Intrusion Detection System Framework Research Articles

Intrusion detection technique in wireless sensor network using grid search random forest with Boruta feature selection algorithm

Attacks in wireless sensor networks (WSNs) aim to prevent or eradicate the network's ability to perform its anticipated functions. Intrusion detection is a defense used in wireless sensor networks that can detect unknown attacks. Due to the incredible development in computer-related applications and massive Internet usage, it is indispensable to provide host and network security. The development of hacking technology tries to compromise computer security through intrusion. Intrusion detection system (IDS) was employed with the help of machine learning (ML) Algorithms to detect intrusions in the network. Classic ML algorithms like support vector machine (SVM), K-nearest neighbour (KNN), and filter-based feature selection often led to poor accuracy and misclassification of intrusions. This article proposes a novel framework for IDS that can be enabled by Boruta feature selection with grid search random forest (BFS-GSRF) algorithm to overcome these issues. The performance of BFS-GSRF is compared with ML algorithms like linear discriminant analysis (LDA) and classification and regression tree (CART) etc. The proposed work was implemented and tested on network security laboratory — knowledge on discovery dataset (NSL-KDD). The experimental results show that the proposed model BFS-GSRF yields higher accuracy (i.e., 99%) in detecting attacks, and it is superior to LDA, CART, and other existing algorithms.

A Novel Hybrid Deep Learning Framework for Intrusion Detection Systems in WSN-IoT Networks

With the advent of wireless communication and digital technology, low power, Internet-enabled, and reconfigurable wireless devices have been developed, which revolutionized day-to-day human life and the economy across the globe. These devices are realized by leveraging the features of sensing, processing the data and nodes communications. The scale of Internet-enabled wireless devices has increased daily, and these devices are exposed to various cyber-attacks. Since the complexity and dynamics of the attacks on the devices are computationally high, intelligent, scalable and high-speed intrusion detection systems (IDS) are required. Moreover, the wireless devices are battery-driven; implementing them would consume more energy, weakening the accuracy of detecting the attacks. Hence the design of the IDS is required, which has to establish the good trade-offs between Energy and accuracy. This research includes the Multi-tiered Intrusion Detection (MDIT) with hybrid deep learning models for improved detection accuracy in wireless networks; spotted hyena optimization (SHO) and Long short-term memory (LSTM) have been studied to design IDS effectively. Extensive experimentation has been carried out in real-time scenarios using the Node MCU Embedded boards and standard benchmarks such as CIDDS-001, UNSWNB15 and KDD++ datasets compared with the other traditional and existing learning models. The average prediction accuracy of 99.89% for all datasets has been achieved. The results show that the proposed system guarantees a high detection accuracy and reduces the prediction time, making this system suitable for resource-constrained IP-enabled wireless devices.

A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-The-Middle Attacks Against Protected Wi-Fi Networks

A Signature-Based Wireless Intrusion Detection System Framework for Multi-Channel Man-in-The-Middle Attacks Against Protected Wi-Fi Networks

Anomaly Detection Framework in Fog-to-Things Communication for Industrial Internet of Things

The rapid development of the Internet of Things (IoT) in the industrial domain has led to the new term the Industrial Internet of Things (IIoT). The IIoT includes several devices, applications, and services that connect the physical and virtual space in order to provide smart, cost-effective, and scalable systems. Although the IIoT has been deployed and integrated into a wide range of industrial control systems, preserving security and privacy of such a technology remains a big challenge. An anomaly-based Intrusion Detection System (IDS) can be an effective security solution for maintaining the confidentiality, integrity, and availability of data transmitted in IIoT environments. In this paper, we propose an intelligent anomaly-based IDS framework in the context of fog-to-things communications to decentralize the cloud-based security solution into a distributed architecture (fog nodes) near the edge of the data source. The anomaly detection system utilizes minimum redundancy maximum relevance and principal component analysis as the featured engineering methods to select the most important features, reduce the data dimensionality, and improve detection performance. In the classification stage, anomaly-based ensemble learning techniques such as bagging, LPBoost, RUSBoost, and Adaboost models are implemented to determine whether a given flow of traffic is normal or malicious. To validate the effectiveness and robustness of our proposed model, we evaluate our anomaly detection approach on a new driven IIoT dataset called X-IIoTID, which includes new IIoT protocols, various cyberattack scenarios, and different attack protocols. The experimental results demonstrated that our proposed anomaly detection method achieved a higher accuracy rate of 99.91% and a reduced false alarm rate of 0.1% compared to other recently proposed techniques.

