Intrusion Detection Research Research Articles

A Bibliometric Review of Intrusion Detection Research in IoT: Evolution, Collaboration, and Emerging Trends

A Bibliometric Review of Intrusion Detection Research in IoT: Evolution, Collaboration, and Emerging Trends

An intelligent security mechanism in mobile Ad-Hoc networks using precision probability genetic algorithms (PPGA) and deep learning technique (Stacked LSTM)

The Mobile Ad-hoc Networks (MANETs) have gained a significant attention in the recent years due to their proliferation and huge application purposes. To defend from many types of modern cyber dangers like Distributed Denial of Service (DDoS) attacks, Advanced Persistent Threats (APTs), Insider Threats, Ransomware, Zero-Day Exploits, Social Engineering tactics, and etc is not easy when it comes to keeping MANETs security. These complex assaults focus on network infrastructure, take advantage of weaknesses in communication protocols and control user actions. Although there have been improvements in intrusion detection systems (IDS), it is still difficult to fully safeguard MANETs. The purpose of this research is to create advanced methods that can accurately find and decrease attacks inside MANETs. Applying Sensor-based Feature Extraction (SFE) to extract useful network features such as Received Signal Strength Indication (RSSI) and Time of Travel (TOT) from datasets NSL-KDD and CICIDS-2017. Utilizing the fresh method of Precise Probability Genetic Algorithm (PPGA) optimization for removing unrelated details, which enhances precision in detecting attacks. Predicting normal and attacking labels by applying Stacked Recurrent Long Short Term Memory (SRLSTM) method, fine-tuning classifier's parameters in every layer to improve outcomes. In order to authenticate and compare the suggested methods with current attack detection tactics, this study will make use of various evaluation measurements. The NSL-KDD, which is a benchmark dataset in network intrusion detection research, has a wide variety of network traffic data with instances that are labeled as normal and different attacks. CICIDS-2017 is similar because it contains an extensive dataset too - this includes real-world traces from network traffic where there's both regular activity and harmful actions. The purpose is to enhance the existing status of MANET security so as it can withstand more strongly against cyber dangers. According to the outcomes, it is analyzed that the attack detection accuracy has improved greatly 99 % when compared to other methods, as shown by the detailed assessment measurements. Better handling of big datasets with top detection accuracy reduces the time needed 8.9 s for training and testing models. Decrease in misclassification results and better ability to differentiate normal network actions from harmful intrusions. Improved resistance of MANETs to different cyber dangers, guaranteeing the safety and dependability of network communication in changing and non-centralized settings.

Systematic literature review on intrusion detection systems: Research trends, algorithms, methods, datasets, and limitations

Abstract Machine learning (ML) and deep learning (DL) techniques have demonstrated significant potential in the development of effective intrusion detection systems. This study presents a systematic review of the utilization of ML, DL, optimization algorithms, and datasets in intrusion detection research from 2018 to 2023. We devised a comprehensive search strategy to identify relevant studies from scientific databases. After screening 393 papers meeting the inclusion criteria, we extracted and analyzed key information using bibliometric analysis techniques. The findings reveal increasing publication trends in this research domain and identify frequently used algorithms, with convolutional neural networks, support vector machines, decision trees, and genetic algorithms emerging as the top methods. The review also discusses the challenges and limitations of current techniques, providing a structured synthesis of the state-of-the-art to guide future intrusion detection research.

Enhanced Intrusion Detection with LSTM-Based Model, Feature Selection, and SMOTE for Imbalanced Data

