Intrusion Detection Problem Research Articles

Data Mining Approach for Evil Twin Attack Identification in Wi-Fi Networks

Recent cyber security solutions for wireless networks during internet open access have become critically important for personal data security. The newest WPA3 network security protocol has been used to maximize this protection; however, attackers can use an Evil Twin attack to replace a legitimate access point. The article is devoted to solving the problem of intrusion detection at the OSI model’s physical layers. To solve this, a hardware–software complex has been developed to collect information about the signal strength from Wi-Fi access points using wireless sensor networks. The collected data were supplemented with a generative algorithm considering all possible combinations of signal strength. The k-nearest neighbor model was trained on the obtained data to distinguish the signal strength of legitimate from illegitimate access points. To verify the authenticity of the data, an Evil Twin attack was physically simulated, and a machine learning model analyzed the data from the sensors. As a result, the Evil Twin attack was successfully identified based on the signal strength in the radio spectrum. The proposed model can be used in open access points as well as in large corporate and home Wi-Fi networks to detect intrusions aimed at substituting devices in the radio spectrum where IEEE 802.11 networking equipment operates.

IOT NETWORK INTRUSION DETECTION USING MACHINE LEARNING ON UNSW-NB15 DATASET

This research presents a comprehensive investigation into the application of machine learning techniques for addressing the pervasive security challenges within Internet of Things (IoT) networks. With the exponential growth of interconnected devices, ensuring the integrity and confidentiality of data transmissions has become increasingly critical. In this study, we deploy and evaluate seven distinct machine learning methods tailored to the IoT network intrusion detection problem. Leveraging the rich and diverse UNSW-NB15 dataset, encompassing real-world network traffic scenarios, our analysis encompasses a thorough examination of both traditional and state-of-the-art algorithms. Through rigorous experimentation and performance evaluation, we assess the efficacy of these methods in accurately detecting and classifying various forms of network intrusions. Our findings provide valuable insights into the strengths and limitations of different machine learning approaches for enhancing the security posture of IoT environments, thereby facilitating informed decision-making for network administrators and cybersecurity practitioners.

Probabilistic Analysis of Random Check Intrusion Detection System

The ubiquitous adoption of network-based technologies has left organizations vulnerable to malicious attacks. It has become vital to have effective intrusion detection systems (IDS) that protect the network from attacks. In this paper, we study the intrusion detection problem through the lens of probability theory. We consider a situation where a network receives random malicious signals at discrete time instances, and an IDS attempts to capture these signals via a random check process. We aim to develop a probabilistic framework for intrusion detection under the given scenario. Concretely, we calculate the detection rate of a network attack by an IDS and determine the expected number of detections. We perform extensive theoretical and experimental analyses of the problem. The results presented in this paper would be helpful tools for designing and analyzing intrusion detection systems. We propose a probabilistic framework that could be useful for IDS experts; for a network-based IDS that monitors in real-time, analyzing the entire traffic flow can be computationally expensive. By probabilistically sampling only a fraction of the network traffic, the IDS can still perform its task effectively while reducing the computational cost. However, checking only a fraction of the traffic increases the possibility of missing an attack. This research can help IDS designers achieve appropriate detection rates while maintaining a low false alarm rate. The groundwork laid out in this paper could be used for future research on understanding the probabilities related to intrusion detection.

Unsupervised intrusion detection system for in-vehicle communication networks

In-vehicle communication has been optimized day to day to keep updated of the technologies. Control area network (CAN) is used as a standard communication method because of its efficient and reliable connection. However, CAN is prone to several network level attacks because of its lack in security mechanisms. Various methods have been introduced to incorporate this in CAN. We proposed an unsupervised method of intrusion detection for in-vehicle communication networks by combining the optimal feature extracting ability of autoencoders and more precise clustering using fuzzy C-means (FCM). The proposed method is light weight and requires less computation time. We performed an extensive experiment and achieved an accuracy of 75.51 % with the ML350 in-vehicle intrusion dataset. By experimental result, the proposed method also works better for other intrusion detection problems like wireless intrusion detection datasets such as WNS-DS with accuracy of 84.05 % and network intrusion detection datasets such as KDDCup with accuracy 60.63 % , UNSW_NB15 with accuracy 73.62 % and Information Security Center of Excellence (ISCX) with accuracy 74.83 %. Overall, the proposed method outperforms the existing methods and avoids labeled datasets when training an in-vehicle intrusion detection model. The results of the experiment of our proposed method performed on various intrusion detection datasets indicate that the proposed approach is generalized and robust in detecting intrusions and can be effectively deployed in real time to monitor CAN traffic in vehicles and proactively alert during attacks.