An Efficient Intrusion Detection Framework Based on Embedding Feature Selection and Ensemble Learning Technique

Network security has emerged as a crucial universal issue that affects enterprises, governments, and individuals. The strategies utilized by the attackers are continuing to evolve, and therefore the rate of attacks targeting the network system has expanded dramatically. An Intrusion Detection System (IDS) is one of the significant defense solutions against sophisticated cyberattacks. However, the challenge of improving the accuracy, detection rate, and minimal false alarms of the IDS continues. This paper proposes a robust and effective intrusion detection framework based on the ensemble learning technique using eXtreme Gradient Boosting (XGBoost) and an embedded feature selection method. Further, the best uniform feature subset is extracted using the up-to-date real-world intrusion dataset Canadian Institute for Cybersecurity Intrusion Detection (CICIDS2017) for all attacks. The proposed IDS framework has successfully exceeded several evaluations on a big test dataset over both multi and binary classification. The achieved results are promising on various measurements with an accuracy overall, precision, detection rate, specificity, F-score, false-negative rate, false-positive rate, error rate, and The Area Under the Curve (AUC) scores of 99.86%, 99.69%, 99.75%, 99.69%, 99.72%, 0.17%, 0.2%, 0.14%, and 99.72 respectively for abnormal class. Moreover, the achieved results of multi-classification are also remarkable and impressively great on all performance metrics.

Cyber Intrusion Detection System Based on a Multiobjective Binary Bat Algorithm for Feature Selection and Enhanced Bat Algorithm for Parameter Optimization in Neural Networks

The staggering development of cyber threats has propelled experts, professionals and specialists in the field of security into the development of more dependable protection systems, including effective intrusion detection system (IDS) mechanisms which are equipped for boosting accurately detected threats and limiting erroneously detected threats simultaneously. Nonetheless, the proficiency of the IDS framework depends essentially on extracted features from network traffic and an effective classifier of the traffic into abnormal or normal traffic. The prime impetus of this study is to increase the performance of the IDS on networks by building a two-phase framework to reinforce and subsequently enhance detection rate and diminish the rate of false alarm. The initial stage utilizes the developed algorithm of a proficient wrapper-approach-based feature selection which is created on a multi-objective BAT algorithm (MOBBAT). The subsequent stage utilizes the features obtained from the initial stage to categorize the traffic based on the newly upgraded BAT algorithm (EBAT) for training multilayer perceptron (EBATMLP), to improve the IDS performance. The resulting methodology is known as the (MOB-EBATMLP). The efficiency of our proposition has been assessed by utilizing the mainstream benchmarked datasets: NLS-KDD, ISCX2012, UNSW-NB15, KDD CUP 1999, and CICIDS2017 which are established as standard datasets for evaluating IDS. The outcome of our experimental analysis demonstrates a noteworthy advancement in network IDS above other techniques.

JAA IDS - FRAMEWORK DESIGN FOR AN EFFICIENT INTRUSION DETECTION SYSTEM

Network security has become a very hot research area as its importance is heavily realized in various fields. Various mechanisms and tools are available to support this. But they do not meet the challenges imposed by fast growing technologies. Massive amounts of high dimensional data are one of the challenges. Data with a large number of features is entering and moving around the network. The Intrusion Detection System is a new mechanism that faces this challenge with the support of data mining and feature selection. In data mining, the ensemble is more preferable than a single method. In an ensemble, during the testing phase, all base classifiers are treated equally and individually participate and vote. To take a final decision, some extra effort has to be made. All these increase computation effort and time. To overcome these, this research paper proposes a new framework for intrusion detection systems using the Auto Bi-Level (ABL) classification technique with Double Filtering Fine Tuning–Ensemble Hybrid method.

