern computer systems. With the emergence of the Internet of Things they have become even more important. It is important to detect and identify the attack in a category so that countermeasures specific to the threat category can be resolved. However, most existing multiclass detection approaches have some weaknesses, mainly related to detecting specific categories of attacks and problems with false positives. This article addresses this research problem and advances state-of-the-art, bringing contributions to a two-stage detection architecture called DNNET-Ensemble, combining binary and multiclass detection. While the benign traffic can be quickly released on the first detection, the intrusive traffic can be subjected to a robust analysis approach without causing delay issues. Additionally, we propose the DNNET binary approach for the binary detection level, which can provide more accurate and faster binary detection. We present the proposal of a federated strategy to train the neural model of the DNNET method without sending data to the cloud, thus preserving the privacy of local data. The proposed Hybrid Attribute Selection strategy can find an optimal subset of attributes through a wrapper method with a lower training cost due to pre-selection using a filter method. Furthermore, the proposed Soft-SMOTE improvement allows operating with a balanced dataset with a minor training time increase, even in scenarios where there are a large number of classes with a large imbalance among them. Results obtained from experiments on renowned intrusion datasets and laboratory experiments demonstrate that the approach can achieve superior detection rates and false positive performance compared to other state-of-the-art approaches.

Fast Attack Detection for Cyber-Physical Systems Using Dynamic Data Encryption.

To defend the cyber-physical system (CPSs) from cyber-attacks, this work proposes an unified intrusion detection mechanism which is capable to fast hunt various types of attacks. Focusing on securing the data transmission, a novel dynamic data encryption scheme is developed and historical system data is used to dynamically update a secret key involved in the encryption. The core idea of the dynamic data encryption scheme is to establish a dynamic relationship between original data, secret key, ciphertext and its decrypted value, and in particular, this dynamic relationship will be destroyed once an attack occurs, which can be used to detect attacks. Then, based on dynamic data encryption, a unified fast attack detection method is proposed to detect different attacks, including replay, false data injection (FDI), zero-dynamics, and setpoint attacks. Extensive comparison studies are conducted by using the power system and flight control system. It is verified that the proposed method can immediately trigger the alarm as soon as attacks are launched while the conventional χ2 detection could only capture the attacks after the estimation residual goes over the predetermined threshold. Furthermore, the proposed method does not degrade the system performance. Last but not the least, the proposed dynamic encryption scheme turns to normal operation mode as the attacks stop.

Secure deep learning-based energy efficient routing with intrusion detection system for wireless sensor networks

In general, wireless sensor networks are used in various industries, including environmental monitoring, military applications, and queue tracking. To support vital applications, it is crucial to ensure effectiveness and security. To prolong the network lifetime, most current works either introduce energy-preserving and dynamic clustering strategies to maintain the optimal energy level or attempt to address intrusion detection to fix attacks. In addition, some strategies use routing algorithms to secure the network from one or two attacks to meet this requirement, but many fewer solutions can withstand multiple types of attacks. So, this paper proposes a secure deep learning-based energy-efficient routing (SDLEER) mechanism for WSNs that comes with an intrusion detection system for detecting attacks in the network. The proposed system overcomes the existing solutions’ drawbacks by including energy-efficient intrusion detection and prevention mechanisms in a single network. The system transfers the network’s data in an energy-aware manner and detects various kinds of network attacks in WSNs. The proposed system mainly comprises two phases, such as optimal cluster-based energy-aware routing and deep learning-based intrusion detection system. Initially, the cluster of sensor nodes is formed using the density peak k-mean clustering algorithm. After that, the proposed system applies an improved pelican optimization approach to select the cluster heads optimally. The data are transmitted to the base station via the chosen optimal cluster heads. Next, in the attack detection phase, the preprocessing operations, such as missing value imputation and normalization, are done on the gathered dataset. Next, the proposed system applies principal component analysis to reduce the dimensionality of the dataset. Finally, intrusion classification is performed by Smish activation included recurrent neural networks. The proposed system uses the NSL-KDD dataset to train and test it. The proposed one consumes a minimum energy of 49.67 mJ, achieves a better delivery rate of 99.92%, takes less lifetime of 5902 rounds, 0.057 s delay, and achieves a higher throughput of 0.99 Mbps when considering a maximum of 500 nodes in the network. Also, the proposed one achieves 99.76% accuracy for the intrusion detection. Thus, the simulation outcomes prove the superiority of the proposed SDLEER system over the existing schemes for routing and attack detection.

