Intrusion Detection Systems Solutions Research Articles

An Efficient Network Intrusion Detection and Classification System using Machine Learning

In today's digital landscape, network security is of paramount importance, with intrusion detection systems (IDS) playing a crucial role in protecting sensitive data from malicious attacks. Traditional IDS, often reliant on signature-based methods, struggle with high false positive rates, difficulty in adapting to novel threats, and significant computational demands. This paper explores the development of an efficient network intrusion detection and classification system utilizing machine learning techniques to address these challenges. By leveraging datasets such as NSL-KDD and UNSW-NB15, our study employs a combination of supervised learning algorithms, including Support Vector Machines (SVM), Random Forests, and Neural Networks, alongside comprehensive data preprocessing and feature engineering strategies. The evaluation of our models through metrics like accuracy, precision, recall, and ROC-AUC demonstrates a marked improvement in detection capabilities and computational efficiency. Our findings suggest that machine learning-based IDS can significantly enhance network security by reducing false positives and adapting to emerging threats more effectively than traditional systems. This research not only underscores the potential of advanced machine learning techniques in IDS but also provides a robust framework for future developments in the field. In the rapidly evolving landscape of cybersecurity, effective network intrusion detection and classification systems are critical for safeguarding sensitive data and maintaining operational integrity. This paper presents a novel approach utilizing machine learning techniques to enhance the efficiency and accuracy of intrusion detection systems (IDS). By employing a combination of supervised and unsupervised learning algorithms, our system can identify and classify both known and unknown threats in real-time. We leverage advanced feature selection methods to optimize the performance of our models, ensuring high detection rates with minimal false positives. Our experimental results, validated on benchmark datasets, demonstrate significant improvements in detection accuracy and processing speed compared to traditional IDS solutions. The proposed system not only strengthens network defenses but also provides a scalable and adaptive framework for future cybersecurity challenges..

An Improved Design for a Cloud Intrusion Detection System Using Hybrid Features Selection Approach with ML Classifier

The rapid adoption of cloud computing has introduced new security concerns, particularly regarding data privacy and protection from sophisticated cyberattacks. Intrusion Detection Systems (IDSs) based on Machine Learning (ML) offer improved detection of malicious behaviour in network traffic. However, existing IDS solutions struggle with large-dimensional data and imbalanced datasets, resulting in higher false positive rates (FPR) and reduced detection rates (DR). In this paper, we propose an improved Cloud IDS leveraging a hybrid features selection approach using Information Gain (IG), Chi-square (CS), and Particle Swarm Optimization (PSO). To address the challenge of imbalanced datasets, the Synthetic Minority Over-sampling Technique (SMOTE) is employed. The Random Forest (RF) classifier is used to detect and classify attacks. The system is evaluated on the UNSW-NB15 and Kyoto datasets, achieving accuracies of over 98% and 99%, respectively, outperforming other methods in terms of detection accuracy.

Evolving Adversarial Training (EAT) for AI-Powered Intrusion Detection Systems (IDS)

Intrusion Detection Systems (IDS) are crucial components of network security, yet traditional IDS models often fail to cope with rapidly evolving adversarial attacks that exploit their static nature. This study proposes a novel approach, Evolving Adversarial Training (EAT), to enhance the adaptability and robustness of AI-powered IDS against dynamic threats. The EAT framework integrates continuous model evolution with advanced adversarial training techniques, enabling the IDS to dynamically adjust to new attack patterns. Experimental results demonstrate that the EAT framework significantly enhances IDS performance, leading to increased detection accuracy and reduced false positive rates compared to conventional methods. These findings emphasize the potential of EAT in fortifying network defenses against evolving cyber threats, offering a promising avenue for future research in scalable and adaptive IDS solutions that can effectively combat the complexities of modern cyber adversaries. The research explores three key objectives: dynamic adaptation and adversarial training, continuous learning and enhanced threat detection, and robustness and generalization. By focusing on these objectives, the study aims to develop AI-powered IDS that can effectively navigate the ever-changing cyber threat landscape. The research methodology includes data collection, model architecture design, training and evaluation, continuous learning, simulation, and real-world testing, all aimed at enhancing the resilience of AI-powered IDS against adversarial attacks. By systematically following this framework, the study intends to enhance the security system of IDS through the effective implementation of EAT.

