Intrusion Detection Scheme Research Articles

Stacking Enabled Ensemble Learning Based Intrusion Detection Scheme (SELIDS) for IoV

Stacking Enabled Ensemble Learning Based Intrusion Detection Scheme (SELIDS) for IoV

Improved Genetic Algorithm-Based MEP Search Strategy for DSNs Intrusion Detection

Improved Genetic Algorithm-Based MEP Search Strategy for DSNs Intrusion Detection

Enhancing the security in IoT and IIoT networks: An intrusion detection scheme leveraging deep transfer learning

The Internet of Things (IoT) networks, which are defined by their interconnected devices and data streams are an expanding attack surface for cyber adversaries. Industrial Internet of Things (IIoT) is a subset of IoT and has significant importance in-terms of security. Robust intrusion detection systems (IDS) are essential for protecting these critical infrastructures. Our research suggests a novel approach to the detection of anomalies in IoT and IIoT networks that leverages the capabilities of deep transfer learning. Our methodology begins with the EdgeIIoT dataset, which serves as the basis for our data analysis. We convert the data into an appropriate image format to enable Convolutional Neural Network (CNN)-based processing. The hyper-parameters of individual machine learning models are subsequently optimized using a Random Search algorithm. This optimization phase optimizes the performance of each model by modifying the hyper-parameters that are unique to the learning algorithms. The performance of each model is meticulously assessed subsequent to hyper-parameter optimization. The top-performing models are subsequently, strategically selected and combined using the ensemble technique. The IDS scheme’s overall detection accuracy and generalizability are improved by the integration of strengths from multiple models. The proposed scheme demonstrates significant effectiveness in identifying a broad spectrum of attacks, encompassing a total of 14 distinct attack types. This comprehensive detection capability contributes to a more secure and resilient IoT ecosystem. Furthermore, application of quantization to our best models reduces resource utilization significantly without compromising accuracy.

FLSec-RPL: a fuzzy logic-based intrusion detection scheme for securing RPL-based IoT networks against DIO neighbor suppression attacks

The Internet of Things (IoT) has gained popularity and is widely used in modern society. The growth in the sizes of IoT networks with more internet-connected devices has led to concerns regarding privacy and security. In particular, related to the routing protocol for low-power and lossy networks (RPL), which lacks robust security functions, many IoT devices in RPL networks are resource-constrained, with limited computing power, bandwidth, memory, and battery life. This causes them to face various vulnerabilities and potential attacks, such as DIO neighbor suppression attacks. This type of attack specifically targets neighboring nodes through DIO messages and poses a significant security threat to RPL-based IoT networks. Recent studies have proposed methods for detecting and mitigating this attack; however, they produce high false-positive and false-negative rates in detection tasks and cannot fully protect RPL networks against this attack type. In this paper, we propose a novel fuzzy logic-based intrusion detection scheme to secure the RPL protocol (FLSec-RPL) to protect against this attack. Our method is built of three key phases consecutively: (1) it tracks attack activity variables to determine potential malicious behaviors; (2) it performs fuzzy logic-based intrusion detection to identify malicious neighbor nodes; and (3) it provides a detection validation and blocking mechanism to ensure that both malicious and suspected malicious nodes are accurately detected and blocked. To evaluate the effectiveness of our method, we conduct comprehensive experiments across diverse scenarios, including Static-RPL and Mobile-RPL networks. We compare the performance of our proposed method with that of the state-of-the-art methods. The results demonstrate that our method outperforms existing methods in terms of the detection accuracy, F1 score, power consumption, end-to-end delay, and packet delivery ratio metrics.