Strategic Honeypot Deployment in Ultra-Dense Beyond 5G Networks: A Reinforcement Learning Approach

The progression of Software Defined Networking (SDN) and the virtualisation technologies lead to the beyond 5&#x00A0;G era, providing multiple benefits in the smart economies. However, despite the advantages, security issues still remain. In particular, SDN/NFV and cloud/edge computing are related to various security issues. Moreover, due to the wireless nature of the entities, they are prone to a wide range of cyberthreats. Therefore, the presence of appropriate intrusion detection mechanisms is critical. Although both Machine Learning (ML) and Deep Learning (DL) have optimised the typical rule-based detection systems, the use of ML and DL requires labelled pre-existing datasets. However, this kind of data varies based on the nature of the respective environment. Another smart solution for detecting intrusions is to use honeypots. A honeypot acts as a decoy with the goal to mislead the cyberatatcker and protect the real assets. In this paper, we focus on Wireless Honeypots (WHs) in ultra-dense networks. In particular, we introduce a strategic honeypot deployment method, using two Reinforcement Learning (RL) techniques: (a) <inline-formula><tex-math notation="LaTeX">$e-Greedy$</tex-math></inline-formula> and (b) <inline-formula><tex-math notation="LaTeX">$Q-Learning$</tex-math></inline-formula>. Both methods aim to identify the optimal number of honeypots that can be deployed for protecting the actual entities. The experimental results demonstrate the efficacy of both methods.

Improving Intrusion Detection using Satin Bowerbird Optimization with Deep Learning Model for IIoT Environment

Intrusion Detection in the Industrial Internet of Things (IIoT) concentrations on the security and safety of critical structures and industrial developments. IIoT extends IoT principles to industrial environments, but linked sensors and devices can be deployed for monitoring, automation, and control of manufacturing, energy, and other critical systems. Intrusion detection systems (IDS) in IoT drive to monitor network traffic, device behavior, and system anomalies for detecting and responding to security breaches. These IDS solutions exploit a range of systems comprising signature-based detection, anomaly detection, machine learning (ML), and behavioral analysis, for identifying suspicious actions like device tampering, unauthorized access, data exfiltration, and denial-of-service (DoS) attacks. This study presents an Improving Intrusion Detection using Satin Bowerbird Optimization with Deep Learning (IID-SBODL) model for IIoT Environment. The IID-SBODL technique initially preprocesses the input data for compatibility. Next, the IID-SBODL technique applies Echo State Network (ESN) model for effectual recognition and classification of the intrusions. Finally, the SBO algorithm optimizes the configuration of the ESN, boosting its capability for precise identification of anomalies and significant security breaches within IIoT networks. By widespread simulation evaluation, the experimental results pointed out that the IID-SBODL technique reaches maximum detection rate and improves the security of the IIoT environment. Through comprehensive experimentation on both UNSW-NB15 and UCI SECOM datasets, the model exhibited exceptional performance, achieving an average accuracy of 99.55% and 98.87%, precision of 98.90% and 98.93%, recall of 98.87% and 98.80%, and F-score of 98.88% and 98.87% for the respective datasets. The IID-SBODL model contributes to the development of robust intrusion detection mechanisms for safeguarding critical industrial processes in the era of interconnected and smart IIoT environments.

An optimal secure defense mechanism for DDoS attack in IoT network using feature optimization and intrusion detection system

Now, the Cyber security is facing unprecedented difficulties as a result of the proliferation of smart devices in the Internet of Things (IoT) environment. The rapid growth in the number of Internet users over the past two decades has increased the need for cyber security. Users have provided new opportunities for attackers to do harm. Limited security budgets leave IoT devices vulnerable and easily hacked to launch distributed denial-of-service (DDoS) attacks, with disastrous results. Unfortunately, due to the unique nature of the Internet of Things environment, most security solutions and intrusion detection systems (IDS) cannot be directly adapted to the IoT with acceptable security performance and are vulnerable to various attacks that do not benefit. In this paper we propose an optimal secure defense mechanism for DDoS in IoT network using feature optimization and intrusion detection system (OSD-IDS). In OSD-IDS mechanism, first we introduce an enhanced ResNet architecture for feature extraction which extracts more deep features from given traffic traces. An improved quantum query optimization (IQQO) algorithm for is used feature selection to selects optimal best among multiple features which reduces the data dimensionality issues. The selected features have given to the detection and classification module to classify the traffic traces are affected by intrusion or not. For this, we design a fast and accurate intrusion detection mechanism, named as hybrid deep learning technique which combines convolutional neural network (CNN) and diagonal XG boosting (CNN-DigXG) for the fast and accurate intrusion detection in IoT network. Finally, we validate the performance of proposed technique by using different benchmark datasets are BoNeSi-SlowHTTPtest and CIC-DDoS2019. The simulation results of proposed IDS mechanism are compared with the existing state-of-art IDS mechanism and analyze the performance with respects to different statistical measures. The results show that the DDoS detection accuracy of proposed OSD-IDS mechanism is high as 99.476% and 99.078% for BoNeSi-SlowHTTPtest, CICDDoS2019, respectively.