A novel time efficient learning-based approach for smart intrusion detection system

BackgroundThe ever increasing sophistication of intrusion approaches has led to the dire necessity for developing Intrusion Detection Systems with optimal efficacy. However, existing Intrusion Detection Systems have been developed using outdated attack datasets, with more focus on prediction accuracy and less on prediction latency. The smart Intrusion Detection System framework evolution looks forward to designing and deploying security systems that use various parameters for analyzing current and dynamic traffic trends and are highly time-efficient in predicting intrusions.AimsThis paper proposes a novel approach for a time-efficient and smart Intrusion Detection System.MethodHerein, we propose a Hybrid Feature Selection approach that aims to reduce the prediction latency without affecting attack prediction performance by lowering the model's complexity. Light Gradient Boosting Machine (LightGBM), a fast gradient boosting framework, is used to build the model on the latest CIC-IDS 2018 dataset.ResultsThe proposed feature selection reduces the prediction latency ranging from 44.52% to 2.25% and the model building time ranging from 52.68% to 17.94% in various algorithms on the CIC-IDS 2018 dataset. The proposed model with hybrid feature selection and LightGBM gives 97.73% accuracy, 96% sensitivity, 99.3% precision rate, and comparatively low prediction latency. The proposed model successfully achieved a raise of 1.5% in accuracy rate and 3% precision rate over the existing model. An in-depth analysis of network parameters is also performed, which gives a deep insight into the variation of network parameters during the benign and malicious sessions.

A novel workload scheduling framework for intrusion detection system in NFV scenario

Compared with traditional Intrusion Detection System (IDS) solutions, deploying IDS in Network Function Virtualization (NFV) environment can have better scalability and flexibility. Existing research works in this area do not consider many IDS features to design IDS-specific workload scheduling approaches. Thus, there is space further to promote the performance of IDS deployment in the NFV scenario. In this paper, we find some critical IDS features by analyzing packet processing procedures, software implementation, and rulesets of typical IDS. Combining these features with the flexibility of NFV, we propose a novel workload scheduling framework for IDS deployment in the NFV scenario. Our framework contains two parts: 1) a novel protocol & destination port based traffic migration strategy which can promote the detection performance and reduce the memory usage compared with the traditional 5-tuple hash based strategy; 2) an auto-configuration algorithm to find a better-than-default configuration for each Virtual Network Function (VNF) instance. We evaluate our framework with real network traffic and benchmark traffic datasets for IDS. Experimental results show that our framework can always have better detection performance and lower memory usage than the 5-tuple hash based migration strategy and the default configuration.

A flow-based intrusion detection framework for internet of things networks

The application of the Internet of Things concept in domains such as industrial control, building automation, human health, and environmental monitoring, introduces new privacy and security challenges. Consequently, traditional implementation of monitoring and security mechanisms cannot always be presently feasible and adequate due to the number of IoT devices, their heterogeneity and the typical limitations of their technical specifications. In this paper, we propose an IP flow-based Intrusion Detection System (IDS) framework to monitor and protect IoT networks from external and internal threats in real-time. The proposed framework collects IP flows from an IoT network and analyses them in order to monitor and detect attacks, intrusions, and other types of anomalies at different IoT architecture layers based on some flow features instead of using packet headers fields and their payload. The proposed framework was designed to consider both the IoT network architecture and other IoT contextual characteristics such as scalability, heterogeneity, interoperability, and the minimization of the use of IoT networks resources. The proposed IDS framework is network-based and relies on a hybrid architecture, as it involves both centralized analysis and distributed data collection components. In terms of detection method, the framework uses a specification-based approach drawn on normal traffic specifications. The experimental results show that this framework can achieve ≈ 100% success and 0% of false positives in detection of intrusions and anomalies. In terms of performance and scalability in the operation of the IDS components, we study and compare it with three different conventional IDS (Snort, Suricata, and Zeek) and the results demonstrate that the proposed solution can consume fewer computational resources (CPU, RAM, and persistent memory) when compared to those conventional IDS.