This study introduces a sophisticated intrusion detection system (IDS) that has been specifically developed for internet of things (IoT) networks. By utilizing the capabilities of long short-term memory (LSTM), a deep learning model renowned for its proficiency in modeling sequential data, our intrusion detection system (IDS) effectively discerns between regular network traffic and potential malicious attacks. In order to tackle the issue of imbalanced data, which is a prevalent concern in the development of intrusion detection systems (IDSs), we have integrated the synthetic minority over-sampling technique (SMOTE) into our approach. This incorporation allows our model to accurately identify infrequent incursion patterns. The rebalancing of the dataset is accomplished by SMOTE through the generation of synthetic samples belonging to the minority class. Various strategies, such as the utilization of generative adversarial networks (GANs), have been put forth in order to tackle the issue of data imbalance. However, SMOTE (synthetic minority over-sampling technique) presents some distinct advantages when applied to intrusion detection. The SMOTE is characterized by its simplicity and proven efficacy across diverse areas, including in intrusion detection. The implementation of this approach is straightforward and does not necessitate intricate adversarial training techniques such as generative adversarial networks (GANs). The interpretability of SMOTE lies in its ability to generate synthetic samples that are aligned with the properties of the original data, rendering it well suited for security applications that prioritize transparency. The utilization of SMOTE has been widely embraced in the field of intrusion detection research, demonstrating its effectiveness in augmenting the detection capacities of intrusion detection systems (IDSs) in internet of things (IoT) networks and reducing the consequences of class imbalance. This study conducted a thorough assessment of three commonly utilized public datasets, namely, CICIDS2017, NSL-KDD, and UNSW-NB15. The findings indicate that our LSTM-based intrusion detection system (IDS), in conjunction with the implementation of SMOTE to address data imbalance, outperforms existing methodologies in accurately detecting network intrusions. The findings of this study provide significant contributions to the domain of internet of things (IoT) security, presenting a proactive and adaptable approach to safeguarding against advanced cyberattacks. Through the utilization of LSTM-based deep learning techniques and the mitigation of data imbalance using SMOTE, our AI-driven intrusion detection system (IDS) enhances the security of internet of things (IoT) networks, hence facilitating the wider implementation of IoT technologies across many industries.

Enhancing Cloud Security through Intrusion Detection: A Comprehensive Study Using the ISOT-CID Dataset

Cloud computing has revolutionized data management, offering unparalleled scalability, flexibility, and efficiency. However, its open and multi-tenant nature introduces significant security vulnerabilities, making it an attractive target for cyber threats. Intrusion Detection Systems (IDS) tailored for cloud environments are essential in mitigating these risks. Despite various IDS models, benchmarking datasets representing realistic cloud environments is a substantial limitation. This study utilizes the ISOT Cloud Intrusion Detection Benchmark Dataset (ISOT-CID), a publicly available dataset featuring a range of network and application layer attacks collected from a real production cloud environment. The research explores the dataset's structure, analyzes attack patterns, and evaluates IDS models' performance to provide actionable insights for enhancing cloud security. This work contributes to the field by presenting a systematic analysis of ISOT-CID, identifying effective IDS models, and proposing improvements for future cloud intrusion detection research.

Enhancing Intrusion Detection Systems with a Hybrid Deep Learning Model and Optimized Feature Composition

Systems for detecting intrusions (IDS) are essential for protecting network infrastructures from hostile activity. Advanced methods are required since traditional IDS techniques frequently fail to properly identify sophisticated and developing assaults. In this article, we suggest a novel method for improving IDS performance through the use of a hybrid deep learning model and feature composition optimization. RNN and CNN has strengths that the proposed hybrid deep learning model leverages to efficiently capture both spatial and temporal correlations in network traffic data. The model can extract useful features from unprocessed network packets using CNNs and RNNs, giving a thorough picture of network behaviour. To increase the IDS's ability to discriminate, we also offer feature optimization strategies. We uncover the most pertinent and instructive features that support precise intrusion detection through a methodical feature selection and engineering process. In order to reduce the computational load and improve the model's efficiency without compromising detection accuracy, we also use dimensionality reduction approaches. We carried out extensive experiments using a benchmark dataset that is frequently utilized in intrusion detection research to assess the suggested approach. The outcomes show that the hybrid deep learning model performs better than conventional IDS methods, obtaining noticeably greater detection rates and lower false positive rates. The performance of model is further improved by the optimized feature composition, which offers a more accurate depiction of network traffic patterns.

SoK] Evaluations in Industrial Intrusion Detection Research

SoK] Evaluations in Industrial Intrusion Detection Research

A Lightweight Botnet Exploiting HTTP for Control Flow Denial on Open-Source Medical Systems.

