Performance Of Intrusion Detection System Research Articles

Few-Shot network intrusion detection based on prototypical capsule network with attention mechanism.

Network intrusion detection plays a crucial role in ensuring network security by distinguishing malicious attacks from normal network traffic. However, imbalanced data affects the performance of intrusion detection system. This paper utilizes few-shot learning to solve the data imbalance problem caused by insufficient samples in network intrusion detection, and proposes a few-shot intrusion detection method based on prototypical capsule network with the attention mechanism. Our method is mainly divided into two parts, a temporal-spatial feature fusion method using capsules for feature extraction and a prototypical network classification method with attention and vote mechanisms. The experimental results demonstrate that our proposed model outperforms state-of-the-art methods on imbalanced datasets.

A novel hybrid autoencoder and modified particle swarm optimization feature selection for intrusion detection in the internet of things network

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

ENHANCING INTRUSION DETECTION SYSTEM ON NODEMCU WITH ENSEMBLE VOTING

As part of the Internet, a NodeMCU becomes a vulnerability to cyber-attack, so the intrusion detection system (IDS) against cyber-attack on the NodeMCU becomes a poignant research challenge. Several studies have applied several machine learning techniques for IDS on NodeMCU; however, there is a research opportunity to improve the performance of existing models. This research aims to increase the IDS performance on NodeMCU with ensemble voting. We hypothesize the realization of how the implementation of an IDS in NodeMCU. Then we obtain and observe a dataset from Kaggle. The dataset comprises five attacks: misconfiguration, DDoS, probe, scanning, and MiTM. Then we design the detection with ensemble voting consisting of a decision tree and a random forest. We benchmark our proposed solution with decision trees and random forest performance. This study uses several test metrics, including , , , and .The test results show that the decision tree has better Precision in predicting misconfiguration attacks and scan attacks than random forests. On the other hand, the random forest has better in predicting normal data, DDoS attacks, probe attacks, and MiTM attacks. In terms of , ensemble voting has the best performance, which is , compared to the decision tree and random forest, which are and , respectively. We conclude that by assembling a decision tree in the random forest with ensemble voting, random forest performance can improve.

Development of a Machine-Learning Intrusion Detection System and Testing of Its Performance Using a Generative Adversarial Network.

Intrusion detection and prevention are two of the most important issues to solve in network security infrastructure. Intrusion detection systems (IDSs) protect networks by using patterns to detect malicious traffic. As attackers have tried to dissimulate traffic in order to evade the rules applied, several machine learning-based IDSs have been developed. In this study, we focused on one such model involving several algorithms and used the NSL-KDD dataset as a benchmark to train and evaluate its performance. We demonstrate a way to create adversarial instances of network traffic that can be used to evade detection by a machine learning-based IDS. Moreover, this traffic can be used for training in order to improve performance in the case of new attacks. Thus, a generative adversarial network (GAN)-i.e., an architecture based on a deep-learning algorithm capable of creating generative models-was implemented. Furthermore, we tested the IDS performance using the generated adversarial traffic. The results showed that, even in the case of the GAN-generated traffic (which could successfully evade IDS detection), by using the adversarial traffic in the testing process, we could improve the machine learning-based IDS performance.

Optimization of predictive performance of intrusion detection system using hybrid ensemble model for secure systems.

Network intrusion is one of the main threats to organizational networks and systems. Its timely detection is a profound challenge for the security of networks and systems. The situation is even more challenging for small and medium enterprises (SMEs) of developing countries where limited resources and investment in deploying foreign security controls and development of indigenous security solutions are big hurdles. A robust, yet cost-effective network intrusion detection system is required to secure traditional and Internet of Things (IoT) networks to confront such escalating security challenges in SMEs. In the present research, a novel hybrid ensemble model using random forest-recursive feature elimination (RF-RFE) method is proposed to increase the predictive performance of intrusion detection system (IDS). Compared to the deep learning paradigm, the proposed machine learning ensemble method could yield the state-of-the-art results with lower computational cost and less training time. The evaluation of the proposed ensemble machine leaning model shows 99%, 98.53% and 99.9% overall accuracy for NSL-KDD, UNSW-NB15 and CSE-CIC-IDS2018 datasets, respectively. The results show that the proposed ensemble method successfully optimizes the performance of intrusion detection systems. The outcome of the research is significant and contributes to the performance efficiency of intrusion detection systems and developing secure systems and applications.