Efficient Intrusion Detection in Patient Health Records Based on LSTM-Based RNN

Advancements in Information and Communication Technology applications play an important role in the field of healthcare and bio-medical engineering. The process of image processing and analysis starts from receiving visual information to giving out the description of the scene for improving the visual appearance of the human viewer and extract the features of the data. Moreover, IDS can be deployed along with other security mechanisms as a line of defence to ensure security of system and network resources. There have been various efforts in designing IDS using Machine Learning (ML) techniques. Additionally, by developing a hybrid strategy for intrusion detection and classification and using feature engineering approaches to extract significant features for learning, among other things, efforts have been made to improve the classification performance of ML-based IDS. However, as networking technology have advanced, attack types have evolved as well. For this reason, an efficient and successful intrusion detection and classification system must be created. To address the issue and achieve good generalization ability for intrusion detection and classification, the paper presents empirical analysis of LSTM based RNN classifiers. The suggested methods' effectiveness is assessed using a range of performance metrics, such as recall, f-score, accuracy, precision, and False Positive Rate (FPR). The LSTM based RNN method recognize attacks with 99.2% accuracy with minimum time complexity (5 s).

Secure and Reliable Intrusion Detection Scheme for Software-Defined Networking Using LFTS-Rnn and PC-JTFOA

In recent times, Software Defined Networking (SDN) has gained immense popularity among communication networks due to its high network connectivity and security. But, owing to the lack of sufficient security schemes and dynamic access control, conventional techniques could be more efficient. Hence, this paper proposes a secure intrusion detection scheme for SDN utilizing LogishFTS-based Recurrent Neural Networks (LFTS-RNN) and Poisson Clumping Japanese Tree Frog Optimization Algorithm (PC-JTFOA). Initially, by using a username, password, and Signed Access Control (SAC), the registered users log in to the network. The Entropy Makwa-based Digital Signature Algorithm (EMDSA) is utilized to identify the attackers during the login process. Then, the Intrusion Detection System (IDS) is trained using the historical dataset. The critical features are extracted in IDS; subsequently, by using the PC-JTFOA, the optimal features are selected. Likewise, the selected features are inputted into the LFTS-RNN to recognize the intruders in the application plane. Moreover, the process of data security and load balancing is undergone by the data. Afterward, the balanced data is subjected to IDS to detect the attackers in the control plane. According to experimental outcomes, the proposed technique obtained a higher prominence with an accuracy of 98.35%.

Evaluating Federated Learning-Based Intrusion Detection Scheme for Next Generation Networks

Evaluating Federated Learning-Based Intrusion Detection Scheme for Next Generation Networks

Securing Networks in the Digital Age: A Review of Intrusion Detection and Prevention Strategies

In today's interconnected world, billions of individuals rely on the internet for various activities, from communication and commerce to entertainment and education. However, this widespread connectivity also brings about an increased risk of cyber threats and malicious activities. In response to these challenges, intrusion detection technology has emerged as a vital component of modern cybersecurity strategies. This paper presents a comprehensive literature survey focusing on Internal Intrusion Detection Systems (IIDS) and traditional Intrusion Detection Systems (IDS). These systems utilize a diverse array of data mining and forensic techniques algorithms to monitor and analyze system activities in real-time, thereby detecting and preventing potential security breaches. Additionally, the paper explores the integration of data mining methods for cyber analytics, offering valuable insights into the development and enhancement of intrusion detection capabilities. Through a thorough examination of existing research and methodologies, this study aims to provide a deeper understanding of the evolving landscape of intrusion detection and contribute to the advancement of cybersecurity practices in an increasingly digitized world.

Multi-order feature interaction-aware intrusion detection scheme for ensuring cyber security of intelligent connected vehicles

