Intrusion Detection System Model Research Articles

Role of Education and Awareness Programs in Fostering Energy Conservation Behavior in Cities: Empowering Urban Sustainability Using Deep Learning Approach

This paper introduces a pioneering framework that emphasizes the critical role of education in promoting energy conservation behavior within urban environments. By synergizing deep learning methodologies with education-awareness formulations and algorithm, the framework aims to bolster energy conservation security in cities. A central aspect of this framework is the development of an advanced Intrusion Detection System (IDS) model, utilizing Restricted Boltzmann Machines (RBMs) tailored to enhance energy consumption security. Through six strategic integrations of educational components, the IDS not only identifies but also mitigates potential threats to energy systems with unprecedented efficiency. Additionally, the research introduces a novel evolutionary feature selection method based on Memetic Algorithms (MAs), which strategically identifies crucial features for RBM training, ensuring optimal model performance. The incorporation of Memetic Algorithms facilitates individual learning and problem-specific knowledge transmission, further enhancing the adaptive capabilities of the system. This multifaceted approach underscores the pivotal role of education in fostering urban sustainability, pushing the boundaries of energy conservation security. By proactively responding to emerging threats, the proposed framework contributes significantly to the overarching goal of sustainable and secure urban energy management.

PCA-ANN: Feature selection based hybrid intrusion detection system in software defined network

Software Defined Networking (SDN) proposes a centralized network paradigm where a central controller manages the network. While this centralizes scheme opens up previously unachievable opportunities, it also makes the network more susceptible to a varying range of cyber threats. The development of effective Intrusion Detection Systems (IDS) designed for the SDN topology is a critical need to address the different vulnerabilities SDN faces. Towards that purpose, the inSDN dataset was specifically curated for intrusion detection in SDN with various attack scenarios unique to the SDN topology. This study leveraged the inSDN dataset to introduce an innovative Intrusion Detection System (IDS) model that amalgamates Principal Component Analysis (PCA), a dimensionality reduction technique widely employed in traditional Machine Learning (ML) to extract the principal features of the dataset and couples it with Artificial Neural Networks (ANN) to classify network traffic based on the extracted features. The proposed model attains an exceptional accuracy rate of 99.95% for multi-class classification and demonstrate that it surpasses the current state-of-the-art techniques while operating within a much simpler framework. This significantly diminishes the necessity for complex models that demand extensive computational resources when dealing with the inSDN attack dataset. The analysis of the dataset carried out in this study also provides insights into the redundancy present in the dataset and identifies the core features that contains most of the information in the dataset.

Optimized Intrusion Detection System in Fog Computing Environment Using Automatic Termination-based Whale Optimization with ELM

In fog computing, computing resources are deployed at the network edge, which can include routers, switches, gateways, and even end-user devices. Fog computing focuses on running computations and storing data directly on or near the fog devices themselves. The data processing occurs locally on the device, reducing the reliance on network connectivity and allowing for faster response times. However, the conventional intrusion detection system (IDS) failed to provide security during the data transfer between fog nodes to cloud, fog data centres. So, this work implemented the optimized IDS in fog computing environment (OIDS-FCE) using advanced naturally inspired optimization algorithms with extreme learning. Initially, the data preprocessing operation maintains the uniform characteristics in the dataset by normalizing the columns. Then, comprehensive learning particle swarm based effective seeker optimization (CLPS-ESO) algorithm extracts the intrusion specific features by analyzing the internal patterns of all rows, columns. In addition, automatic termination-based whale optimization algorithm (ATWOA) selects the best intrusion features from CLPS-ESO resultant features using correlation analysis. Finally, the hybrid extreme learning machine (HELM) classifies the varies instruction types from ATWOA optimal features. The simulation results show that the proposed OIDS-FCE achieved 98.52% accuracy, 96.38% precision, 95.50% of recall, and 95.90% of F1-score using UNSW-NB dataset, which are higher than other artificial intelligence IDS models.