Genetic-based Fuzzy IDS for Feature Set Reduction and Worm Hole Attack Detection

The wireless ad-hoc networks are decentralized networks with a dynamic topology that allows for end-to-end communications via multi-hop routing operations with several nodes collaborating themselves, when the destination and source nodes are not in range of coverage. Because of its wireless type, it has lot of security concerns than an infrastructure networks. Wormhole attacks are one of the most serious security vulnerabilities in the network layers. It is simple to launch, even if there is no prior network experience. Signatures are the sole thing that preventive measures rely on. Intrusion detection systems (IDS) and other reactive measures detect all types of threats. The majority of IDS employ features from various network layers. One issue is calculating a huge layered features set from an ad-hoc network. This research implements genetic algorithm (GA)-based feature reduction intrusion detection approaches to minimize the quantity of wireless feature sets required to identify worm hole attacks. For attack detection, the reduced feature set was put to a fuzzy logic system (FLS). The performance of proposed model was compared with principal component analysis (PCA) and statistical parametric mapping (SPM). Network performance analysis like delay, packet dropping ratio, normalized overhead, packet delivery ratio, average energy consumption, throughput, and control overhead are evaluated and the IDS performance parameters like detection ratio, accuracy, and false alarm rate are evaluated for validation of the proposed model. The proposed model achieves 95.5% in detection ratio with 96.8% accuracy and produces very less false alarm rate (FAR) of 14% when compared with existing techniques.

A Hierarchical Deep Learning-Based Intrusion Detection Architecture for Clustered Internet of Things

The Internet of Things (IoT) system’s ever-expanding attack surface calls for a new intrusion detection system (IDS). These systems may include thousands of wireless devices that need to be protected from cyberattacks. Recent research efforts used machine learning to analyze and identify various attacks and abnormal behavior on IoT systems. Most of these techniques are characterized by low accuracy and they do not scale to today’s IoT-enabled smart cities applications. This article proposes a secure automatic two-levels intrusion detection system (SATIDS) which utilizes the minimum redundancy maximum relevance (MRMR) feature selection technique and an enhanced version of long short-term memory (LSTM) based on an artificial recurrent neural network (RNN) to enhance the IDS performance. SATIDS aims at detecting traffic anomalies with greater accuracy while also reducing the time it takes to perform this task. The proposed algorithm was trained and evaluated using two of the most recent datasets based on realistic data: ToN-IoT and InSDN datasets. The performance analysis of the proposed system proves that it can differentiate between attacks and normal traffic, identify the attack category, and finally define the type of sub-attack with high accuracy. Comparing the performance of the proposed system with the existing IDSs reveals that it outperforms its best rivals from the literature in detecting many types of attacks. It improves accuracy, detection rates, F1-score, and precision. Using 500 hidden and two LSTM layers achieves accuracy of 97.5%, precision of 98.4%, detection rate of 97.9%, and F1-score of 98.05% on ToN-IoT dataset, and precision of 99%, detection rate of 99.6%, and F1-score of 99.3% on InSDN dataset. Finally, SATIDS was applied to an IoT network which utilizes the energy harvesting real-time routing protocol (EHRT). EHRT optimizes the low-energy adaptive clustering hierarchy (LEACH) routing technique using a modified artificial fish swarm algorithm. The integration between the optimized LEACH and the proposed IDS enhances the network lifetime, energy consumption, and security.

A Review on Intrusion Detection Using Machine Learning Techniques

An essential tool for monitoring and identifying intrusion threats is the intrusion detection system (IDS). As a result, intrusion detection systems monitor network traffic heading through computer systems to detect for malicious activity and recognized dangers, and send alerts. With a focus on datasets, ML methods, and metrics, this study tries to analyse recent IDS research using a Machine Learning (ML) approach. To make sure the model is suitable for IDS application, dataset selection is crucial. The efficiency of the ML method can also be impacted by the dataset structure. As a result, the choice of ML algorithm depends on the dataset's structure. Metric will then offer a quantitative assessment of ML algorithms for a given dataset. In addition True Positive Rate (TPR), False Positive Rate (FPR) and accuracy, are the three metrics for IDS performance evaluation that are most frequently utilized. This is understandable given that these metrics offer crucial cues that are crucial to IDS performance. A clear path and direction for future study has been provided by the discussion and comparison of the results from various works.