A comprehensive survey on deep learning‐based intrusion detection systems in Internet of Things (IoT)

AbstractThe proliferating popularity of Internet of Things (IoT) devices has led to wide‐scale networked system implementations across multiple disciplines, including transportation, medicine, smart homes, and many others. This unprecedented level of interconnectivity has introduced new security vulnerabilities and threats. Ensuring security in these IoT settings is crucial for protecting against malicious activities and safeguarding data. Real‐time identification and response to potential intrusions and attacks are essential, and intrusion detection systems (IDS) are pivotal in this process. However, the dynamic and diverse nature of the IoT environment presents significant challenges to existing IDS solutions, which are often based on rule‐based or statistical approaches. Deep learning, a subset of artificial intelligence, has shown great potential to enhance IDS in IoT. Deep learning models can identify complex patterns and characteristics by utilizing artificial neural networks, automatically building hierarchical representations from data. This capability results in more precise and efficient intrusion detection in IoT‐based systems. The primary aim of this survey is to present an extensive overview of the current research on deep learning and IDS in the IoT domain. By examining existing literature, discussing mainstream datasets, and highlighting current challenges and potential prospects, this survey provides valuable insights into the prevailing scenario and future directions for using deep learning in IDS for IoT. The findings from this research aim to enhance intrusion detection techniques in IoT environments and promote the development of more effective antimalware solutions against cyber threats targeting IoT device systems.

An innovative model for an enhanced dual intrusion detection system using LZ‐JC‐DBSCAN, EPRC‐RPOA and EG‐GELU‐GRU

AbstractThe rise of suspicious activities in network communication, driven by increased internet accessibility, necessitates the development of advanced intrusion detection systems (IDS). Existing IDS solutions often exhibit poor performance in detecting suspicious activity and fail to identify various attack types within packet capture (PCAP) files, which monitor network traffic. This paper proposes a deep learning‐based dual IDS model designed to address these issues. The process begins with utilizing the CSE‐CIC‐IDS2019 dataset to extract features from PCAP files. Suspicious activities are detected using the Exponential Geometric‐Gaussian Error Linear Units‐Gated Recurrent Unit (EG‐GELU‐GRU) method. Normal data undergoes further feature extraction and preprocessing through Log ZScore‐Jacosine Density‐Based Spatial Clustering of Applications with Noise (LZ‐JC‐DBSCAN). Feature selection is optimized using the Entropy Pearson R Correlation‐Red Panda optimization algorithm. Suspicious files are flagged, while load balancing is performed on normal data. Attack detection is achieved through word embedding with the Glorot Kaufman‐bidirectional encoder representations from transformers technique and classification via the EG‐GELU‐GRU model. Attacked packets are blocked, and the method is reapplied for attack‐type classification. Experimental results using Python demonstrate the model’s superior performance, achieving 98.18% accuracy and 98.73% precision, surpassing existing approaches and significantly enhancing intrusion detection capabilities.

Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems

Intrusion Detection Systems (IDS) have become pivotal in safeguarding information systems against evolving threats. Concurrently, Concept Drift presents a significant challenge in machine learning, affecting the adaptability and accuracy of predictive models in dynamic environments. Understanding the synergy between IDS and Concept Drift is crucial for developing robust security systems. The motivation behind this survey is driven by the emerging complexities in cyber threats and the dynamic nature of data streams, which necessitate advanced IDS capable of adapting to Concept and Feature Drift. Our analysis reveals a glaring omission in the existing literature—the integration of Concept Drift and Feature Drift within IDS. Most studies have focused on Concept Drift in a general context or on IDS but have yet to comprehensively consider the implications of data dynamics. This oversight has led to a fragmented understanding and suboptimal approaches to tackling modern cyber threats. To address this, we propose a comprehensive review that delves into the role of machine learning in IDS, explicitly focusing on Concept and Feature Drift. We have proposed a framework that includes all the necessary components for a drift-aware IDS. The framework incorporates dynamic feature selection, adaptive learning algorithms, and continuous monitoring techniques to handle Concept Drift and Feature Drift effectively. The survey highlights state-of-the-art methodologies and current challenges in integrating these concepts. The methodology involves an exhaustive analysis of published works from 2019 to 2024, comparing and contrasting various models and approaches. This includes a detailed examination of Concept Drift-aware IDS methods, dynamic feature selection techniques, and the impact of high dimensionality in IDS. These quantitative improvements underscore the necessity for developing adaptive and resilient IDS. The survey uncovers under-represented areas in current research, paving the way for future investigations. By highlighting these gaps and providing comparative data, the survey sets a clear direction for upcoming research efforts to foster the development of more dynamic and adaptable IDS solutions. The quantitative experimental evaluation of the proposed framework is planned to be conducted in a future article, where we will assess its effectiveness and performance in real-world scenarios.