Improved Elman Deep Learning Model for Intrusion Detection System in Internet of Things

Many researchers have developed intrusion detection systems in the past using conventional techniques such as artificial neural networks, fuzzy clustering, evolutionary algorithms, association rule mining, and support vector machines. However, in terms of false negative rates and detection rates, these methods did not yield the best outcomes. To address these problems, we proposed a hybrid deep learning model (HDLM) based on intrusion detection and prevention in IoT devices. Initially, the data are collected from KDDCup-99 and NSL-KDD datasets. Then, the important features are extracted from the dataset using the Forward Feature Selection Algorithm (FFSA). Finally, the extracted features are given to the HDLM classifier. The proposed HDLM is a combination of Elman Recurrent Neural Network (ERNN) and Subtraction-Average-Based Optimizer (SABO). The performance of the suggested method is assessed using performance metrics including precision, recall, accuracy, sensitivity, specificity, and F_Measure. The experimental results show that the proposed method attained the maximum intrusion detection accuracy of 98.52%.

Ensemble averaging deep neural network for botnet detection in heterogeneous Internet of Things devices

The botnet attack is one of the coordinated attack types that can infect Internet of Things (IoT) devices and cause them to malfunction. Botnets can steal sensitive information from IoT devices and control them to launch another attack, such as a Distributed Denial-of-Service (DDoS) attack or email spam. This attack is commonly detected using a network-based Intrusion Detection System (NIDS) that monitors the network device’s activity. However, IoT network is dynamic and IoT devices have many types with different configurations and vendors in IoT environments. Therefore, this research proposes an Intrusion Detection System (IDS) by ensemble-ing traffic from heterogeneous IoT devices. This research proposes Deep Neural Network (DNN) to create a training model from each heterogeneous IoT device. After that, each training model from each heterogeneous IoT device is used to predict the traffic. The prediction results from each training model are averaged using the ensemble averaging method to determine the final result. This research used the N-BaIoT dataset to validate the proposed IDS model. Based on experimental results, ensemble averaging DNN can detect botnet attacks in heterogeneous IoT devices with an average accuracy of 97.21, precision of 91.41, recall of 87.31, and F1-score 88.48.

A fog-edge-enabled intrusion detection system for smart grids

The Smart Grid (SG) heavily depends on the Advanced Metering Infrastructure (AMI) technology, which has shown its vulnerability to intrusions. To effectively monitor and raise alarms in response to anomalous activities, the Intrusion Detection System (IDS) plays a crucial role. However, existing intrusion detection models are typically trained on cloud servers, which exposes user data to significant privacy risks and extends the time required for intrusion detection. Training a high-quality IDS using Artificial Intelligence (AI) technologies on a single entity becomes particularly challenging when dealing with vast amounts of distributed data across the network. To address these concerns, this paper presents a novel approach: a fog-edge-enabled Support Vector Machine (SVM)-based federated learning (FL) IDS for SGs. FL is an AI technique for training Edge devices. In this system, only learning parameters are shared with the global model, ensuring the utmost data privacy while enabling collaborative learning to develop a high-quality IDS model. The test and validation results obtained from this proposed model demonstrate its superiority over existing methods, achieving an impressive percentage improvement of 4.17% accuracy, 13.19% recall, 9.63% precision, 13.19% F1 score when evaluated using the NSL-KDD dataset. Furthermore, the model performed exceptionally well on the CICIDS2017 dataset, with improved accuracy, precision, recall, and F1 scores reaching 6.03%, 6.03%, 7.57%, and 7.08%, respectively. This novel approach enhances intrusion detection accuracy and safeguards user data and privacy in SG systems, making it a significant advancement in the field.