Evaluation of Efficient Classification Algorithm for Intrusion Detection System

Intrusion detection system is one of the most significant network security problems in the technology world. To improve the Intrusion Detection System (IDS) many machine learning methods are implemented. In order to develop the performance of IDS, different classification algorithms are applied to detect different types of attacks. For building efficient IDS is not an easy task and choosing a suitable classification algorithm. The best method is to test the Performance of the different classification algorithms and select best method from them. This paper aim is to assemble an IDS model in terms of confusion matrix, accuracy, recall, precision, f-score, specificity and sensitivity. It also provides a detailed comparison with the dataset, data preprocessing, number of features selected, feature selection technique, classification algorithms, and evaluation performance of algorithms described in the intrusion detection system.

An Intrusion Detection System for RPL-Based IoT Networks

The Internet of Things (IoT) has become very popular during the last decade by providing new solutions to modern industry and to entire societies. At the same time, the rise of the industrial Internet of Things (IIoT) has provided various benefits by linking infrastructure around the world via sensors, machine learning, and data analytics. However, the security of IoT devices has been proven to be a major concern. Almost a decade ago, the IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) was designed to handle routing in IoT and IIoT. Since then, numerous types of attacks on RPL have been published. In this paper, a novel intrusion detection system (IDS) is designed and implemented for RPL-based IoT. The objective is to perform an accurate and efficient detection of various types of routing and denial-of-service (DoS) attacks such as version number attack, blackhole attack, and grayhole attack, and different variations of flooding attacks such as Hello flood attack, DIS attack, and DAO insider attack. To achieve this, different detection strategies are combined, taking advantage of the strengths of each individual strategy. In addition, the proposed IDS is experimentally evaluated by performing a deep analysis of the aforementioned attacks in order to study the impact caused. This evaluation also estimates the accuracy and effectiveness of the IDS performance when confronted with the considered attacks. The obtained results show high detection accuracy. Furthermore, the overhead introduced in terms of CPU usage and power consumption is negligible. In particular, the CPU usage overhead is less than 2% in all cases, whereas the average power consumption increase is no more than 0.5%, which can be considered an insignificant impact on the overall resource utilisation.

A Novel Learning-Based Attack Detection System for Enhancing Security in Cyber-Physical Environments

An Intrusion Detection System (IDS) is an essential part of the network as it contributes towards securing the network against various vulnerabilities and threats. Over the past decades, there has been a comprehensive study in the field of IDS, and various approaches have been developed to design intrusion detection and classification system. With the proliferation in the usage of Deep Learning (DL) techniques and their ability to learn data extensively, we aim to design Deep Neural Network (DNN) based IDS. In this study, we aim to focus on enhancing the performance of DNN-based IDS in Cyber-Physical Systems (CPS). CPS combine physical processes, networking, and computation. The integration of CPS components could seriously jeopardise the security of CPS settings because of the physical limitations. The vulnerability of CPS to cyberattacks has grown with the development of IoT and other physical systems. As cyber-physical systems refer to the intersection of your organization’s technology and IT infrastructure and its physical assets, ensuring access and data security through advanced methods prevents any cyber-attack from damaging your physical assets and thereby disrupting your business flow. Conventional cyber and network security procedures fail to guarantee data privacy and security in CPS contexts. This research aims to provide a cutting-edge attack detection method based on learning for CPS environments. The paper suggests using MLP-based smart attack control systems to increase the CPSs' security. Performance analysis is presented in terms of different evaluation metrics such as accuracy, precision, recall, f-score, and False Positive Rate (FPR), and the results are compared with existing feature selection techniques. The effectiveness of the suggested model was confirmed by comparing the outcomes with those of other successful deep learning-based algorithms, including the Gaussian Naive Bayes algorithm, SVM, and logistic regression. Comparative results demonstrate that the suggested method outperforms existing learning models with an exceptional accuracy of 99.52%.

PSO-Driven Feature Selection and Hybrid Ensemble for Network Anomaly Detection

As a system capable of monitoring and evaluating illegitimate network access, an intrusion detection system (IDS) profoundly impacts information security research. Since machine learning techniques constitute the backbone of IDS, it has been challenging to develop an accurate detection mechanism. This study aims to enhance the detection performance of IDS by using a particle swarm optimization (PSO)-driven feature selection approach and hybrid ensemble. Specifically, the final feature subsets derived from different IDS datasets, i.e., NSL-KDD, UNSW-NB15, and CICIDS-2017, are trained using a hybrid ensemble, comprising two well-known ensemble learners, i.e., gradient boosting machine (GBM) and bootstrap aggregation (bagging). Instead of training GBM with individual ensemble learning, we train GBM on a subsample of each intrusion dataset and combine the final class prediction using majority voting. Our proposed scheme led to pivotal refinements over existing baselines, such as TSE-IDS, voting ensembles, weighted majority voting, and other individual ensemble-based IDS such as LightGBM.