The recent emergence of open-source medical cyber-physical systems has rapidly transformed the healthcare industry. This can be attributed to advancements in 3D printing technology and the growing popularity of open-source microcomputer systems like Arduino and Raspberry Pi. However, the increased use of these systems in hospitals has also raised cybersecurity concerns. In particular, new technologies, such as IoT devices and other mobile devices, have posed new challenges in exploiting modern botnets and determining their effectiveness with limited resources. In this paper, we propose a lightweight and full-encrypted cross-platform botnet system that provides a proof-of-concept demonstration of how a botnet attack can block control flow from the syringe pump in a testbed of an IoT medical network. The emphasis is placed on minimal deployment time and resource usage, making this lightweight botnet different from most traditional botnets, thus furthering cybersecurity research in intrusion detection for open-source medical systems.

A Comparison Experiment of Binary Classification for Detecting the GTP Encapsulated IoT DDoS Traffics in 5G Network

<p>5G is characterized by ultra-low latency and the deployment of large-scale IoT environments. IoT devices with weak security can cause security problems such as network failures in 5G. To solve this problem, automated intrusion detection research using ML was being conducted. In previous studies, detection research using ML in the wired network environment was active, but it was relatively insufficient in the 5G network. In addition, the vast amount of traffic in IoT devices can create latency problems for intrusion detection with ML, making it difficult to achieve ultra-low latency 5G service objectives. Therefore, this study analyzed the meaning of the performance and required time of an optimized single ML model and ensemble learning experiment to detect in real time while ensuring high detection performance of large-capacity DDoS in 5G network. When the 5G GTP encapsulated traffic was collected and binary classification was performed, the optimized single ML model performed more than 99%. Especially, compared with ensemble learning, the experimental results showed similar performance and reduced detection time by at least 34 times. As a result of the experiment, it was shown that a single ML model optimized for detecting IoT DDoS in 5G with ultra-low latency is significant.</p> <p> </p>

Privacy Protection and Intrusion Detection System of Wireless Sensor Network Based on Artificial Neural Network.

With the increasing openness and development of network technology, the network based on the wireless sensor network system has increasingly become an important tool for human social life and production, but it also brings some network security problems. Among them, focus is on network privacy disclosure and foreign intrusion and the research of intrusion detection and privacy protection has increasingly become an important topic of network security. This paper deeply studies the wireless sensor network system based on neural network on the basis of traditional privacy protection and intrusion detection system. Firstly, it applies particle swarm optimization algorithm and constructs a wireless sensor network intrusion detection system based on particle swarm optimization algorithm. The system includes important modules such as data extraction, data analysis, data feedback, and auxiliary decision-making. Compared with other algorithms, particle swarm optimization algorithm does not rely on problem information. It mainly uses real numbers to solve, so the algorithm has strong universality. At the same time, its corresponding principle is simple and easy to implement and less parameters need to be adjusted. Compared with other algorithms, particle swarm optimization algorithm has fast convergence speed and little memory requirement for the computer. At the same time, this paper uses the leap of particle swarm optimization algorithm to make it easier to find the global optimal solution. At the corresponding level of wireless sensor network privacy protection, based on the original data aggregation privacy protection scheme, this paper proposes a privacy protection scheme based on polynomial regression and a user privacy protection scheme based on the same state encryption, which further improves the security of privacy protection and facilitates the management of information. To realize the integrity of user privacy information protection, this paper realizes the decryption of data based on the correlation between binary metadata and compares the corresponding decrypted data with aggregated data, so as to complete the integrity of privacy data protection. The experimental results show that the binary metadata correlation decryption method proposed in this paper and the introduction of the corresponding particle swarm optimization algorithm improve the stability of the system by about 10%, the corresponding system security by a positive proportion, and the integrity of private data by about 10%; therefore, the algorithm proposed in this paper has obvious advantages.

CUPID: A labeled dataset with Pentesting for evaluation of network intrusion detection

Reproducibility of network intrusion detection research necessitates widely available datasets that represent real-world scenarios. One of the key omissions of existing datasets used in empirical evaluations of network intrusions is the lack of human-generated traffic with accurate labels to distinguish benign and malicious behavior. Using an emulated network environment with a vulnerable web application, we collected baseline traffic, human-generated normal user traffic, automated attacks, and the attacks of ten human penetration testers of varying abilities. We preprocessed this collected data to produce a new dataset named the Colorado University Pentesting Intrusion Dataset (CUPID). The attacks span from reconnaissance activities to delivery of an exploit payload. To our knowledge, this is the first collection that provides labeled, Institutional Review Board-approved, benign and attacker data that is publicly available. The CUPID dataset can be used to train and test the limits of classification-based machine learning algorithms used for network intrusion detection systems.