Intrusion Detection System

The use of encrypted data, the diversity of new protocols, and the surge in the number of malicious activities worldwide have posed new challenges for intrusion detection systems (IDS). In this scenario, existing signature-based IDS are not performing well. Various researchers have proposed machine learning-based IDS to detect unknown malicious activities based on behaviour patterns. Results have shown that machine learning-based IDS perform better than signature-based IDS (SIDS) in identifying new malicious activities in the communication network. In this paper, the authors have analyzed the IDS dataset that contains the most current common attacks and evaluated the performance of network intrusion detection systems by adopting two data resampling techniques and 10 machine learning classifiers. It has been observed that the top three IDS models—KNeighbors, XGBoost, and AdaBoost—outperform binary-class classification with 99.49%, 99.14%, and 98.75% accuracy, and XGBoost, KNneighbors, and GaussianNB outperform in multi-class classification with 99.30%, 98.88%, and 96.66% accuracy.

Secure and privacy-preserving intrusion detection in wireless sensor networks: Federated learning with SCNN-Bi-LSTM for enhanced reliability

As the digital landscape expands rapidly due to technological advancements, cybersecurity concerns have become more prevalent. Intrusion Detection Systems (IDSs), which are crucial for identifying unusual network traffic indicative of malicious activity, have become a necessity. These systems can be either hardware or software-based. However, traditional IDS models often fail to adequately protect data privacy and detect complex, unique breaches, particularly within Wireless Sensor Networks (WSNs). To address these limitations, this paper proposes a novel Stacked Convolutional Neural Network and Bidirectional Long Short Term Memory (SCNN-Bi-LSTM) model for intrusion detection in WSNs. This model leverages Federated Learning (FL) to enhance intrusion detection performance and safeguard privacy. The FL-based SCNN-Bi-LSTM model is unique in its approach, allowing multiple sensor nodes to collaboratively train a central global model without revealing private data, thereby alleviating privacy concerns. The deep learning methodology of the SCNN-Bi-LSTM model effectively identifies sophisticated and previously unknown cyber threats by meticulously examining both local and temporal linkages in network patterns. The model has been specifically designed to detect and categorize different types of Denial of Service (DoS) attacks using specialized WSN-DS and CIC-IDS-2017 datasets. Compared to traditional Artificial Deep Neural Network (ADNN) models, our proposed FL-SCNN-Bi-LSTM model demonstrated superior detection rates for complex and unknown attacks, significantly improving IDS performance. The model achieved a notable classification accuracy of approximately 99.9% precision and recall on both datasets, substantially reducing false positives and negatives. Our research underscores the potential of federated learning and deep learning in enhancing the security and privacy of WSNs. The proposed FL-SCNN-Bi-LSTM architecture not only facilitates the identification of complex cyber threats but also exemplifies how deep learning techniques can be employed to bolster intrusion detection systems while preserving user data privacy.

Detecting cyberthreats in Metaverse learning platforms using an explainable DNN

The rapid integration of the Internet of Artificial Intelligence and Internet of Things (AI-IoT) technologies has given rise to a pivotal element of the upcoming digital era, the Metaverse. This confluence has significantly impacted virtual learning platforms by introducing enhanced, immersive, and interactive environments for learners, educators, and institutions. However, the growing reliance on Metaverse necessitates robust cybersecurity measures to detect and mitigate cyber threats and ensure the safety of users. This paper proposes an explainable deep neural network (DNN) designed to identify and address network intrusion attacks within Metaverse learning environments. By leveraging the latest cybersecurity IoT datasets and employing an effective feature selection method, this study provides a visually interpretable, trustworthy, and quantitative explanation of the network intrusion detection system (NIDS) model using Shapley Additive exPlanations (SHAP) and local interpretable model-agnostic explanation (LIME) explainability methods. The adopted explainable DNN, capable of processing network traffic features from interconnected Metaverse devices and IoT sensors, can facilitate accurate and comprehensible remediation of anomalous from benign activities within Metaverse. The NIDS model yields a high performing accuracy of 99.9% for establishing a more secure and trustworthy metaverse learning environment.