Fusion of statistical importance for feature selection in Deep Neural Network-based Intrusion Detection System

Intrusion Detection System (IDS) is an essential part of network as it contributes towards securing the network against various vulnerabilities and threats. Over the past decades, there has been comprehensive study in the field of IDS and various approaches have been developed to design intrusion detection and classification system. With the proliferation in the usage of Deep Learning (DL) techniques and their ability to learn data extensively, we aim to design Deep Neural Network (DNN)-based IDS. In this study, we aim to focus on enhancing the performance of DNN-based IDS by proposing a novel feature selection technique that selects features via fusion of statistical importance using Standard Deviation and Difference of Mean and Median. Here, in the proposed approach, features are pruned based on their rank derived using fusion of statistical importance. Moreover, fusion of statistical importance aims to derive relevant features that possess high discernibility and deviation, that assists in better learning of data. The performance of the proposed approach is evaluated using three intrusion detection datasets, namely, NSL-KDD, UNSW_NB-15, and CIC-IDS-2017. Performance analysis is presented in terms of different evaluation metrics such as accuracy, precision, recall, f-score, and False Positive Rate (FPR) and the results are compared with existing feature selection techniques. Apart from evaluation metrics, performance comparison is also presented in terms of execution time. Moreover, results achieved are also statistically tested using Wilcoxon Signed Rank test.

Attribute Selection Based Genetic Network Programming for Intrusion Detection System

Intrusion detection, as a technology used to monitor abnormal behavior and maintain network security, has attracted many researchers’ attention in recent years. Thereinto, association rule mining is one of the mainstream methods to construct intrusion detection systems (IDS). However, the existing association rule algorithms face the challenges of high false positive rate and low detection rate. Meanwhile, too many rules might lead to the uncertainty increase that affects the performance of IDS. In order to tackle the above problems, a modified genetic network programming (GNP) is proposed for class association rule mining. Specifically, based on the property that node connections in the directed graph structure of GNP can be used to construct attribute associations, we propose to introduce information gain into GNP node selection. The most important attributes are thus selected, and the irrelevant attributes are removed before the rule is extracted. Moreover, not only the uncertainty among the class association rules is alleviated and also time consumption is reduced. The extracted rules can be applied to any classifier without affecting the detection performance. Experiment results based on NSL-KDD and KDDCup99 verify the performance of our proposed algorithm.

Enhancing Performance Using New Hybrid Intrusion Detection System

Intrusion Detection Systems (IDS) are an efficient defense against network attacks as well as host attacks as they allow network/host administrators to detect any policy violations. However, traditional IDS are vulnerable and unreliable for new malicious and genuine attacks. In other case, it is also inefficient to analyze large amount of data such as possibility logs. Furthermore, for typical OS, there are a lot of false positives and false negatives. There are some techniques to increase the quality and result of IDS where data mining is one of technique that is important to mining the information that useful from a large amount of data which noisy and random. The purpose of this study is to combine three technique of data mining to reduce overhead and to improve efficiency in intrusion detection system (IDS). The combination of clustering (Hierarchical) and two categories (C5, CHAID) is proposed in this study. The designed IDS is evaluated against the KDD'99 standard Data set (Knowledge Discovery and Data Mining), which is used to evaluate the efficacy of intrusion detection systems. The suggested system can detect intrusions and categorize them into four categories: probe, DoS, U2R (User to Root), and R2L (Remote to Local). The good performance of IDS in case of accuracy and efficiency was the result of this study.

Cyber Attack Detection Dataset: A Review

As cyber attack become more complicated, it becomes more difficult to identify breaches successfully. The inability to identify intrusions might jeopardize security services’ confidence, compromising data confidentiality, integrity, and availability. Cyber attacks like, Ping of Death, Botnets, also IP spoofing, as well as Social Engineering attacks, are becoming more common. A number of Intrusion Detection System (IDS) approaches developed to encounter cyber security intrusion. In order to discover attack patterns, the IDS performance was evaluated by employing dataset of IDS made up of network traffic properties. Intrusion detection is a classification problem in which different Artificial Intelligence techniques have been utilized to classify between legitimate also malicious network traffic. The multiple IDS datasets used to evaluate the IDS model are listed in this publication. These are new attack categories and recent datasets containing network attack features. This paper presents several IDS dataset with many existing evaluation techniques in model of IDS. Hopefully the outcome can be used in designing efficient and effective systems employing the benchmark and new IDS datasets.