An Intrusion Detection Model Based on Feature Selection and Improved One-Dimensional Convolutional Neural Network

The problem of intrusion detection has new solutions, thanks to the widespread use of machine learning in the field of network security, but it still has a few issues at this time. Traditional machine learning techniques to intrusion detection rely on expert experience to choose features, and deep learning approaches have a low detection efficiency. In this paper, an intrusion detection model based on feature selection and improved one-dimensional convolutional neural network was proposed. This model first used the extreme gradient boosting decision tree (XGboost) algorithm to sort the preprocessed data, and then it used comparison to weed out 55 features with a higher contribution. Then, the extracted features were fed into the improved one-dimensional convolutional neural network (I1DCNN), and this network training was used to complete the final classification task. The feature selection and improved one-dimensional convolutional neural network (FS-I1DCNN) intrusion detection model not only solved the traditional machine learning method of relying on expert experience to extract features but also improved the detection efficiency of the model, reduced the training time while reducing the dimension, and increased the overall accuracy. In comparison to the I1DCNN model without feature extraction and the conventional one-dimensional convolutional neural network (1DCNN) model, the experimental results demonstrate that the FS-I1DCNN model’s overall accuracy increases by 0.67% and 2.94%, respectively. Its accuracy, precision, recall, and F1-score were significantly better than those of the other intrusion detection models, including SVM and DBN.

INTRUSION DETECTION SYSTEMS AND METHODS: CURRENT SITUATION AND DIRECTIONS FOR IMPROVEMENT

The structure of modern intrusion detection systems (IDS) is reviewed. The main directions of recognition of security violations of protected systems are characterized in modern IDS. The analysis of the used methods and models of the structure of IDS was carried out according to the defined main groups. The main disadvantages of the current IDS are given and directions for their improvement are justified. Intrusion detection systems (IDS) are systems that collect information from various points of a protected computer system (computer network) and analyze this information to identify both attempts to breach and real security breaches (intrusions). It has been shown that in modern detection systems, the following main elements are logically distinguished: the information collection subsystem, the analysis subsystem, and the data presentation module. Each intrusion detection method has been reviewed separately and the disadvantages of the methods have been highlighted. The current situation regarding intrusion detection systems and methods is described and directions for improvement are indicated. Among the methods used in the analysis subsystem of modern IDS, two directions can be distinguished: one is aimed at detecting anomalies in the protected system, and the other is aimed at finding abuses. Each of these directions has its advantages and disadvantages, therefore, in most of the existing IDSs, combined solutions are used based on the synthesis of the corresponding methods. It was noted that there are two groups of methods: with controlled training (“training with an instructor”), and with unsupervised training (“training without an instructor”). The main difference between them is that supervised training methods use a fixed set of evaluation parameters and some a priori knowledge about the values of the evaluation parameters. The main methods of detecting anomalies are explained in detail and detailed in the Tables. It has been pointed out that the methods currently applied in IDS are based on the general concepts of pattern recognition theory. Several main methods of creating an “image” in modern IDS are discussed and the topic of choosing the optimal set of functions for evaluating the protected system is highlighted. Information about Bayesian statistics, Covariance matrices, Confidence networks (Bayesian networks) is reflected. Pros and cons of descriptive statistics, Neural networks, Pattern Generation, abuse detection methods are also discussed. It has been explained that the methods currently implemented in IDS are based on the general concepts of pattern recognition theory. In accordance with them, in order to detect an anomaly, an image of the normal functioning of the information system is formed on the basis of an expert assessment. This image acts as a set of evaluation parameter values. The data presentation subsystem is necessary to inform interested parties about the state of the protected system. Some systems assume the existence of groups of users, each of which controls certain subsystems of the protected system. Therefore, in such IDSs access control, group policies, permissions, and etc. is applied. In the end, the disadvantages of the existing detection systems were noted and recommendations were given for improving the IDS. It has been noted that due to the presence of a significant number of factors of various nature, the functioning of the information system and IDS has a probabilistic nature. Therefore, it is relevant to substantiate the type of probabilistic laws of specific parameters of functioning. Of particular note is the problem of substantiating the loss function of an information system, which is set in accordance with its objective function and on the area of the parameters of the system functioning. At the same time, the objective function should be determined not only at the expert level, but also in accordance with the totality of the parameters of the functioning of the entire information system and the tasks assigned to it. Then the IDS quality indicator will be defined as one of the parameters that affect the objective function, and its admissible values will be determined by the admissible values of the loss function. Based on the foregoing, it can be concluded that considerable experience has been accumulated in practical activities in solving intrusion detection problems. The applied IDS are largely based on empirical schemes of the intrusion detection process, further improvement of IDS is associated with the specification of methods for the synthesis and analysis of complex systems, the theory of pattern recognition as applied to IDS. Keywords: IDS, optimal function, Covariance matrix, Bayes statistics, detection systems.