Enhanced collaborative intrusion detection for industrial cyber-physical systems using permissioned blockchain and decentralized federated learning networks

In the digital economy, the security of Cyber-Physical Systems (CPSs) is paramount. Despite the deployment of various Intrusion Detection Systems (IDSs) in industrial CPSs, the primary obstacles to the advanced research include class imbalance, privacy gap, model homogenization, and arbitrary aggregation. Thus, in this paper, a Permissioned Blockchain-enabled decentralized federated distillation Generative Adversarial Network (GAN), namely PB-fdGAN, is proposed for Collaborative IDSs (CIDSs) in industrial CPSs. The novel Local Differential Privacy (LDP)-external classifier GAN (ecGAN) addresses class imbalance and privacy concerns by integrating label conditions into the latent space and using Wasserstein distance for stability in semi-supervised learning. Additionally, a Decentralized Federated Distillation (DFD) scheme allows for collaborative model building without data exchange, enhancing privacy and diversity. Moreover, a Quality of Service (QoS)-consortium blockchain framework with a new QoS evaluation strategy ensures reliable and effective model aggregation. The experimental evaluation demonstrates the high effectiveness of PB-fdGAN in detecting various types of cyber threats and the superiorities over state-of-the-art IDS solutions.

Network intrusion detection system for IoT security using machine learning and statistical based hybrid feature selection

AbstractThe widespread adoption of Internet of Things (IoT) devices has revolutionized daily life, offering convenience and efficiency. However, this growth has also brought new security challenges. With the escalating use of Internet and network technology, the number of cyber‐attacks has increased, intensifying the focus on Intrusion Detection Systems (IDS) among researchers. Network intrusion detection (NID) plays a crucial role in securing IoT networks, becoming essential for modern security infrastructure. Recently, machine learning algorithms have shown promise in providing IDS solutions. Yet, IoT IDS systems face challenges due to their functional and physical diversity, making comprehensive feature utilization impractical. Therefore, effective feature selection becomes imperative. In this research, a novel feature selection methodology for anomaly‐based NIDS is proposed. The methodology commences by employing two filter‐based techniques, namely 1‐way ANOVA and the Pearson correlation coefficient, to meticulously identify and extract pertinent features from the dataset. These methods serve as initial filters to discern the most relevant attributes, ensuring that only the most informative features are retained for subsequent analysis. Subsequently, the most optimal features identified by both methodologies are extracted utilizing the principles of union and intersection in mathematical set theory. Using the NSL‐KDD and UNSW‐NB15 datasets, we exemplify how our model can outperform conventional ML classifiers in terms of detection rate, precision, recall. In our study, intrusion detection is carried out by SVM, kNN, Decision Tree, Logistic Regression and Random Forest using trained attack patterns. The demonstrated results highlight the exceptional performance of the proposed system, with an impressive accuracy rate of 99.6% on the NSL‐KDD dataset and a substantial 97.7% on the UNSW‐NB15 dataset, clearly surpassing the performance of contemporary methods.