Generating a benchmark cyber multi-step attacks dataset for intrusion detection

Nowadays, with the rapid increase in the number of applications and networks, the number of cyber multi-step attacks has been increasing exponentially. Thus, the need for a reliable and acceptable Intrusion Detection System (IDS) solution is becoming urgent to protect the networks and devices. However, implementing a robust IDS needs a reliable and up-to-date dataset in order to capture the behaviors of the new types of attacks especially a multi-step attack. In this paper, a new benchmark Multi-Step Cyber-Attack Dataset (MSCAD) is introduced. MSCAD includes two multi-step scenarios; the first scenario is a password cracking attack, and the second attack scenario is a volume-based Distributed Denial of Service (DDoS) attack. The MSCAD was assessed in two manners; firstly, the MSCAD was used to train IDS. Then, the performance of IDS was evaluated in terms of G-mean and Area Under Curve (AUC). Secondly, the MSCAD was compared with other free open-source and public datasets based on the latest keys criteria of a dataset evaluation framework. The results show that IDS-based MSCAD achieved the best performance with G-mean 0.83 and obtained good accuracy to detect the attacks. Besides, the MSCAD successfully passing twelve keys criteria.

Enhancing Performance Using New Hybrid Intrusion Detection System

Intrusion Detection Systems (IDS) are an efficient defense against network attacks as well as host attacks as they allow network/host administrators to detect any policy violations. However, traditional IDS are vulnerable and unreliable for new malicious and genuine attacks. In other case, it is also inefficient to analyze large amount of data such as possibility logs. Furthermore, for typical OS, there are a lot of false positives and false negatives. There are some techniques to increase the quality and result of IDS where data mining is one of technique that is important to mining the information that useful from a large amount of data which noisy and random. The purpose of this study is to combine three technique of data mining to reduce overhead and to improve efficiency in intrusion detection system (IDS). The combination of clustering (Hierarchical) and two categories (C5, CHAID) is proposed in this study. The designed IDS is evaluated against the KDD'99 standard Data set (Knowledge Discovery and Data Mining), which is used to evaluate the efficacy of intrusion detection systems. The suggested system can detect intrusions and categorize them into four categories: probe, DoS, U2R (User to Root), and R2L (Remote to Local). The good performance of IDS in case of accuracy and efficiency was the result of this study.

Analysis of Autoencoder Compression Performance in Intrusion Detection System

Exchanging data between devices is getting easier and faster just by using a network. Nevertheless, many factors threaten this process and the network itself. Implementing an Intrusion Detection System (IDS) may minimize the risk since it can identify and prevent attacks on the network. There are many methods to design an IDS to work optimally only by reducing data dimensions, one of which is by using the Autoencoder. However, its data dimensions may not have been optimal, which affects the IDS performance. In this study, we work on this problem. This study shows that one of the dimensional reduction methods can get optimal results. It indicates that it is implementable to secure the network.

Enhancing Performance Using New Hybrid Intrusion Detection System

Intrusion Detection Systems (IDS) are an efficient defense against network attacks as well as host attacks as they allow network/host administrators to detect any policy violations. However, traditional IDS are vulnerable and unreliable for new malicious and genuine attacks. In other case, it is also inefficient to analyze large amount of data such as possibility logs. Furthermore, for typical OS, there are a lot of false positives and false negatives. There are some techniques to increase the quality and result of IDS where data mining is one of technique that is important to mining the information that useful from a large amount of data which noisy and random. The purpose of this study is to combine three technique of data mining to reduce overhead and to improve efficiency in intrusion detection system (IDS). The combination of clustering (Hierarchical) and two categories (C5, CHAID) is proposed in this study. The designed IDS is evaluated against the KDD'99 standard Data set (Knowledge Discovery and Data Mining), which is used to evaluate the efficacy of intrusion detection systems. The suggested system can detect intrusions and categorize them into four categories: probe, DoS, U2R (User to Root), and R2L (Remote to Local). The good performance of IDS in case of accuracy and efficiency was the result of this study.