Zero-Trust Marine Cyberdefense for IoT-Based Communications: An Explainable Approach

Integrating Explainable Artificial Intelligence (XAI) into marine cyberdefense systems can address the lack of trustworthiness and low interpretability inherent in complex black-box Network Intrusion Detection Systems (NIDS) models. XAI has emerged as a pivotal focus in achieving a zero-trust cybersecurity strategy within marine communication networks. This article presents the development of a zero-trust NIDS framework designed to detect contemporary marine cyberattacks, utilizing two modern datasets (2023 Edge-IIoTset and 2023 CICIoT). The zero-trust NIDS model achieves an optimal Matthews Correlation Coefficient (MCC) score of 97.33% and an F1-score of 99% in a multi-class experiment. The XAI approach leverages visual and quantitative XAI methods, specifically SHapley Additive exPlanations (SHAP) and the Local Interpretable Model-agnostic Explanations (LIME) algorithms, to enhance explainability and interpretability. The research results indicate that current black-box NIDS models deployed for marine cyberdefense can be made more reliable and interpretable, thereby improving the overall cybersecurity posture of marine organizations.

Improving Network Security: An Intrusion Detection System (IDS) Dataset from Higher Learning Institutions, Mbeya University of Science and Technology (MUST), Tanzania

Nowadays, Internet-driven culture securing computer networks in Higher Learning Institutions (HLIs) has become a major responsibility. Intrusion Detection Systems (IDS) are crucial for protecting networks from unauthorized activity and cyber threats. This paper examines the process of improving network security by creating a comprehensive IDS dataset using real traffic from HLIs, highlighting the importance of accurate and representative data in improving the system's ability to identify and mitigate future cyber-attacks. The IDS model was created using a variety of machine learning (ML) techniques. Metrics like accuracy, precision, recall, and F1-score were used to assess the performance of each model. The dataset used for training and testing was real-world network traffic data obtained from the institution's computer network. The results showed that the developed IDS obtained exceptional accuracy rates, with Random Forest, Gradient Boosting, and XGBoost models all achieving an accuracy of around 93%. Precision and recall values were likewise quite high across all algorithms. Furthermore, the study discovered that data quality has a substantial impact on IDS performance. Proper data preparation, feature engineering, and noise removal were found to be helpful in improving model accuracy and reducing false positives. While the IDS models performed well throughout validation and testing, implementing such systems in a production setting necessitates careful thought. As a result, the essay also examined the procedures for testing and deploying the IDS models in a real-world scenario. It underlined the significance of ongoing monitoring and maintenance in order to keep the model effective in identifying intrusions. The research aids in the progress of network security in HLI. Educational institutions can better protect their precious assets and sensitive information from cyberattacks by understanding the impact of data quality on IDS performance and implementing effective deployment techniques

Intrusion Detection in Internet of Things Systems: A Feature Extraction with Naive Bayes Classifier Approach

The Internet of Things (IoT) has proliferated, transitioning from modest home automation to encompass sectors like healthcare, agriculture, transportation, and manufacturing. This evolution is characterized by devices' ability to autonomously gather, disseminate, and analyze data, leading to improved real-time decision-making, predictive insights, and customized user experiences. The ubiquity of IoT, while promising, introduces significant data security concerns. The vast number of interlinked devices and diverse and often insufficient security features make them vulnerable to cyber threats, emphasizing the need for robust security mechanisms. Intrusion Detection Systems (IDS) have traditionally acted as vital guards against such threats; however, with the ever-increasing data in the IoT, traditional IDS models, such as Naive Bayes, face processing speed and accuracy challenges. This paper introduces a novel model, "FE+NB," which merges advanced Feature Extraction (FE) with the Naive Bayes (NB) classifier. Central to this model is the "Temporal-Structural Synthesis" technique tailored for IoT traffic data, focusing on data compression, temporal and structural analyses, and Feature Selection (FS) using mutual information. Consequently, the model enhances efficiency and accuracy in Intrusion Detection (ID) in complex IoT networks.