Statistical Implementation for SD-RNN Model for Multi-Class Classification for Network Intrusion Detection System

With the increasing popularity of technologies that depend on computer networks, providing security is of paramount importance. Consequently, intrusion detection systems (IDS) play a vital role in monitoring these networks. An essential element in securing the network of an organization is the Intrusion Detection System (IDS), which serves as the primary barrier against cyber threats and is tasked with thwarting illegal entry into the network. Flow-based network traffic analysis is commonly used in IDS solutions to identify security concerns. In recent years, several innovative strategies have been proposed and implemented to address the issue of network security, with a specific focus on Intrusion Detection Systems (IDSs). The creation of intrusion detection systems using AI methods is a modern method for finding breaches in a network. Since there are many possible approaches, it is important to have a standardized method that facilitates good judgement when classifying intrusions. This paper presents a novel approach utilizing deep learning and machine learning modelling to develop a model for multi-class classification. The principal objective is to create IDS that can effectively detect anomalies using flow-based analysis. The latest CICIDS2017 dataset is used in experimentation for testing and training. The experiments performed with a deep learning model for IDS produced promising results, achieving a 99.77% accuracy rate for multi-class classification while employing the specific dataset.

Boosting Network Security: A comparative Analysis of Deep Learning Techniques for Intrusion Detection

This paper addresses demanding situations in Intrusion Detection Systems (IDS) by way of combining the Adaptive Synthetic Sampling (ADASYN) method with a break up-primarily based Resnet framework. ADASYN balances sample distribution, overcoming biases in the direction of large samples. Our method extracts multiscale functions, reduces interchannel redundancy, and enhances the version's capability using a smooth hobby operation. We recommend a Residual Neural Network (ResNN) version for intrusion detection, displaying massive enhancements in recognition accuracy and execution performance. Ongoing work targets to optimize performance further, highlighting the capacity for extra strong IDS solutions.

A Novel IDS with a Dynamic Access Control Algorithm to Detect and Defend Intrusion at IoT Nodes.

The Internet of Things (IoT) is the underlying technology that has enabled connecting daily apparatus to the Internet and enjoying the facilities of smart services. IoT marketing is experiencing an impressive 16.7% growth rate and is a nearly USD 300.3 billion market. These eye-catching figures have made it an attractive playground for cybercriminals. IoT devices are built using resource-constrained architecture to offer compact sizes and competitive prices. As a result, integrating sophisticated cybersecurity features is beyond the scope of the computational capabilities of IoT. All of these have contributed to a surge in IoT intrusion. This paper presents an LSTM-based Intrusion Detection System (IDS) with a Dynamic Access Control (DAC) algorithm that not only detects but also defends against intrusion. This novel approach has achieved an impressive 97.16% validation accuracy. Unlike most of the IDSs, the model of the proposed IDS has been selected and optimized through mathematical analysis. Additionally, it boasts the ability to identify a wider range of threats (14 to be exact) compared to other IDS solutions, translating to enhanced security. Furthermore, it has been fine-tuned to strike a balance between accurately flagging threats and minimizing false alarms. Its impressive performance metrics (precision, recall, and F1 score all hovering around 97%) showcase the potential of this innovative IDS to elevate IoT security. The proposed IDS boasts an impressive detection rate, exceeding 98%. This high accuracy instills confidence in its reliability. Furthermore, its lightning-fast response time, averaging under 1.2 s, positions it among the fastest intrusion detection systems available.

Improving Intrusion Detection using Satin Bowerbird Optimization with Deep Learning Model for IIoT Environment

Intrusion Detection in the Industrial Internet of Things (IIoT) concentrations on the security and safety of critical structures and industrial developments. IIoT extends IoT principles to industrial environments, but linked sensors and devices can be deployed for monitoring, automation, and control of manufacturing, energy, and other critical systems. Intrusion detection systems (IDS) in IoT drive to monitor network traffic, device behavior, and system anomalies for detecting and responding to security breaches. These IDS solutions exploit a range of systems comprising signature-based detection, anomaly detection, machine learning (ML), and behavioral analysis, for identifying suspicious actions like device tampering, unauthorized access, data exfiltration, and denial-of-service (DoS) attacks. This study presents an Improving Intrusion Detection using Satin Bowerbird Optimization with Deep Learning (IID-SBODL) model for IIoT Environment. The IID-SBODL technique initially preprocesses the input data for compatibility. Next, the IID-SBODL technique applies Echo State Network (ESN) model for effectual recognition and classification of the intrusions. Finally, the SBO algorithm optimizes the configuration of the ESN, boosting its capability for precise identification of anomalies and significant security breaches within IIoT networks. By widespread simulation evaluation, the experimental results pointed out that the IID-SBODL technique reaches maximum detection rate and improves the security of the IIoT environment. Through comprehensive experimentation on both UNSW-NB15 and UCI SECOM datasets, the model exhibited exceptional performance, achieving an average accuracy of 99.55% and 98.87%, precision of 98.90% and 98.93%, recall of 98.87% and 98.80%, and F-score of 98.88% and 98.87% for the respective datasets. The IID-SBODL model contributes to the development of robust intrusion detection mechanisms for safeguarding critical industrial processes in the era of interconnected and smart IIoT environments.