The evolution of technology has raised concerns regarding cybersecurity for intelligent connected vehicles (ICVs). In-vehicle network in ICVs lacks robust protection mechanisms, making it vulnerable to cyber threats. In response, intrusion detection systems (IDSs) for ICVs have been developed to protect vehicles from malicious cyber attacks. However, current IDS methods solely rely on independent features, limiting their learning capabilities and increasing the number of false detections. Moreover, many IDSs require the knowledge of mapping between network messages and contents, which restricts their application. To address these limitations, we propose the Multi-order Feature Interaction-aware Intrusion Detection (MIFI) scheme for ICVs. Feature attention cross network is designed to address higher-order feature interactions, while factorization machine is used for second-order interactions. Then a discriminator is utilized to detect the attacks. MIFI expands the feature space through features interaction, thereby enhancing its ability to detect attacks. Moreover, it perceives the relationships of vehicle messages, facilitating intrusion detection without knowing the corresponding rules of vehicle messages. The performance of the proposed method is evaluated on two real-vehicle datasets, affirming its effectiveness and robustness. MIFI achieves an accuracy of over 99% in detecting different attacks. The proposed method can improve the accuracy of traditional IDS to a maximum of 99.99%, and increase the highest F1-score to 97.18%, demonstrating the model’s ability of achieving multi-order feature interactions. Ultimately, MIFI is suitable for intrusion detection in different types of ICV networks, significantly contributing to the cybersecurity of ICVs.

Auto metric graph neural network optimized with woodpecker mating algorithm for detecting network layer attacks in mobile ad hoc networks

ABSTRACT Nowadays, Mobile Ad hoc Network (MANET) gains more attraction due to its seamless and dynamic use. The existing methods in MANET are plagued by some weaknesses, like higher computation time, undermining their real-time responsiveness. Whereas, lower accuracy in intrusion detection compromises the reliability of these systems, potentially leading to missed threats posing a challenge for effective security measures in dynamic MANET environments. To mitigate these weaknesses, an Auto Metric Graph Neural Network optimized with Woodpecker Mating Algorithm is proposed in this paper for detecting Network Layer Attack in MANET (AGNN-WMA-DNLA-MANET). Initially, the data are gathered from CIC-IDS 2019 dataset. The gathered data undergoes pre-processing to eliminate redundancy and missing values replacement using the Local Least Squares method. Afterward, the preprocessing output is fed to AGNN for classification, which classifies the attack as active, passive, or normal. Then, Woodpecker Mating Algorithm (WMA) is proposed to optimize the AGNN weight parameters to ensure the accurate classification. The proposed technique is executed in NS2 tool. The metrics, like accuracy, false positive rate (FPR) and attack detection rate (ADR), computation time, and RoC is analyzed. The proposed AGNN-WMA-DNLA-MANET approach provides 14.68%, 7.142%, and 4.65% higher accuracy for active attack, 15.19%, 2.77%, and 9.85% higher accuracy for passive attack and 38.18%, 12.02%, and 7.59% better accuracy for normal compared with existing methods, such as Dependable intrusion detection scheme under deep convolutional neural network (DCNN-MANET), deep learning-based intrusion detection scheme for MANET (AE-DNN-MANET), and Benchmarking of machine learning for anomaly based intrusion detection scheme (ML-MANET), respectively.

Proposed algorithm base optimization scheme for intrusion detection using feature selection

<span>The number of devices linked to the internet is rapidly increasing as the internet has become ingrained in every aspect of modern life. However, certain issues are getting worse, and their resolutions are not well-defined. One of the main issues is convergence and speed for communication between different internet of things (IoT) devices and their security. For that purpose, in this paper, an improved artificial bee colony (ABC) algorithm with binary search equations along with neural networks is proposed, known as the artificial bee colony algorithm with binary search equations (BABCN) algorithm for intrusion detection in terms of convergence and speed for communication. The depth-first search framework and binary search equations on which the artificial bee colony algorithm with binary search equations algorithm is built improve the algorithm’s capacity for exploitation and speed up convergence. The initial weight and threshold value of the ABC neural networks are optimized using an algorithm to prevent them from entering a local optimum during the training procedure and accelerating training. The NSL-KDD dataset was used, and based on the results; the proposed algorithm improves classification and has high intrusion detection ability in the network. The proposed has undergone tests to be evaluated, and the results show that it performs better in detection accuracy, time, and false positive rate.</span>

Intelligent intrusion detection for optical fiber perimeter security system based on an improved high efficiency feature extraction technique