Spatial-Temporal Graph Model Based on Attention Mechanism for Anomalous IoT Intrusion Detection

Spatial-Temporal Graph Model Based on Attention Mechanism for Anomalous IoT Intrusion Detection

Comprehensive Security Framework: Integrating Intrusion Detection, Fire Safety, and Environmental Monitoring in Network Infrastructure

Intrusion detection systems aim to capture security attacks &amp; use analysers to determine details. Local wireless IDSs track all local wireless traffic and produce warnings based on signatures or abnormalities. Intrusion detection mechanisms can be configured to render unwanted access to the region easier. This paper aims to design a system to defend from intruders, human beings, through traditional surveillance devices, which cannot function in real-time, by utilising cameras fitted with infrared sensors. The aforementioned components comprise an interface program development system, intrusion detector sensors, wireless sensors, a programmable microcontroller, a controlled power supply device, Proteus relays, a GSM modem, and a cell phone. In reaction to adjustments in the atmosphere the controller activates a sensor to monitor and report input to the PIR’s wireless network. When the fire alarm device senses smoke, it can transmit a brief text message to the building’s owners. The system which uses an LM35 sensor to determine the temperature of food products, preventing fires from spreading throughout buildings without the tenants’ knowledge was produced. It is inexpensive, simple to install, and applicable to a variety of locations, including hotels, warehouses, and the automotive industry. This research study incorporates comprehensive tactics for monitoring environmental elements and fire safety, going beyond traditional intrusion detection methodologies. In doing so, this study offers a comprehensive strategy for protecting network infrastructures against various threats. The goal of integrating these essential components is to offer a more complete and reliable security solution.

A Novel Intrusion Detection Mechanism in Cloud Computing Environments based on Artificial Neural Network and Genetic Algorithm

A Novel Intrusion Detection Mechanism in Cloud Computing Environments based on Artificial Neural Network and Genetic Algorithm

Optimizing Intrusion Detection Mechanisms for IoT Network Security

The ubiquity of interconnected devices within the Internet of Things (IoT) paradigm has revolutionized modern connectivity, simultaneously amplifying the susceptibility of networks to diverse security threats. This study addresses the pressing necessity for robust intrusion detection mechanisms tailored for IoT networks. Utilizing a simulated dataset reflecting a spectrum of network intrusions within a military environment, the research employs sophisticated methodologies, notably harnessing Decision Tree (DT) algorithms optimized via Grey Wolf Optimization (GWO) for hyperparameter tuning. The investigation meticulously evaluates and refines intrusion detection mechanisms, emphasizing the pivotal role of feature importance analysis in fortifying network security. Results demonstrate the efficacy of the optimized DT algorithm in the precise classification of network traffic, illuminating key attributes instrumental for intrusion detection. These findings underscore the significance of adaptive and interpretable detection strategies in mitigating evolving threats within IoT networks, advocating for resilient approaches to bolster network security.

Fuzzy-enhanced adaptive multi-layered cloud security framework leveraging artificial intelligence, quantum-resistant cryptography, and fuzzy systems for robust protection

With the growing reliance on cloud computing, ensuring robust security and data protection has become a pressing concern. Traditional cryptographic methods face potential vulnerabilities in the post-quantum era, necessitating the development of advanced security frameworks. This paper presents a fuzzy-enhanced adaptive multi-layered cloud security framework that leverages artificial intelligence, quantum-resistant cryptography, and fuzzy systems to provide comprehensive protection in cloud environments. The proposed framework incorporates data encryption, access control, and intrusion detection mechanisms, with fuzzy logic systems augmenting the decision-making process for threat detection and response. The integration of artificial intelligence and quantum-resistant cryptographic techniques enhances the framework’s adaptability and resilience against emerging threats. The implementation of fuzzy systems further improves the accuracy and efficiency of the security mechanisms, ensuring robust protection in the face of uncertainty and evolving attack vectors. The fuzzy-enhanced adaptive multi-layered cloud security framework offers a comprehensive, adaptable, and efficient solution for securing cloud infrastructures, safeguarding sensitive data, and mitigating the risks associated with the post-quantum era.