Securing Mobile Edge Computing Using Hybrid Deep Learning Method

In recent years, Mobile Edge Computing (MEC) has revolutionized the landscape of the telecommunication industry by offering low-latency, high-bandwidth, and real-time processing. With this advancement comes a broad range of security challenges, the most prominent of which is Distributed Denial of Service (DDoS) attacks, which threaten the availability and performance of MEC’s services. In most cases, Intrusion Detection Systems (IDSs), a security tool that monitors networks and systems for suspicious activity and notify administrators in real time of potential cyber threats, have relied on shallow Machine Learning (ML) models that are limited in their abilities to identify and mitigate DDoS attacks. This article highlights the drawbacks of current IDS solutions, primarily their reliance on shallow ML techniques, and proposes a novel hybrid Autoencoder–Multi-Layer Perceptron (AE–MLP) model for intrusion detection as a solution against DDoS attacks in the MEC environment. The proposed hybrid AE–MLP model leverages autoencoders’ feature extraction capabilities to capture intricate patterns and anomalies within network traffic data. This extracted knowledge is then fed into a Multi-Layer Perceptron (MLP) network, enabling deep learning techniques to further analyze and classify potential threats. By integrating both AE and MLP, the hybrid model achieves higher accuracy and robustness in identifying DDoS attacks while minimizing false positives. As a result of extensive experiments using the recently released NF-UQ-NIDS-V2 dataset, which contains a wide range of DDoS attacks, our results demonstrate that the proposed hybrid AE–MLP model achieves a high accuracy of 99.98%. Based on the results, the hybrid approach performs better than several similar techniques.

ANALYZING THE CAN PROTOCOL: VULNERABILITIES, PROTECTIVE MEASURES AND IMPROVEMENTS

The Controller Area Network (CAN) bus, originally designed for internal communication among a limited number of Electronic Control Units (ECUs) within vehicles, faces significant security challenges due to the rapid expansion of ECUs in modern automobiles. This expansion necessitates accessibility for diagnostic purposes, yet the CAN protocol lacks fundamental security features such as encryption, authentication, and integrity checks, rendering it vulnerable to various attacks including message injection, Denial of Service (DoS), and masquerading ECUs. This paper surveys existing literature and investigates potential intrusions on the CAN bus, highlighting attacks ranging from GPS spoofing to remote sensor tampering. Various solutions are discussed, including network subdivision, encryption, authentication techniques, and intrusion detection systems (IDS). Recent research proposes IDS solutions utilizing machine learning algorithms such as Random Forest, Support Vector Machine, and Deep Neural Networks (DNN), demonstrating effectiveness in detecting known attacks. However, challenges persist in identifying unknown attacks and enhancing overall system performance. Innovative approaches, such as event-triggered detection and bloom filtering techniques, show promise in mitigating specific attack vectors but may introduce overhead or limitations in real-time response. Deep learning-based IDS systems exhibit high performance but struggle with the detection of novel attacks. Furthermore, while some solutions address specific vulnerabilities, others propose more comprehensive security measures, such as preventing remote manipulation of critical vehicle functions like steering and braking. Overall, the research emphasizes the critical need for robust security measures in automotive systems to safeguard against evolving threats to vehicle safety and integrity.