Blocking intrusion logic using optimized multi-head convolution in wireless sensor network

Wireless sensor nodes (WSN) combine sensing and communication capabilities in the smallest sensor network component. Sensor nodes have basic networking capabilities, such as wireless connection with other nodes, data storage, and a microcontroller to do basic processing. The intrusion detection problem is well analyzed and there exist numerous techniques to solve this issue but suffer will poor intrusion detection accuracy and a higher false alarm ratio. To overcome this challenge, a novel Intrusion Detection via Salp Swarm Optimization based Deep Learning Algorithm (ID-SODA) has been proposed which classifies intrusion node and non-intrusion node. The proposed ID-SODA technique uses the k-means clustering algorithm to perform clustering. The Salp Swarm Optimization (SSO) technique takes into residual energy, distance, and cost while choosing the cluster head selection (CHS). The CHS is given the input to a multi-head convolutional neural network (MHCNN), which will classify into intrusion node and non-intrusion node. The performance analysis of the suggested ID-SODA is evaluated based on the parameters like accuracy, precision, F1 score, detection rate, recall, false alarm rate, and false negative rate. The suggested ID-SODA achieves an accuracy range of 98.95%. The result shows that the suggested ID-SODA improves the overall accuracy better than 6.56%, 2.94%, and 2.95% in SMOTE, SLGBM, and GWOSVM-IDS respectively.

Hybrid VGG19 and 2D-CNN for intrusion detection in the FOG-cloud environment

Fog computing (FC) extends cloud technology by providing services, storage, and network interaction between data centers and end devices. By putting storage and processing closer to the network edge, fog computing may improve IDS effectiveness and efficiency. We develop a cloud-fog intrusion detection system (CFIDS) that employs cloud and fog resources to identify threats in the current research. However, the attack affects data packets from Fog layer nodes. The majority of intrusive cyber-attacks are close variants of previously identified cyber attacks with duplicate data and attributes. In addition, the data packet must be analyzed to determine the intrusion. SYN packets, used to initiate TCP connections, flood a victim's network in a syn threat. To mitigate the impact of syn attacks in a FC environment, it is essential to implement the necessary security measures. Deep learning-based IDS are suitable for protecting fog computing layers from attacks and addressing current issues. The authors of this paper have put forth a new hybrid architecture for DL intrusion detection in fog computing, which combines the use of DL models. Due to the large dimensionality of network data, Radial basis function-based support vector regression (RBFSVR)is initially used to minimize the dimensionality of the data and reduce the training time. Then, on the cloud server, the integrated VGG19 and 2DCNN are utilized to complete the dataset's training and transfer it to the fog layer, where data transmission is observed and threats are recognized. Experiments with the UNSW-NB15, CICIDS2017, and CICIDS2018 datasets demonstrate that the techniques presented in this paper outperforms other comparable techniques in terms of detection rate, F-score, precision, recall, FAR, and accuracy, thereby solving the problem of intrusion detection. In addition, by analyzing irregular patterns of network traffic, flow duration isutilized to avoid harmful attacks in a fog computing environment.