The automated analysis of optical fiber vibration sensing data has been highly demanded in engineering applications. Therefore, intrusion analysis, which aims at detecting, recognizing, and classifying intrusions, holds great importance for optical fiber vibration sensing. In this work, an intelligent intrusion detection scheme employing an improved high-efficiency feature extraction technique and utilizing a dual Mach–Zehnder interferometer (DMZI)-based optical fiber perimeter security system is proposed. So, the DMZI-based perimeter security system in practical settings can be successfully established. Specifically, time-frequency feature vectors with nine features are firstly constructed using a maximal overlap discrete wavelet transformation approach and a zero crossing rate method. Then, the feature vectors are classified into corresponding categories using a radial basis function neural network. The effectiveness of the proposed scheme has been validated using six types of human intrusions, such as knocking, climbing, waggling, cutting, crashing and kicking the fence. The results show that the given intrusions can be accurately and rapidly recognized by the proposed scheme. The average recognition rate of 95.0% is achieved, and the average processing time for each sample data is only 0.033 s, which is significantly lower than the sampling interval (0.3 s) in our experiment. It is believed that the proposed scheme holds promising potential in the field of optical fiber perimeter security systems.

An Effective Intrusion Detection Scheme over Wireless Communication Environment based on Artificial Intelligence Enabled Modified Learning Strategy

based on Artificial Intelligence Enabled Modified Learning Strategy In this present digital world, each and every document need to be in system format as well as preserved into the server end. So, that the transactions between client and server entities are handled by using wireless communication schemes. There are millions of individuals hooked up to the internet enabled network today, and each of them possesses some level of sensitive information. Nowadays, the most valuable asset is knowledge about the organization or its users. This attracts the attackers or hackers to acquire the personal or private information from the server end or else the path that is used for communication. Numerous types of hackers attempt to penetrate a private system in order to obtain access and extract all critical data that could harm the infrastructure, posing a significant threat to the firm. These kinds of attacks are called intrusions and the attackers are termed as intruders. This paper has a detailed study of the past detection scheme and proposed a novel intrusion detection scheme to support users to prevent the data from intruders. The major objective of this paper is to design a novel Intrusion Detection System with full of attack handling and identification capabilities as well as prevent the data safe in server end without give a lead to intruders to make an attempt. The motto of this work is to introduce a modified learning strategy with respect to the conventional learning scheme called Artificial Neural Network (ANN) and provides a robust support and resistance to identify the intruders over the wireless communication environment. To make the users more convenient to preserve the data over the remote server environment and make transactions in secured manner with the help of the proposed learning scheme. These objectives are clearly illustrated with graphical representations over the resulting section of this paper. This paper introduced a modified learning scheme called Artificial Intelligence Enabled Modified Learning Strategy (AIeMLS), in which it provides a support to genuine network users to carry on with their private data as well as preserve the data over the server end without any threats. The proposed logic called AIeMLS is derived from the conventional learning scheme called ANN, in which it is composed of a number of processing components that accept inputs and generate outputs according to their predetermined activation functions and it is being used to characterize complex situations and to anticipate the contents of specified model parameters based on their learning data. By modifying the last layer of the ANN and adapt the logic of Support Vector Machine (SVM) into it to customize the model into a novel design. This is helpful to identify the intrusions in an intellectual manner with maximum level of accuracy and performance ratio.The proposed modified learning approach AIeMLS attains the maximum accuracy ratio of 98.5% in an outcome, whereas the other conventional algorithms such as ANN and SVM attain 98% and 96% accuracy in results. These resulting performance and efficiency is portrayed in the resulting section using graphical outputs.This approach of identifying the intrusions over the wireless communication environment is helpful to users in real-time environment and significantly preserves the data in proper manner. In future the work can further be enhanced by means of adding some crypto security features to enhance the security level more in the proposed work.