DTL-IDS: An optimized Intrusion Detection Framework using Deep Transfer Learning and Genetic Algorithm

In the dynamic field of the Industrial Internet of Things (IIoT), the networks are increasingly vulnerable to a diverse range of cyberattacks. This vulnerability necessitates the development of advanced intrusion detection systems (IDSs). Addressing this need, our research contributes to the existing cybersecurity literature by introducing an optimized Intrusion Detection System based on Deep Transfer Learning (DTL), specifically tailored for heterogeneous IIoT networks. Our framework employs a tri-layer architectural approach that synergistically integrates Convolutional Neural Networks (CNNs), Genetic Algorithms (GA), and bootstrap aggregation ensemble techniques. The methodology is executed in three critical stages: First, we convert a state-of-the-art cybersecurity dataset, Edge_IIoTset, into image data, thereby facilitating CNN-based analytics. Second, GA is utilized to fine-tune the hyperparameters of each base learning model, enhancing the model’s adaptability and performance. Finally, the outputs of the top-performing models are amalgamated using ensemble techniques, bolstering the robustness of the IDS. Through rigorous evaluation protocols, our framework demonstrated exceptional performance, reliably achieving a 100% attack detection accuracy rate. This result establishes our framework as highly effective against 14 distinct types of cyberattacks. The findings bear significant implications for the ongoing development of secure, efficient, and adaptive IDS solutions in the complex landscape of IIoT networks.

Enhancing Privacy-Preserving Intrusion Detection through Federated Learning

Detecting anomalies, intrusions, and security threats in the network (including Internet of Things) traffic necessitates the processing of large volumes of sensitive data, which raises concerns about privacy and security. Federated learning, a distributed machine learning approach, enables multiple parties to collaboratively train a shared model while preserving data decentralization and privacy. In a federated learning environment, instead of training and evaluating the model on a single machine, each client learns a local model with the same structure but is trained on different local datasets. These local models are then communicated to an aggregation server that employs federated averaging to aggregate them and produce an optimized global model. This approach offers significant benefits for developing efficient and effective intrusion detection system (IDS) solutions. In this research, we investigated the effectiveness of federated learning for IDSs and compared it with that of traditional deep learning models. Our findings demonstrate that federated learning, by utilizing random client selection, achieved higher accuracy and lower loss compared to deep learning, particularly in scenarios emphasizing data privacy and security. Our experiments highlight the capability of federated learning to create global models without sharing sensitive data, thereby mitigating the risks associated with data breaches or leakage. The results suggest that federated averaging in federated learning has the potential to revolutionize the development of IDS solutions, thus making them more secure, efficient, and effective.

PIGNUS: A Deep Learning model for IDS in industrial internet-of-things

The heterogeneous nature of the Industrial Internet of Thing (IIoT) has a considerable impact on the development of an effective Intrusion Detection System (IDS). The proliferation of linked devices results in multiple inputs from industrial sensors. IDS faces challenges in analyzing the features of the traffic and identifying anonymous behavior. Due to the unavailability of a comprehensive feature mapping method, the present IDS solutions are non-usable to identify zero-day vulnerabilities.In this paper, we introduce the first comprehensive IDS framework that combines an efficient feature-mapping technique and cascading model to solve the above-mentioned problems. We call our proposed solution deeP learnIG model intrusioN detection in indUStrial internet-of things (PIGNUS). PIGNUS integrates Auto Encoders (AE) to select optimal features and Cascade Forward Back Propagation Neural Network (CFBPNN) for classification and attack detection. The cascading model uses interconnected links from the initial layer to the output layer and determines the normal and abnormal behavior patterns and produces a perfect classification. We execute a set of experiments on five popular IIoT datasets: gas pipeline, water storage tank, NSLKDD+, UNSW-NB15, and X-IIoTID. We compare PIGNUS to the state-of-the-art models in terms of accuracy, False Positive Ratio (FPR), precision, and recall. The results show that PIGNUS provides more than 95% accuracy, which is 25% better on average than the existing models. In the other parameters, PIGNUS shows 20% improved FPR, 10% better recall, and 10% better in precision. Overall, PIGNUS proves its efficiency as an IDS solution for IIoTs. Thus, PIGNUS is an efficient solution for IIoTs.