Network intrusion detection based on the temporal convolutional model

Recurrent networks have been adopted as default architecture in approaches performing sequence modelling of network intrusion detection problems. However, models based on Recurrent Neural Network (RNN) architecture have some limitations regarding computation complexity and detection performance due to information loss. Recent studies suggested that certain convolutional-based architectures that can natively process temporal data outperform recurrent networks in time series modelling, such as speech synthesis and machine translation. Inspired by the success of temporal-based convolutional architectures in other domains, this paper designs and implements four temporal-based convolutional models in network intrusion detection and studies their classification performance. The models are based on MINImally RandOm Convolutional KErnel Transform (MiniRocket), eXplainable Convolutional Neural Network for Multivariate Time Series Classification (XCM), One-Dimensional Convolution Neural Network (OS-CNN), and Time Series Transformer (TST) architecture. We evaluate our models using the effectiveness and efficiency metrics based on CICDDoS2019 and CSE-CIC-IDS2018 datasets. Every model has achieved a high evaluation performance in the range between 98.07% and 99.99% in most considered metrics using the test dataset. MiniRocket and OS-CNN obtained the highest evaluation results regarding the effectiveness metrics. The high evaluation results suggest that they can improve the detection effectiveness of approaches formulating network intrusion detection as a time series task.

Intrusion detection in cloud computing based on time series anomalies utilizing machine learning

The growth of cloud computing is hindered by concerns about privacy and security. Despite the widespread use of network intrusion detection systems (NIDS), the issue of false positives remains prevalent. Furthermore, few studies have approached the intrusion detection problem as a time series issue, requiring time series modeling. In this study, we propose a novel technique for the early detection of intrusions in cloud computing using time series data. Our approach involves a method for Feature Selection (FS) and a prediction model based on the Facebook Prophet model to assess its efficiency. The FS method we propose is a collaborative feature selection model that integrates time series analysis techniques with anomaly detection, stationary, and causality tests. This approach specifically addresses the challenge of misleading connections between time series anomalies and attacks. Our results demonstrate a significant reduction in predictors employed in our prediction model, from 70 to 10 predictors, while improving performance metrics such as Mean Absolute Error (MAE), Mean Squared Error (MSE), Root Mean Squared Error (RMSE), Mean Absolute Percentage Error (MAPE), Median Absolute Percentage Error (MdAPE), and Dynamic Time Warping (DTW). Furthermore, our approach has resulted in reduced training, prediction, and cross-validation times of approximately 85%, 15%, and 97%, respectively. Although memory consumption remains similar, the utilization time has been significantly reduced, resulting in substantial resource usage reduction. Overall, our study presents a comprehensive methodology for effective early detection of intrusions in cloud computing based on time series anomalies, employing a collaborative feature selection model and the Facebook Prophet prediction model. Our findings highlight the efficiency and performance improvements achieved through our approach, contributing to the advancement of intrusion detection techniques in the context of cloud computing security.

An Intrusion Detection Method Based on Self-Generated Coding Technology for Stealthy False Data Injection Attacks in Train-Ground Communication Systems

This paper investigates the problem of intrusion detection of stealthy false data injection (FDI) attacks in train-ground communication systems. An intrusion detection method is proposed based on the self-generated coding technology. Different from the existing pseudo-random coding generators-based detection methods, the proposed method designs a self-generated multiplicative coding scheme by employing the authentication mechanism, where the coding sequences to encrypt and decrypt the original measurement data of trains are dynamically updated by parsing the latest timestamp online such that the attacker is not able to obtain the prior knowledge of the coding sequences, which improves the security of the data transmission in the train-ground communication network. Under stealthy FDI attacks, the proposed method increases the output residuals of the remote state estimator, which ensures that the residual-based detector continuously outputs alarm. Furthermore, in order to mitigate the impact of the attack on the system, a dead reckoning algorithm-based defence model is established to reconstruct the position information of trains compromised by the attacker. Finally, the effectiveness and superiority of the proposed method are verified through semi-physical simulation experiments.