CatBoost-based Intrusion Detection Method for the Physical Layer of Smart Agriculture

Agriculture holds a pivotal role in the progress of human society. The challenges stemming from a burgeoning population, land degradation, water scarcity, and urbanization have intensified the need for more efficient agricultural production. While smart farming brings significant benefits to farmers and agricultural output, it also introduces complex cybersecurity risks to agricultural production. The security of the physical layer in smart agriculture is intricately tied to crop growth and yield, with indirect implications for the security of the network and application layers. This paper introduces a novel intrusion detection scheme based on CatBoost for the physical layer and evaluates its effectiveness using the publicly available ToN_IOT dataset. In binary classification results, the scheme achieves a remarkable recognition accuracy of 99.94%, along with a precision and recall of 99.88%. In multi-classification results, the scheme outperforms other existing solutions across all metrics. The experimental findings clearly illustrate the exceptional recognition accuracy of this implemented method against physical layer attacks within the domain of smart agriculture. Furthermore, the system’s implementation ensures the security of input data for the smart agriculture network layer, cloud, and blockchain applications.

Binarized Spiking Neural Network with blockchain based intrusion detection framework for enhancing privacy and security in cloud computing environment

Cloud computing (CC) is prone to attacks, which upsurges complication and erudition. By this, its origins provocative implications can enterprise data veracity, concealment, and accessibility. To overwhelm these issues, a Binarized Spiking Neural Network with block chain based deputized proof of stake consensus (DPoS) algorithm fostered intrusion detection scheme is proposed in this manuscript to enhance the privacy and the security on the cloud computing Environment (EP-DPoSBC-ES-BS4NN-IDS-CC). The data is amassed from NSL-KDD benchmark dataset. The first-level privacy process is carried with block chain based deputized proof of stake consensus (DPoS) algorithm. The secondary level privacy process is carried out by utilizing the pre-processing and the feature selection process. For, pre-processing, proposed Basic interlude gradient filtering (BIGF) are utilized to eradicate the unsolicited content and filtering pertinent data. The pre-processing outcome is supplied to the feature selection phase. Here, the ideal features are taken with the help of Weightiness espoused feature assortment approaches (WEFA). The data is classified as normal or abnormal based on Binarized Spiking Neural Network. Subsequently, the proposed EP-DPoSBC-ES-BS4NN-IDS-CC is examined under some performance metrics. The proposed technique attains 12.94 %, 17.68 %, 17.99 % and 13.96 % improved accuracy; 59.9 %, 50 %, 31.45 % and 48.17 % lower Computation Time and 3.19 %, 0.83 %, 2.1 % and 5.43 % higher AUC than the existing methods. Customers and cloud service providers may find this framework useful as a decision-support tool in helping them move their data in a safe, timely, and reliable manner. In future work, a prototype of the approach will develop in real-world scenario, capably inside a tight network of connected computers. It allows evaluate effectively in real-world utility.

An optimized Bi-LSTM with random synthetic over-sampling strategy for network intrusion detection

An optimized Bi-LSTM with random synthetic over-sampling strategy for network intrusion detection

A GAN-based security strategy for WSN networks based on honeypot algorithm

One of the essential elements of the cyber physical system is wireless sensor network (WSN), which is a multi-hop, self-organizing wireless network made up of numerousfixed or moving sensors. It jointly senses, gathers, analyses, and transfer the data ofdetected objects in the network's service area before sending this data to the network' sowner. Blackhole, Grayhole, Flooding, and Scheduling attacks are just a few of theusual WSN attacks that could quickly harm the system. Owing to constrained resourceof sensor nodes, a significant level of redundancy, network data's higher correlation,intrusion detection schemes for wireless sensor networks also have the drawbacks ofpoor identification rate, high computation overhead, and higher false alarm rate. Tooverwhelm the above problems, in this manuscript, Self-Attention-Based ProvisionalVariational Auto-Encoder Generative Adversarial Network (SAPVAGAN) optimized withHoney Badger Algorithms proposed for enhancing Cyber security in Wireless sensornetwork(ECS-WSN-SAPVAGANHBA). Based on the optimum features, the intruders in WSN data are categorizedinto normal and anomalous data (Black hole attack, Gray hole attack, Flooding attackand Scheduling attacks) with the help of SAPVAGAN.In general, SAPVAGANnotexpose any adaption of optimization modes for determining better parameters toassure accurate detection of WSN intrusion. Hence, Honey Badger Algorithm (HBA) isproposed in this work to optimize the SAPVAGAN, which precisely detects the WSNintrusion.The proposed ECS-WSN-SAPVAGANHBA method is performed in Pythonutilizing the WSN-DS dataset. Here, the performance metrics like recall, precision, f-measure,specificity, accuracy, RoC and computation time is evaluated. The proposedmethod provides 23.56%, 12.64%, and 15.63% higher accuracy, 23.14%, 16.78% and20.04% lower computational time analyzed to the existing models,such as IntrusionDetection System in Wireless Sensor Network Using Light GBM method(ECS-WSNSLGBM),Intrusion Detection Scheme in Wireless Sensor Network utilizing RecurrentNeural Network(ECS-WSN-RNN) and Intrusion Detection Scheme for Wireless SensorNetworks utilizing Whale Optimized Gate Recurrent Unit (ECS-WSN-WOGRU)respectively.