Detection and Investigation of DDoS Attacks in Network Traffic using Machine Learning Algorithms

The Internet of Things (IoT) represents the start of a new age in information technology (IoT). Objects (things) such as smart TVs, telephones, and smartwatches may now connect to the Internet. New services and software improve many consumers' lives. Online lessons based on COVID-9 are also included in child education devices. Multiple device integration is becoming more widespread as the Internet of Things (IoT) grows in popularity. While IoT devices offer tremendous advantages, they may also create network disruptions. This article summarises current DDoS intrusion detection research utilizing machine learning methods. This study examines the detection performance of DDoS attacks utilizing WEKA tools using the most recent NSL KDD datasets. Logistic Regression (LR), Naive Bayes (NB), SVM, K-NN, Decision Tree (DT), and Random Forest (RF) are examples of Machine Learning algorithms. Using K-Nearest Neighbors in the presented assessment (K-NN), accuracy was attained. Finally, future research questions are addressed.

A Systematic Review of the Intrusion Detection Techniques in VANETS

Vehicular Ad hoc Networks are an important subset of MANETs. VANET is the group of vehicles that are connected to each other wirelessly. VANET security is a major issue that is being worked upon these days. One tiny security flaw can cause a huge loss of lives. For ensuring the security, Intrusion Detection Systems (IDS) are implemented in VANETs for detecting any intrusion. The IDS analyzes the network and detects any malicious node if present. This paper presents a comprehensive review of some of the recent and important intrusion detection research works and presents a comparative analysis of the techniques used in detecting intrusions as well as attacks focused.

Comparison of the NSL-KDD dataset and its predecessor the KDD Cup ’99 dataset

This study examines three datasets, notably the KDD Cup '99 and the NSL-KDD datasets, which are commonly used in intrusion detection research in computer networks. The KDD Cup '99 dataset contains five million records, each with 41 attributes that may be used to categorize malicious assaults into four categories: Probe, DoS, U2R, and R2L. Because it was developed by simulation over a virtual computer network, the KDD Cup '99 dataset cannot reflect real traffic statistics. Duplicate and redundant records from the KDD Cup '99 dataset are eliminated from the training and test sets, respectively, in the NSL-KDD dataset.

How to Effectively Collect and Process Network Data for Intrusion Detection?

The number of security breaches in the cyberspace is on the rise. This threat is met with intensive work in the intrusion detection research community. To keep the defensive mechanisms up to date and relevant, realistic network traffic datasets are needed. The use of flow-based data for machine-learning-based network intrusion detection is a promising direction for intrusion detection systems. However, many contemporary benchmark datasets do not contain features that are usable in the wild. The main contribution of this work is to cover the research gap related to identifying and investigating valuable features in the NetFlow schema that allow for effective, machine-learning-based network intrusion detection in the real world. To achieve this goal, several feature selection techniques have been applied on five flow-based network intrusion detection datasets, establishing an informative flow-based feature set. The authors’ experience with the deployment of this kind of system shows that to close the research-to-market gap, and to perform actual real-world application of machine-learning-based intrusion detection, a set of labeled data from the end-user has to be collected. This research aims at establishing the appropriate, minimal amount of data that is sufficient to effectively train machine learning algorithms in intrusion detection. The results show that a set of 10 features and a small amount of data is enough for the final model to perform very well.

High Camouflage Intrusion Detection Method for Structured Database Based on Multi Pattern Matching

with the rise and rapid development of mobile communication, intelligent terminal and data system, we are entering the era of mobile Internet. In recent years, more and more data need to be processed and transmitted in daily life, and structured data is becoming more and more important. Among them, multi-mode matching technology can search data in a wider range. Matching for multiple patterns at a time avoids unnecessary matching, accelerates the matching process, and helps to find longer matching information and obtain higher accuracy. This paper mainly introduces the high camouflage intrusion detection method of structured database based on multi-mode matching. This paper uses the high disguised intrusion detection method of structured database based on multi-mode matching, collects sensitive information of wireless access points and stations through the communication of WLAN in multimodal matching, then intercepts and forges data packets to initiate replay attack. Replay attack is characterized by abnormal traffic in the network, which can be detected by statistical analysis. The experimental results show that the high camouflage intrusion detection method based on multi-mode matching makes the camouflage intrusion detection rate increase by 23%. The limitations of the design and research of camouflage intrusion detection are analyzed, discussed and summarized, so as to enrich the academic research results.