A GPU-assisted NFV framework for intrusion detection system

The network function virtualization (NFV) paradigm advocates the replacement of specific-purpose hardware supporting packet processing by general-purpose ones, reducing costs and bringing more flexibility and agility to the network operation. However, this shift can degrade the network performance due to the non-optimal packet processing capabilities of the general-purpose hardware. Meanwhile, graphics processing units (GPUs) have been deployed in many data centers (DCs) due to their broad use in, e.g., machine learning (ML). These GPUs can be leveraged to accelerate the packet processing capability of virtual network functions (vNFs), but the delay introduced can be an issue for some applications. Our work proposes a framework for packet processing acceleration using GPUs to support vNF execution. We validate the proposed framework with a case study, analyzing the benefits of using GPU to support the execution of an intrusion detection system (IDS) as a vNF and evaluating the traffic intensities where using our framework brings the most benefits. Results show that the throughput of the system increases from 50 Mbps to 1 Gbps by employing our framework while reducing the central process unit (CPU) resource usage by almost 40%. The results indicate that GPUs are a good candidate for accelerating packet processing in vNFs.11The complete implementation of the software components reported in this work will be published in open-source format upon paper acceptance.

Deep Learning based Optimal Multimodal Fusion Framework for Intrusion Detection Systems for Healthcare Data

Data fusion is a multidisciplinary research area that involves different domains. It is used to attain minimum detection error probability and maximum reliability with the help of data retrieved from multiple healthcare sources. The generation of huge quantity of data from medical devices resulted in the formation of big data during which data fusion techniques become essential. Securing medical data is a crucial issue of exponentially-pacing computing world and can be achieved by Intrusion Detection Systems (IDS). In this regard, since singular-modality is not adequate to attain high detection rate, there is a need exists to merge diverse techniques using decision-based multimodal fusion process. In this view, this research article presents a new multimodal fusion-based IDS to secure the healthcare data using Spark. The proposed model involves decision-based fusion model which has different processes such as initialization, pre-processing, Feature Selection (FS) and multimodal classification for effective detection of intrusions. In FS process, a chaotic Butterfly Optimization (BO) algorithm called CBOA is introduced. Though the classic BO algorithm offers effective exploration, it fails in achieving faster convergence. In order to overcome this, i.e., to improve the convergence rate, this research work modifies the required parameters of BO algorithm using chaos theory. Finally, to detect intrusions, multimodal classifier is applied by incorporating three Deep Learning (DL)-based classification models. Besides, the concepts like Hadoop MapReduce and Spark were also utilized in this study to achieve faster computation of big data in parallel computation platform. To validate the outcome of the presented model, a series of experimentations was performed using the benchmark NSLKDDCup99 Dataset repository. The proposed model demonstrated its effective results on the applied dataset by offering the maximum accuracy of 99.21%, precision of 98.93% and detection rate of 99.59%. The results assured the betterment of the proposed model.

An Efficient IDS Framework for DDoS Attacks in SDN Environment

The rapid usage of the Internet for the last few decades has lead to the deployment of high-speed networks in commercial and educational institutions. As network traffic is increasing, security challenges are also increasing in the high-speed network. Although the Intrusion Detection System (IDS) has a significant role in spotting potential attacks, the heavy traffic flow causes severe technical challenges relating to monitoring and detecting the network activities. Moreover, the devastating nature of the Distributed Denial-of-Service (DDoS) attack draws out as a significant cyber-attack regardless of the emergence of Software Defined Network (SDN) architecture. This paper proposes a novel framework to address the performance issues of IDS and the design issues of SDN about DDoS attacks by incorporating intelligence in the data layer using Data Plane Development Kit (DPDK) in the SDN architecture. This novel framework is named as DPDK based DDoS Detection (D3) framework, since DPDK provides fast packet processing and monitoring in the data plane. Moreover, the statistical anomaly detection algorithm implemented in the data plane as Virtual Network Function (VNF) using DPDK offers fast detection of DDoS attacks. The experimental results of the D3 framework guarantee both efficiency and effect of the novel IDS framework. The publicly available CIC DoS datasets also ensure the detection effect of a single statistical anomaly detection algorithm against the DDoS attack.