Oversampling and undersampling for intrusion detection system in the supervisory control and data acquisition IEC 60870‐5‐104

AbstractSupervisory control and data acquisition systems are critical in Industry 4.0 for controlling and monitoring industrial processes. However, these systems are vulnerable to various attacks, and therefore, intelligent and robust intrusion detection systems as security tools are necessary for ensuring security. Machine learning‐based intrusion detection systems require datasets with balanced class distribution, but in practice, imbalanced class distribution is unavoidable. A dataset created by running a supervisory control and data acquisition IEC 60870‐5‐104 (IEC 104) protocol on a testbed network is presented. The dataset includes normal and attacks traffic data such as port scan, brute force, and Denial of service attacks. Various types of Denial of service attacks are generated to create a robust and specific dataset for training the intrusion detection system model. Three popular techniques for handling class imbalance, that is, random over‐sampling, random under‐sampling, and synthetic minority oversampling, are implemented to select the best dataset for the experiment. Gradient boosting, decision tree, and random forest algorithms are used as classifiers for the intrusion detection system models. Experimental results indicate that the intrusion detection system model using decision tree and random forest classifiers using random under‐sampling achieved the highest accuracy of 99.05%. The intrusion detection system model's performance is verified using various metrics such as recall, precision, F1‐Score, receiver operating characteristics curves, and area under the curve. Additionally, 10‐fold cross‐validation shows no indication of overfitting in the created intrusion detection system model.

Overview and Exploratory Analyses of CICIDS2017 Intrusion Detection Dataset

Intrusion detection systems are used to detect attacks in a network.  Machine learning (ML) approaches have been widely used to build such Intrusion Detection Systems (IDSs) because they are more accurate when built from a very large and representative dataset. In recent times, one of the benchmark datasets that are used to build ML-based Intrusion Detection models is CICIDS2017 dataset. The dataset is contained in eight groups and was collected from the Canadian Institute on Cyber Security dataset repository.  The dataset is available in both PCAP and netflow formats. This study used the netflow records in the CIDIDS2017 dataset as they are found to contain newer attacks,very large and are found useful for traffic analysis. Exploratory Data Analysis (EDA) techniques were used to reveal various characteristics of the dataset. The general objective is to provide more insights on the nature, structure and issues with the dataset so as  to identify the best ways for using it to achieve improved ML-based IDS models. Furthermore, some of the open problems that can arise from the use of the dataset in any machine learning-based Intrusion Detection systems are highlighted and possible solutions are briefly discussed. The EDA techniques used revealed important relationships among input variables and the target class. The study concluded that the EDA can better influence the decision of future IDS researches that use the dataset. Thus, improved machine learning-based intrusion detection systems can be built from the dataset once it is well understood and pre-processed.

Overcoming the Challenges of Data Lack, Leakage, and Dimensionality in Intrusion Detection Systems: A Comprehensive Review

The Internet of Things (IoT) and cloud computing are rapidly gaining momentum as decentralized internet-based technologies and have led to an increase in information in nearly every technical and commercial industry. However, ensuring the security of IoT systems is a pressing issue due to the complexities involved in connected and shared environments. Networks are guarded by Intrusion Detection Systems (IDS) against various cyber threats such as malware, viruses, and unauthorized access. IDS have recently adopted Machine Learning (ML) and Deep Learning (DL) techniques to identify and classify security risks. However, the effective utilization of these technologies depends on the availability, quality, and characteristics of the data used to train models. Moreover, data lack, data leak, and dimensionality (DLLD) are common problems in data science and ML. This paper surveys existing research and suggests solutions for overcoming DLLD-related issues to improve IDS model.