Ensemble-Based Deep Learning Models for Enhancing IoT Intrusion Detection

Cybersecurity finds widespread applications across diverse domains, encompassing intelligent industrial systems, residential environments, personal gadgets, and automobiles. This has spurred groundbreaking advancements while concurrently posing persistent challenges in addressing security concerns tied to IoT devices. IoT intrusion detection involves using sophisticated techniques, including deep learning models such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and anomaly detection algorithms, to identify unauthorized or malicious activities within IoT ecosystems. These systems continuously monitor and analyze network traffic and device behavior, seeking patterns that deviate from established norms. When anomalies are detected, security measures are triggered to thwart potential threats. IoT intrusion detection is vital for safeguarding data integrity, ensuring users’ privacy, and maintaining critical systems’ reliability and safety. As the IoT landscape evolves, effective intrusion detection mechanisms become increasingly essential to mitigate the ever-growing spectrum of cyber threats. Practical security approaches, notably deep learning-based intrusion detection, have been introduced to tackle these issues. This study utilizes deep learning models, including convolutional neural networks (CNNs), long short-term memory (LSTM), and gated recurrent units (GRUs), while introducing an ensemble deep learning architectural framework that integrates a voting policy within the model’s structure, thereby facilitating the computation and learning of hierarchical patterns. In our analysis, we compared the performance of ensemble deep learning classifiers with traditional deep learning techniques. The standout models were CNN-LSTM and CNN-GRU, achieving impressive accuracies of 99.7% and 99.6%, along with exceptional F1-scores of 0.998 and 0.997, respectively.

A model for multi-attack classification to improve intrusion detection performance using deep learning approaches

This proposed model introduces novel deep learning methodologies. The objective here is to create a reliable intrusion detection mechanism to help identify malicious attacks. Deep learning based solution framework is developed consisting of three approaches. The first approach is Long-Short Term Memory Recurrent Neural Network (LSTM-RNN) with seven optimizer functions such as adamax, SGD, adagrad, adam, RMSprop, nadam and adadelta. The model is evaluated on NSL-KDD dataset and classified multi attack classification. The model has outperformed with adamax optimizer in terms of accuracy, detection rate and low false alarm rate. The results of LSTM-RNN with adamax optimizer is compared with existing shallow machine and deep learning models in terms of accuracy, detection rate and low false alarm rate. The multi model methodology consisting of Recurrent Neural Network (RNN), Long-Short Term Memory Recurrent Neural Network (LSTM-RNN), and Deep Neural Network (DNN). The multi models are evaluated on bench mark datasets such as KDD’99, NSL-KDD, and UNSWNB15 datasets. The models self-learnt the features and classifies the attack classes as multi-attack classification. The models RNN, and LSTM-RNN provide considerable performance compared to other existing methods on KDD’99 and NSL-KDD dataset.

A Lightweight Unsupervised Intrusion Detection Model Based on Variational Auto-Encoder.

With the gradual integration of internet technology and the industrial control field, industrial control systems (ICSs) have begun to access public networks on a large scale. Attackers use these public network interfaces to launch frequent invasions of industrial control systems, thus resulting in equipment failure and downtime, production data leakage, and other serious harm. To ensure security, ICSs urgently need a mature intrusion detection mechanism. Most of the existing research on intrusion detection in ICSs focuses on improving the accuracy of intrusion detection, thereby ignoring the problem of limited equipment resources in industrial control environments, which makes it difficult to apply excellent intrusion detection algorithms in practice. In this study, we first use the spectral residual (SR) algorithm to process the data; we then propose the improved lightweight variational autoencoder (LVA) with autoregression to reconstruct the data, and we finally perform anomaly determination based on the permutation entropy (PE) algorithm. We construct a lightweight unsupervised intrusion detection model named LVA-SP. The model as a whole adopts a lightweight design with a simpler network structure and fewer parameters, which achieves a balance between the detection accuracy and the system resource overhead. Experimental results on the ICSs dataset show that our proposed LVA-SP model achieved an F1-score of 84.81% and has advantages in terms of time and memory overhead.