Intrusion Detection System for Internet of Things Based on Temporal Convolution Neural Network and Efficient Feature Engineering

In the era of the Internet of Things (IoT), connected objects produce an enormous amount of data traffic that feed big data analytics, which could be used in discovering unseen patterns and identifying anomalous traffic. In this paper, we identify five key design principles that should be considered when developing a deep learning-based intrusion detection system (IDS) for the IoT. Based on these principles, we design and implement Temporal Convolution Neural Network (TCNN), a deep learning framework for intrusion detection systems in IoT, which combines Convolution Neural Network (CNN) with causal convolution. TCNN is combined with Synthetic Minority Oversampling Technique-Nominal Continuous (SMOTE-NC) to handle unbalanced dataset. It is also combined with efficient feature engineering techniques, which consist of feature space reduction and feature transformation. TCNN is evaluated on Bot-IoT dataset and compared with two common machine learning algorithms, i.e., Logistic Regression (LR) and Random Forest (RF), and two deep learning techniques, i.e., LSTM and CNN. Experimental results show that TCNN achieves a good trade-off between effectiveness and efficiency. It outperforms the state-of-the-art deep learning IDSs that are tested on Bot-IoT dataset and records an accuracy of 99.9986% for multiclass traffic detection, and shows a very close performance to CNN with respect to the training time.

A tfidfvectorizer and singular value decomposition based host intrusion detection system framework for detecting anomalous system processes

Host based intrusion detection systems (HIDSs) are indispensable tools for providing a comprehensive security solution. They are capable of detecting host specific attacks, which cannot be detected using network based intrusion detection systems (NIDSs). This paper proposes a novel tfidfvectorizer and truncated singular value decomposition (SVD) based host intrusion detection system (HIDS) framework for identification of anomalous system processes in real time. The proposed HIDS framework takes the system call trace files as its input and transforms them into n-gram feature vector representational models. The framework then uses a vectorization technique called the tfidfvectorizer to compute the tfidf values of the n-gram terms of the transformed feature vectors. Dimensionality reduction of the transformed n-gram feature vectors are then carried out using truncated SVD based on their tfidf values. The dimensionality reduced tfidfvectorized n-gram feature vectors are finally provided as inputs to various machine learning based classifier models to determine whether the corresponding system call trace files are normal or anomalous. Experimental results on the benchmark ADFA-LD and ADFA-WD datasets show that the proposed HIDS framework effectively detects anomalous system processes with high accuracy and low processing overhead. It is also shown to outperform other HIDS frameworks proposed in the literature.

Anomaly Detection in Wireless Sensor Networks: A Proposed Framework

With the rise of IOT devices and the systems connected to the internet, there was, accordingly, an ever-increasing number of network attacks (e.g. in DOS, DDOS attacks). A very significant research problem related to identifying Wireless Sensor Networks (WSN) attacks and the analysis of the sensor data is the detection of the relevant anomalies. In this paper, we propose a framework for intrusion detection system in WSN. The first two levels are located inside the WSN, one of them is between sensor nodes and the second is between the cluster heads. While the third level located on the cloud, and represented by the base stations. In the first level, which we called light mode, we simulated an intrusion traffic by generating data packets based on TCPDUMP data, which contain intrusion packets, our work, is done by using WSN technology. We used OPNET simulation for generating the traffic because it allows us to collect intrusion detection data in order to measure the network performance and efficiency of the simulated network scenarios. Finally, we report the experimental results by mimicking a Denial-of-Service (DOS) attack. <em> </em>

Real time dataset generation framework for intrusion detection systems in IoT

The Internet of Things (IoT) has evolved in the last few years to become one of the hottest topics in the area of computer science research. This drastic increase in IoT applications across different disciplines, such as in health-care and smart industries, comes with a considerable security risk. This is not limited only to attacks on privacy; it can also extend to attacks on network availability and performance. Therefore, an intrusion detection system is essential to act as the first line of defense for the network. IDS systems and algorithms depend heavily on the quality of the dataset provided. Sadly, there has been a lack of work in evaluating and collecting intrusion detection system related datasets that are designed specifically for an IoT ecosystem. Most of the studies published focus on outdated and non-compatible datasets such as the KDD98 dataset. Therefore, in this paper, we aim to investigate the existing datasets and their applications for IoT environments. Then we introduce a real-time data collection framework for building a dataset for intrusion detection system evaluation and testing. The main advantages of the proposed dataset are that it contains features that are explicitly designed for the 6LoWPAN/RPL network, the most widely used protocol in the IoT environment.