A Study of Machine Learning Algorithms for DDoS Detection

The Internet is used practically everywhere in today's digital environment. With the increased use of the Internet comes an increase in the number of threats. DDoS attacks are one of the most popular types of cyber-attacks nowadays. With the fast advancement of technology, the harm caused by DDoS attacks has grown increasingly severe. Because DDoS attacks may readily modify the ports/protocols utilized or how they function, the basic features of these attacks must be examined. Machine learning approaches have also been used extensively in intrusion detection research. Still, it is unclear what features are applicable and which approach would be better suited for detection. With this in mind, the research presents a machine learning-based DDoS attack detection approach. To train the attack detection model, we employ four Machine Learning algorithms: Decision Tree classifier (ID3), k-Nearest Neighbors (k-NN), Logistic Regression, and Random Forest classifier. The results of our experiments show that the Random Forest classifier is more accurate in recognizing attacks.

Power information network intrusion detection based on deep learning and cloud computing

With the advent of the computer network era, people like to think in deeper ways and methods. In addition, the power information network is facing the problem of information leakage. The research of power information network intrusion detection is helpful to prevent the intrusion and attack of bad factors, ensure the safety of information, and protect state secrets and personal privacy. In this paper, through the NRIDS model and network data analysis method, based on deep learning and cloud computing, the demand analysis of the real-time intrusion detection system for the power information network is carried out. The advantages and disadvantages of this kind of message capture mechanism are compared, and then a high-speed article capture mechanism is designed based on the DPDK research. Since cloud computing and power information networks are the most commonly used tools and ways for us to obtain information in our daily lives, our lives will be difficult to carry out without cloud computing and power information networks, so we must do a good job to ensure the security of network information network intrusion detection and defense measures.

Flow‐based intrusion detection algorithm for supervisory control and data acquisition systems: A real‐time approach

Intrusion detection in supervisory control and data acquisition (SCADA) systems is integral because of the critical roles of these systems in industries. However, available approaches in the literature lack representative flow-based datasets and reliable real-time adaption and evaluation. A publicly available labelled dataset to support flow-based intrusion detection research specific to SCADA systems is presented. Cyberattacks were carried out against our SCADA system test bed to generate this flow-based dataset. Moreover, a flow-based intrusion detection system (IDS) is developed for SCADA systems using a deep learning algorithm. We used the dataset to develop this IDS model for real-time operations of SCADA systems to detect attacks momentarily after they happen. The results show empirical proof of the model’s adequacy when deployed online to detect cyberattacks in real time.

HCRNNIDS: Hybrid Convolutional Recurrent Neural Network-Based Network Intrusion Detection System

Nowadays, network attacks are the most crucial problem of modern society. All networks, from small to large, are vulnerable to network threats. An intrusion detection (ID) system is critical for mitigating and identifying malicious threats in networks. Currently, deep learning (DL) and machine learning (ML) are being applied in different domains, especially information security, for developing effective ID systems. These ID systems are capable of detecting malicious threats automatically and on time. However, malicious threats are occurring and changing continuously, so the network requires a very advanced security solution. Thus, creating an effective and smart ID system is a massive research problem. Various ID datasets are publicly available for ID research. Due to the complex nature of malicious attacks with a constantly changing attack detection mechanism, publicly existing ID datasets must be modified systematically on a regular basis. So, in this paper, a convolutional recurrent neural network (CRNN) is used to create a DL-based hybrid ID framework that predicts and classifies malicious cyberattacks in the network. In the HCRNNIDS, the convolutional neural network (CNN) performs convolution to capture local features, and the recurrent neural network (RNN) captures temporal features to improve the ID system’s performance and prediction. To assess the efficacy of the hybrid convolutional recurrent neural network intrusion detection system (HCRNNIDS), experiments were done on publicly available ID data, specifically the modern and realistic CSE-CIC-DS2018 data. The simulation outcomes prove that the proposed HCRNNIDS substantially outperforms current ID methodologies, attaining a high malicious attack detection rate accuracy of up to 97.75% for CSE-CIC-IDS2018 data with 10-fold cross-validation.