Customised Intrusion Detection for an Industrial IoT Heterogeneous Network Based on Machine Learning Algorithms Called FTL-CID

Technological breakthroughs in the Internet of Things (IoT) easily promote smart lives for humans by connecting everything through the Internet. The de facto standardised IoT routing strategy is the routing protocol for low-power and lossy networks (RPL), which is applied in various heterogeneous IoT applications. Hence, the increase in reliance on the IoT requires focus on the security of the RPL protocol. The top defence layer is an intrusion detection system (IDS), and the heterogeneous characteristics of the IoT and variety of novel intrusions make the design of the RPL IDS significantly complex. Most existing IDS solutions are unified models and cannot detect novel RPL intrusions. Therefore, the RPL requires a customised global attack knowledge-based IDS model to identify both existing and novel intrusions in order to enhance its security. Federated transfer learning (FTL) is a trending topic that paves the way to designing a customised RPL-IoT IDS security model in a heterogeneous IoT environment. In this paper, we propose a federated-transfer-learning-assisted customised distributed IDS (FT-CID) model to detect RPL intrusion in a heterogeneous IoT. The design process of FT-CID includes three steps: dataset collection, FTL-assisted edge IDS learning, and intrusion detection. Initially, the central server initialises the FT-CID with a predefined learning model and observes the unique features of different RPL-IoTs to construct a local model. The experimental model generates an RPL-IIoT dataset with normal and abnormal traffic through simulation on the Contiki-NG OS. Secondly, the edge IDSs are trained using the local parameters and the globally shared parameters generated by the central server through federation and aggregation of different local parameters of various edges. Hence, transfer learning is exploited to update the server's and edges' local and global parameters based on relational knowledge. It also builds and customised IDS model with partial retraining through local learning based on globally shared server knowledge. Finally, the customised IDS in the FT-CID model enforces the detection of intrusions in heterogeneous IoT networks. Moreover, the FT-CID model accomplishes high RPL security by implicitly utilising the local and global parameters of different IoTs with the assistance of FTL. The FT-CID detects RPL intrusions with an accuracy of 85.52% in tests on a heterogeneous IoT network.

Exponential Squirrel Search Algorithm-Based Deep Classifier for Intrusion Detection in Cloud Computing with Big Data Assisted Spark Framework

Intrusion detection systems (IDS) are extensively employed for detecting suspicious behaviors in hosts. The ability of distributed IDS solutions makes it viable to combine and handle various kinds of sensors and generate alerts to different hosts positioned in distributed platforms. However, to offer secure and feasible services in a cloud platform is an imperative issue due to the impacts of attacks. This paper devises a novel IDS framework using cloud data to counter the influence of attacks. Here, the spark architecture is employed for discovering the intrusions. The pre-processing is applied to the input data for removing artifacts and noise considering input data. Thereafter, the feature extraction and feature fusion are performed in slave nodes. The feature fusion is carried out with the proposed Exponential Squirrel Search Algorithm (ExpSSA) algorithm. The fused features are considered in a deep-stacked autoencoder (Deep SAE) for performing effective intrusion detection. The proposed ExpSSA is adapted to train Deep SAE for tuning optimum weights. The exponential weighted moving average (EWMA) and squirrel search algorithm (SSA) are combined to create the proposed ExpSSA. The proposed ExpSSA-based Deep SAE offered improved performance compared to other techniques with the highest accuracy, detection rate of 0.846, and minimal FPR.

A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning

The rapid growth of the Internet and communications has resulted in a huge increase in transmitted data. These data are coveted by attackers and they continuously create novel attacks to steal or corrupt these data. The growth of these attacks is an issue for the security of our systems and represents one of the biggest challenges for intrusion detection. An intrusion detection system (IDS) is a tool that helps to detect intrusions by inspecting the network traffic. Although many researchers have studied and created new IDS solutions, IDS still needs improving in order to have good detection accuracy while reducing false alarm rates. In addition, many IDS struggle to detect zero-day attacks. Recently, machine learning algorithms have become popular with researchers to detect network intrusion in an efficient manner and with high accuracy. This paper presents the concept of IDS and provides a taxonomy of machine learning methods. The main metrics used to assess an IDS are presented and a review of recent IDS using machine learning is provided where the strengths and weaknesses of each solution is outlined. Then, details of the different datasets used in the studies are provided and the accuracy of the results from the reviewed work is discussed. Finally, observations, research challenges and future trends are discussed.