Intrusion Detection System for IoT Heterogeneous Perceptual Network

With the acceleration of the Internet of things (IoT) construction, the security and energy consumption of IoT will become an import factor restricting the overall development of the IoT. In order to reduce the energy consumption of the IoT heterogeneous perceptual network in the attack-defense process, the placement strategy of the intrusion detection system (IDS) described in this paper is to place the IDS on the cluster head nodes selected by the clustering algorithm called ULEACH, which we have proposed in this paper. By optimizing the calculation of the node threshold, the ULEACH clustering algorithm will comprehensively consider the heterogeneity of the perceptual nodes and take the residual energy, energy consumption rate, and overall performance of the nodes into account. As a result, the strategy improves the utilization of the nodes to enhance the performance of heterogeneous perceptual network and extend the lifetime of the system. Furthermore, the paper proposes a intrusion detection system framework and establishes dynamic intrusion detection model for IoT heterogeneous perceptual network based on game theory, by applying modified particle swarm optimization, the optimal defense strategy that could balance the detection efficiency and energy consumption of the system is obtained. Finally, the experiment results show that proposed strategy not only effectively detects multiple network attacks, but also reduces energy consumption.

Multi-cloud cooperative intrusion detection system: trust and fairness assurance

The sophistication of the recent cloud computing systems has made them more vulnerable to intelligent cyber attacks. Moreover, it is becoming very difficult for a single intrusion detection system (IDS) to detect all existing attacks, due to limited knowledge about such attacks’ patterns and implications. Recent works in cloud security have shown that cooperation among cloud-based IDSs can enhance their accuracy. However, there are two main challenges associated with the existing cooperative IDSs, which are related to trust and fairness assurance. To tackle these challenges, we propose in this paper a cooperative cloud-based IDS framework that (1) enables IDSs to distributively form trustworthy IDSs communities by advancing a trust-based hedonic coalitional game, which allows IDSs to increase their individual detection accuracy in the presence of untrusted IDSs and (2) formulates a fairness assurance mechanism as a Stackelberg game between the well-behaving IDSs and the selfish ones that frequently send consultation requests to other IDSs, and at the same do not answer other IDSs’ consultation requests. Experimental results show the effectiveness of the proposed approach in terms of enhancing the accuracy of detection and achieving the fairness among IDSs in terms of benefits obtained through cooperation.

Network Intrusion Detection Based on Novel Feature Selection Model and Various Recurrent Neural Networks

The recent increase in hacks and computer network attacks around the world has intensified the need to develop better intrusion detection and prevention systems. The intrusion detection system (IDS) plays a vital role in detecting anomalies and attacks on the network which have become larger and more pervasive in nature. However, most anomaly-based intrusion detection systems are plagued by high false positives. Furthermore, Remote-to-Local (R2L) and User-to-Root (U2R) are two kinds of attack which have low predicted accuracy scores in advance IDS methods. Therefore, this paper proposes a novel IDS framework to overcome these IDS problems. The proposed framework including three main parts. The first part is to build SFSDT model which is the feature selection model. SFSDT is to generate the best feature subset from the original feature set. This model is a hybrid Sequence Forward Selection (SFS) algorithm and Decision Tree (DT) model. The second part is to build various IDS models to train on the best-selected feature subset. The various Recurrent Neural Networks (RNN) are traditional RNN, Long Short-Term Memory (LSTM), and Gated Recurrent Unit (GRU). Two IDS datasets are used for the learned models in experiments including NSL-KDD in 2010 and ISCX in 2012. The final part is to evaluate the proposed model by comparing the proposed models to other IDS models. The experimental results show the proposed models achieve significantly improved accuracy detection rate as well as attack types classification. Furthermore, this approach can reduce the computation time by memory profilers measurement.