Using Ensemble Techniques Based on Machine and Deep Learning for Solving Intrusion Detection Problems: A Survey

Obviously, the increasing threats to network security, which led to devastating network attacks, have taken a heavy toll on enterprises as a simple firewall cannot prevent complex and changing attacks. Therefore, companies should use intrusion detection systems in combination with other security devices to protect against corporate network security issues. In fact, intrusion detection is a system whose primary function is to protect network security by monitoring traffic, collecting and analyzing information, and then issuing an alert in cases where the output of the analysis represents a threat to network security. Intrusion Detection Systems (IDS) can stop unauthorized activity on a network or operating system, react automatically, stop the intrusion's source in time, record it, and alert the network administrator to ensure maximum system security. The process of detecting attacks using a single algorithm has not proven its worth. Therefore, several algorithms were used together by using ensemble learning. To elaborate, ensemble learning is a well-known predictive technique that involves training multiple algorithms to treat the same problem, after which the results are combined to produce a single, potent prediction that can provide performance better than that of a single algorithm. The primary goal of this study is to present an overview of the main ensemble techniques that are used to enhance the effectiveness of the intrusion detection system, as well as the research using these methods as published by Elsevier and Springer from 2018 until the time being. The results prove that the two easiest methods within ensemble learning to implement are majority voting and weighted averaging, which provide good results in terms of accuracy. In cases where the base models have a significant variance, the bagging method would be more beneficial, while the boosting method would be used in cases where the basic models are biased, and in order to lower bias by learning different algorithms, the stacking ensemble methods are used.

On the combination of adaptive neuro-fuzzy inference system and deep residual network for improving detection rates on intrusion detection.

Deep Residual Networks (ResNets) are prone to overfitting in problems with uncertainty, such as intrusion detection problems. To alleviate this problem, we proposed a method that combines the Adaptive Neuro-fuzzy Inference System (ANFIS) and the ResNet algorithm. This method can make use of the advantages of both the ANFIS and ResNet, and alleviate the overfitting problem of ResNet. Compared with the original ResNet algorithm, the proposed method provides overlapped intervals of continuous attributes and fuzzy rules to ResNet, improving the fuzziness of ResNet. To evaluate the performance of the proposed method, the proposed method is realized and evaluated on the benchmark NSL-KDD dataset. Also, the performance of the proposed method is compared with the original ResNet algorithm and other deep learning-based and ANFIS-based methods. The experimental results demonstrate that the proposed method is better than that of the original ResNet and other existing methods on various metrics, reaching a 98.88% detection rate and 1.11% false alarm rate on the KDDTrain+ dataset.

Evaluation of Machine Learning Techniques for Traffic Flow-Based Intrusion Detection

Cybersecurity is one of the great challenges of today's world. Rapid technological development has allowed society to prosper and improve the quality of life and the world is more dependent on new technologies. Managing security risks quickly and effectively, preventing, identifying, or mitigating them is a great challenge. The appearance of new attacks, and with more frequency, requires a constant update of threat detection methods. Traditional signature-based techniques are effective for known attacks, but they are not able to detect a new attack. For this reason, intrusion detection systems (IDS) that apply machine learning (ML) techniques represent an alternative that is gaining importance today. In this work, we have analyzed different machine learning techniques to determine which ones permit to obtain the best traffic classification results based on classification performance measurements and execution times, which is decisive for further real-time deployments. The CICIDS2017 dataset was selected in this work since it contains bidirectional traffic flows (derived from traffic captures) that include benign traffic and different types of up-to-date attacks. Each traffic flow is characterized by a set of connection-related attributes that can be used to model the traffic and distinguish between attacks and normal flows. The CICIDS2017 also contains the raw network traffic captures collected during the dataset creation in a packet-based format, thus permitting to extract the traffic flows from them. Various classification techniques have been evaluated using the Weka software: naive Bayes, logistic, multilayer perceptron, sequential minimal optimization, k-nearest neighbors, adaptive boosting, OneR, J48, PART, and random forest. As a general result, methods based on decision trees (PART, J48, and random forest) have turned out to be the most efficient with F1 values above 0.999 (average obtained in the complete dataset). Moreover, multiclass classification (distinguishing between different types of attack) and binary classification (distinguishing only between normal traffic and attack) have been compared, and the effect of reducing the number of attributes using the correlation-based feature selection (CFS) technique has been evaluated. By reducing the complexity in binary classification, better results can be obtained, and by selecting a reduced set of the most relevant attributes, less time is required (above 30% of decrease in the time required to test the model) at the cost of a small performance loss. The tree-based techniques with CFS attribute selection (six attributes selected) reached F1 values above 0.990 in the complete dataset. Finally, a conventional tool like Zeek has been used to process the raw traffic captures to identify the traffic flows and to obtain a reduced set of attributes from these flows. The classification results obtained using tree-based techniques (with 14 Zeek-based attributes) were also very high, with F1 above 0.997 (average obtained in the complete dataset) and low execution times (allowing several hundred thousand flows/s to be processed). These classification results obtained on the CICIDS2017 dataset allow us to affirm that the tree-based machine learning techniques may be appropriate in the flow-based intrusion detection problem and that algorithms, such as PART or J48, may offer a faster alternative solution to the RF technique.