Improving Network Security: An Intrusion Detection System (IDS) Dataset from Higher Learning Institutions, Mbeya University of Science and Technology (MUST), Tanzania

Nowadays, Internet-driven culture securing computer networks in Higher Learning Institutions (HLIs) has become a major responsibility. Intrusion Detection Systems (IDS) are crucial for protecting networks from unauthorized activity and cyber threats. This paper examines the process of improving network security by creating a comprehensive IDS dataset using real traffic from HLIs, highlighting the importance of accurate and representative data in improving the system's ability to identify and mitigate future cyber-attacks. The IDS model was created using a variety of machine learning (ML) techniques. Metrics like accuracy, precision, recall, and F1-score were used to assess the performance of each model. The dataset used for training and testing was real-world network traffic data obtained from the institution's computer network. The results showed that the developed IDS obtained exceptional accuracy rates, with Random Forest, Gradient Boosting, and XGBoost models all achieving an accuracy of around 93%. Precision and recall values were likewise quite high across all algorithms. Furthermore, the study discovered that data quality has a substantial impact on IDS performance. Proper data preparation, feature engineering, and noise removal were found to be helpful in improving model accuracy and reducing false positives. While the IDS models performed well throughout validation and testing, implementing such systems in a production setting necessitates careful thought. As a result, the essay also examined the procedures for testing and deploying the IDS models in a real-world scenario. It underlined the significance of ongoing monitoring and maintenance in order to keep the model effective in identifying intrusions. The research aids in the progress of network security in HLI. Educational institutions can better protect their precious assets and sensitive information from cyberattacks by understanding the impact of data quality on IDS performance and implementing effective deployment techniques

Two-Stage Intrusion Detection System in Intelligent Transportation Systems Using Rule Extraction Methods From Deep Neural Networks

In recent years, intrusion detection systems (IDSs) are offering effective solutions to protect various types of cyber-attacks in different networks such as Internet of Vehicles (IoVs) network in Intelligent Transportation Systems (ITS). Deep learning models have largely been leveraged by these intrusion detection systems to achieve better effectiveness results. However, deep learning models are black boxes, which limits their acceptability in decision systems. Also, they require powerful processing capabilities such as GPU, which limit their deployments in resource-constrained devices in IoV environment. To deal with these issues, we propose a two-stage IDS in ITS to discover suspicious network activity of In-Vehicles Networks (IVN) and vehicles to everything (V2X) networks. Our proposed IDS system uses rule extraction methods from deep learning models, i.e., deep neural networks in two stages. In the first stage, we analyze network traffic to distinguish between normal and attack traffic. If the traffic is found malicious, the second stage is invoked to identify the type of attack. To this end, we propose three variants of rule extraction. The first and the second variants are homogeneous, and they apply <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$DeepRed$</tex-math> </inline-formula> and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$HypInv$</tex-math> </inline-formula> rule extraction methods in both stages respectively. The third variant is heterogeneous, and it applies <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$HypInv$</tex-math> </inline-formula> in the first stage to perform binary classification, and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$DeepRed$</tex-math> </inline-formula> in the second stage to perform attack classification. The key idea is to combine the advantages of rule extraction technique and two-stage IDS architecture to resource consumption and improve classification accuracy. The proposed IDS model was tested using four benchmark datasets, i.e. ISCXIDS2012, CIC-IDS2017, and CSE-CIC-IDS2018 datasets are used for external network communications and the car hacking dataset are used for in-vehicle communications. The evaluation results show that the homogeneous <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$DeepRed$</tex-math> </inline-formula> is the optimal one in all cases of IDS system with an accuracy scores ranging between 92.43%-98.32% under CIC-IDS2017 dataset, between 91.32%-99.46% under CSE-CIC-IDS2018 dataset, and between 96.05%-99.21% under Car-hacking dataset.