Artificial Immune Systems in Local and Network Cybersecurity: An Overview of Intrusion Detection Strategies

In this paper, an overview of artificial immune systems (AIS) used in intrusion detection systems (IDS) is provided, along with a review of recent efforts in this field of cybersecurity. In particular, the focus is on the negative selection algorithm (NSA), a popular, prominent algorithm of the AIS domain based on the human immune system. IDS offer intrusion detection capabilities, both locally and in a network environment. The paper offers a review of recent solutions employing AIS in IDS, capable of detecting anomalous network traffic/breaches and operating system file infections caused by malware. A discussion regarding the reviewed research is presented with an analysis and suggestions for further research, and then the work is concluded.

Intrusion detection system for cyberattacks in the Internet of Vehicles environment

This paper presents a novel framework for intrusion detection specially designed for cyberattacks, such as Denial-of-Service, Distributed Denial-of-Service, Distributed Reflection Denial-of-Service, Brute Force, Botnets, and Sniffing, on vehicles that are situated in the Internet of Vehicles environment. We propose an intrusion detection system based on machine learning that is capable of detecting abnormal behavior by examining network traffic to find unusual data flows. In this paper, we have presented a strategy for intrusion detection through a careful evaluation and selection of the most effective techniques for the following steps of the machine learning process: (i) data preprocessing by using Z-score normalization that preserves the data distribution for the proposed method and handles outliers; (ii) feature selection by using a regression model that simplifies the model complexity and reduces the execution time; and (iii) model selection and training – Random Forest, Extreme Gradient Boosting, Categorical Boosting, Light Gradient Boosting Machine – with hyperparameter optimization to control the behavior in the training phase and to prevent overfitting. The effectiveness of the proposed solution is demonstrated by extensive numerical experiments carried out using the well-known standard datasets CIC-IDS-2017, CSE-CIC-IDS-2018, and CIC-DDoS-2019, both separately and merged. We achieved a high accuracy above 99.8% within a running time of 46.9 s and 0.24 s detection time for the three combined intrusion detection system datasets, thereby showing that the proposed intrusion detection system outperforms the previous methods introduced in the literature.

Cloud-based Near Real-Time Multiclass Interruption Recognition and Classification using Ensemble and Deep Learning

Due to speedy development in internet facilities, detecting intrusions in a real-time cloud environment is challenging via traditional methods. In this case, advanced machine or deep learning methods can be efficiently used in anomaly or intrusion detection. Thus, the present study focuses on designing and developing the intrusion detection scheme using an ensemble learning-based random forest method and deep convolutional neural networks in a near real-time cloud atmosphere. The proposed models were tested on CSE-CICIDS2018 datasets in Python (Anaconda 3) environment. The proposed models achieved 97.73 and 99.91 per cent accuracy using random forest and deep convolutional neural networks, respectively. The developed models can be effectively utilised in real-time cloud datasets to detect intrusions.