Weighted heterogeneous ensemble for the classification of intrusion detection using ant colony optimization for continuous search spaces

This paper proposes a heterogeneous ensemble classifier configuration for a multiclass intrusion detection problem. The ensemble is composed of k-nearest neighbors, artificial neural networks, and naïve Bayes classifiers. The decisions of these classifiers are combined with weighted majority voting, where optimal weights are generated by ant colony optimization for continuous search spaces. As a comparison basis, we have also implemented the ensemble configuration with the unweighted majority voting or Winner Takes All strategy. To ensure the maximum variety of classifiers, we have implemented three versions of each classification algorithm by varying each classifier’s parameters making a total of nine diverse experts for the ensemble. For our empirical study, we used the full NSL-KDD dataset to classify network traffic into one of five different classes. Our results indicate that the ensemble configuration using ACOR-optimized weights is capable of resolving the conflicts between multiple classifiers and improving the overall classification accuracy of the ensemble.

Network intrusion detection based on conditional wasserstein variational autoencoder with generative adversarial network and one-dimensional convolutional neural networks

There is a class-imbalance problem that the number of minority class samples is significantly lower than that of majority class samples in common network traffic datasets. Class-imbalance phenomenon will affect the performance of the classifier and reduce the robustness of the classifier to detect unknown anomaly detection. And the distribution of the continuous features in the dataset does not follow the Gaussian distribution, which will bring great difficulties to intrusion detection. We propose Conditional Wasserstein Variational Autoencoders with Generative Adversarial Network (CWVAEGAN) to solve the class-imbalance phenomenon, CWVAEGAN transform the original dataset through data preprocessing, and then use the improved VAEGAN to generate minority class samples. According to the CWVAEGAN model, an intrusion detection system based on CWVAEGAN and One-dimensional convolutional neural networks (1DCNN), namely CWVAEGAN-1DCNN, is established. By using the examples generated by CWVAEGAN, the problem of intrusion detection on class unbalanced data is solved. Specifically, CWVAEGAN-1DCNN consists of three modules: data preprocessing module, CWVAEGAN, and deep neural network. We evaluate the performance of CWVAEGAN-1DCNN on two benchmark datasets and compared it with the other 16 methods. Experiment results suggest that the performance of CWVAEGAN-1DCNN is better than class-balancing methods, and other advanced methods.