Evaluated bird swarm optimization based on deep belief network (EBSO-DBN) classification technique for IOT network intrusion detection

Because of the recent development of various intrusion detection systems (IDS), which defend computer networks from security as well as privacy threats. The confidentiality, integrity and also availability of data may be compromised in the case that IDS prevention efforts fail. The amount of private, delicate and crucial data travelling over the worldwide network has expanded tremendously as a result of the recent development of Internet of Things (IoT) devices. Developing a better edge-based feature selection strategy, a deep learning technique for identifying and blocking malicious traffic, is the goal of intrusion detection. The classification method Evaluated Bird Swarm Optimization based Deep Belief Network (EBSO-DBN) has shown to be the most successful in this study. A variation of performance criteria have been used to critically assess deep learning techniques for IDS (accuracy, precision, recall, f-1 score, false alarm rate and detection rate). To ascertain the optimal performance of IDS models, this study focuses on building an ensemble classifier utilizing the suggested EBSO-DBN classification algorithm with 98.7% of accuracy, 99.4% of precision and 98.8% of recall.

Convolutional neural network for intrusion detection using blockchain technology

Cyber-physical systems (CPS) are becoming increasingly ubiquitous, connecting the physical world with the cyber realm. This convergence has exposed CPS to a growing threat landscape, necessitating robust intrusion detection systems (IDS) to safeguard critical infrastructure. Deep learning (DL) has emerged as a powerful tool for IDS, and convolutional neural networks (CNNs) have demonstrated exceptional performance in this domain. However, traditional IDS models are susceptible to data tampering and manipulation, compromising their integrity and effectiveness. Blockchain technology, with its inherent immutability and tamper-proof nature, offers a promising solution to enhance the security and reliability of IDS models. In this study, we propose a CNN-based IDS model that leverages blockchain technology to secure network traffic data. Our hypothesis is that integrating blockchain with CNNs can significantly improve the security and robustness of IDS models against data tampering and manipulation. To test our hypothesis, we employ a greedy-based genetic algorithm to select the most relevant features from network traffic data, followed by training a CNN model using the selected features. Finally, we evaluate the trained CNN model on a real-world dataset, demonstrating its ability to accurately classify network traffic as normal or intrusive. The results of our evaluation reveal that the proposed CNN-based IDS model achieves a classification accuracy of 99.2%, surpassing traditional IDS models. Moreover, our model exhibits enhanced resilience against data tampering and manipulation, demonstrating the effectiveness of blockchain integration in safeguarding the integrity of IDS models. Our findings underscore the potential of blockchain-enhanced CNNs as a robust and secure solution for intrusion detection in CPS, ensuring the integrity and protection of critical infrastructure.

Sustainable and lightweight domain-based intrusion detection system for in-vehicle network

Intelligent transportation systems are designed to enhance and optimize the traffic flow, safety of urban mobility, and improve energy efficiency. While advanced vehicles are equipped with new features, such as communication technologies for the exchange of safety messages, the communication interfaces of the vehicles increase the attack surfaces for attackers to exploit, even into the in-vehicle network (IVN). The automotive Ethernet and intrusion detection systems (IDSs) are promising solutions to the security problem inside the IVN. The automotive Ethernet has higher bandwidth capacity at an economical cost and flexibility for expansion than the current solution. The IDSs can protect the IVN from attackers compromising the vehicle. They can be implemented based on machine learning to learn from the normal IVN traffic behavior. However, numerous IDSs that utilize machine learning face hardware limitations when training within the in-vehicle network. Thus, the models have to be trained outside the IVN and then imported into it. Moreover, the IVN messages are unlabeled whether they are normal or under attack. We propose a lightweight unsupervised IDS that enables training in the IVN with limited computation resources. Our IDS models have an impressive parameter reduction of up to 94% compared to existing models. This leads to a remarkable reduction in memory usage of up to 86%, training time slashed by up to 69%, and a remarkable drop in energy consumption by up to 68%. Despite the size reduction, the proposed models remain only slightly less accurate than current solutions by up to 2%.