A lightweight IoT intrusion detection model based on improved BERT-of-Theseus

The proliferation of Internet of Things (IoT) technology has resulted in an increase in security vulnerabilities associated with the interconnectivity of IoT devices. As a result, there is a need for intrusion detection mechanisms that can effectively detect attacks on IoT security vulnerabilities. However, due to the resource constraints of IoT deployment devices, intrusion detection schemes must be customized to meet the specific demands of the IoT environment. In this study, we propose a knowledge-distillation-based IoT intrusion detection model named BT-TPF, which is capable of detecting network attacks encountered by IoT devices in an IoT environment with limited computing resources. The proposed BT-TPF model leverages a Siamese network for feature dimensionality reduction of complex high-dimensional network traffic data. Additionally, it employs a large-scale Vision Transformer as a teacher model to guide a small-scale Poolformer model during training, before deploying the trained Poolformer model as a classifier to detect network intrusion traffic. Through knowledge distillation, the final small model obtained in this paper only requires a minimum of 788 parameters, reducing the number of parameters by approximately 90% compared to the large model before knowledge distillation, while maintaining high detection accuracy. Experimental results show that the BT-TPF model achieves over 99% accuracy on both the CIC-IDS2017 and TON_IoT datasets. Furthermore, it exhibits significant advantages compared to traditional Deep Learning methods and recent state-of-the-art models, as evidenced by various evaluation metrics.

Novel modeling and optimization for joint Cybersecurity-vs-QoS Intrusion Detection Mechanisms in 5G networks

The rapid emergence of 5G technology brings new cybersecurity challenges that hold significant implications for our economy, society, and environment. Among these challenges, ensuring the effectiveness of Intrusion Detection Mechanisms (IDMs) in monitoring networks and detecting 5G-related cyberattacks is of utmost importance. However, optimizing cybersecurity levels and selecting appropriate IDMs remain as critical and ongoing challenges. This work considers multiple pre-deployed distributed Security Agents (SAs) across the network, each capable of running various IDMs, where they differ by their effectiveness in detecting the attacks (referred to as security term) and the consumption of resources (referred to as Quality of Service (QoS) costs). We formulate a joint security and QoS utility function leveraging the Cobb–Douglas production utility function. There are several parameters that impact the joint objective problem, including the set of elasticity parameters, that reflect the importance of the two objectives. We derive an optimal set of elasticity parameters in closed form to identify the balancing point where both objectives have equal utility values. Through comprehensive simulations, we demonstrate that increasing the detection level of SAs enhances the security utility while simultaneously diminishing the QoS utility, as more computational, bandwidth, and monetary resources are utilized for IDM processing. After optimization, our mechanism can strike an effective balance between cybersecurity and QoS overhead while demonstrating the importance of different parameters in the joint problem.

Strengthening Cloud Security: An Innovative Multi-Factor Multi-Layer Authentication Framework for Cloud User Authentication

Cloud multi-factor authentication is a critical security measure that helps strengthen cloud security from unauthorized access and data breaches. Multi-factor authentication verifies that authentic cloud users are only authorized to access cloud apps, data, services, and resources, making it more secure for enterprises and less inconvenient for users. The number of authentication factors varies based on the security framework’s architecture and the required security level. Therefore, implementing a secured multi-factor authentication framework in a cloud platform is a challenging process. In this paper, we developed an adaptive multi-factor multi-layer authentication framework that embeds an access control and intrusion detection mechanisms with an automated selection of authentication methods. The core objective is to enhance a secured cloud platform with low false positive alarms that makes it more difficult for intruders to access the cloud system. To enhance the authentication mechanism and reduce false alarms, multiple authentication factors that include the length, validity, and value of the user factor is implemented with a user’s geolocation and user’s browser confirmation method that increase the identity verification of cloud users. An additional AES-based encryption component is applied to data, which are protected from being disclosed. The AES encryption mechanism is implemented to conceal the login information on the directory provider of the cloud. The proposed framework demonstrated excellent performance in identifying potentially malicious users and intruders, thereby effectively preventing any intentional attacks on the cloud services and data.

Security analysis of fog computing environment for ensuring the security and privacy of information

AbstractIn fog computing, the management, measurement, configuration, control, communication, and storage tasks are carried out collaboratively by one or more near‐user or end users. Fog computing is widely utilized in major application domains like centralized fog utilized in a shopping complex (UXFog), agriculture domain (FoAgro), health‐care domain (MediFog), vehicle parking system, and energy Lattices. The execution of fog computing at the system's edge provides the elevated quality of service (QoS), promotes area mindfulness, and minimal dormancy for the continuous and online streaming application areas. Fog networking is extremely concerned about wireless system security due to the prevalence of wireless communication in fog computing. Sniffer attacks, Jamming assaults, and several other intrusions are considered examples of security issues. While considering network storage issues, factors like interaction management, dynamic workload, and low dormancy are the most challenging aspects of designing the network model. Thus, privacy and security issues are crucial while designing the network model, accomplished through intrusion detection, access control and authentication methods. Therefore, the security analysis of fog computing based on authentication, access control and intrusion detection mechanisms are analyzed in this research to design a novel technique with enhanced security and privacy features for sharing and accessing information.