A deep learning approach to predict the number of [formula omitted]-barriers for intrusion detection over a circular region using wireless sensor networks

Wireless Sensor Networks (WSNs) is a promising technology with enormous applications in almost every walk of life. One of the crucial applications of WSNs is intrusion detection and surveillance at border areas and in the defence establishments. The border areas are stretched over hundreds to thousands of miles, hence, it is not possible to patrol the entire border region. As a result, an enemy may enter from any point absence of surveillance and cause the loss of lives or destroy the military establishments. WSNs can be a feasible solution for the problem of intrusion detection and surveillance at the border areas. Detection of an enemy at the border areas and nearby critical areas such as military cantonments is a time-sensitive task as a delay of a few seconds may have disastrous consequences. Therefore, it becomes imperative to design systems that can identify and detect the enemy as soon as it comes within the range of the deployed system. In this paper, we have proposed a deep learning architecture based on a fully connected feed-forward Artificial Neural Network (ANN) for the accurate prediction of the number of k-barriers for fast intrusion detection and prevention. We have trained and evaluated the feed-forward ANN model using four potential features, namely area of the circular region, sensing range of sensors, transmission range of sensors, and number of sensor for Gaussian and uniform sensor distribution. These features are extracted through Monte Carlo simulation. In doing so, we found that the model accurately predicts the number of k-barriers for both Gaussian and uniform sensor distribution with correlation coefficient (R = 0.78) and Root Mean Square Error (RMSE = 41.15) for the former and R = 0.79 and RMSE = 48.36 for the latter. Further, the proposed approach outperforms the other benchmark algorithms in terms of accuracy and computational time complexity.

CAN Bus Intrusion Detection Based on Auxiliary Classifier GAN and Out-of-distribution Detection

The Controller Area Network (CAN) is a ubiquitous bus protocol present in the Electrical/Electronic (E/E) systems of almost all vehicles. It is vulnerable to a range of attacks once the attacker gains access to the bus through the vehicle’s attack surface. We address the problem of Intrusion Detection on the CAN bus and present a series of methods based on two classifiers trained with Auxiliary Classifier Generative Adversarial Network (ACGAN) to detect and assign fine-grained labels to Known Attacks and also detect the Unknown Attack class in a dataset containing a mixture of (Normal + Known Attacks + Unknown Attack) messages. The most effective method is a cascaded two-stage classification architecture, with the multi-class Auxiliary Classifier in the first stage for classification of Normal and Known Attacks, passing Out-of-Distribution (OOD) samples to the binary Real-Fake Classifier in the second stage for detection of the Unknown Attack class. Performance evaluation demonstrates that our method achieves both high classification accuracy and low runtime overhead, making it suitable for deployment in the resource-constrained in-vehicle environment.

Effective network intrusion detection via representation learning: A Denoising AutoEncoder approach

The introduction of deep learning techniques in intrusion detection problems has enabled an enhanced standard of detection effectiveness. However, most of the progress has occurred in supervised learning, which required a vast amount of labeled training samples. In the real world, there is a limited amount of labeled data available to train a deep neural network, affecting the classifier’s detection performance. Therefore, to address the lack of labeled network traffic required to train an effective supervised classifier, this study introduces a semi-supervised intrusion detection framework that combines the unsupervised and supervised techniques. The unsupervised pre-training approach is implemented based on a denoising autoencoder (DAE), to compress the intrusion dataset and obtain the lower-dimensional features representation. Then a portion of the compressed data is used to train the DNN classifier based on a multiclass supervised approach. The network architecture is optimized by tuning hyper-parameters using a trial-and-error approach. Comparative analysis is performed between the proposed approach and the most relevant deep learning methods available in the literature against the CICIDS2018 dataset, consisting of recent network attack traces. Our approach outperforms competitive methods while maintaining stable classification results above 99.6% on F1-score, precision, and recall metrics. Additionally, it is trained in 64 min while achieving a low false alarm rate. Furthermore, the DAE module reduces the input network traffic data to one-tenth of the size of the input dataset.

Intrusion Detection for Database Security using a Hidden Naïve Bayes Binary Classifier

The Hidden Naive Bayes Binary Classifier is used for Database Security to detect Intruders. Data mining is used a lot in intrusion detection systems to classify normal or anomaly events. This method is a transparent, effective, and widely used mining method based on the idea of conditional attribute independence. HNB classifier is a more advanced version of Naive Bayes classifier algorithm and is efficiently used for intrusion attacks. It keeps the simplicity and efficiency of Naive Bayes, but loosens the independence condition. In the tests, it is proved that this binary classifier model can be used to solve the intrusion detection problem.