Intrusion Detection System Agents Research Articles

Securing smart home against sinkhole attack using weight‐based IDS placement strategy

AbstractExtensive use of the Internet of Things (IoT) in smart homes makes users' lives easy and comfortable. Yet, these resource‐constrained devices are prone to manifold security attacks. The sinkhole attack is one of the most destructive attacks that disrupt smart home operations, causing user dissatisfaction. Existing intrusion detection systems (IDS) cannot handle sinkhole attacks competently as they (i) do not consider the node capacity for being an IDS agent, leading to a low attack detection ratio, (ii) do not examine the sinkhole node's role when mitigating attacks, causing remaining network disconnection with the root node and (iii) do not consider replacing energy‐exhausted IDS nodes, causing connectivity loss of partial network with the root. This paper addresses these shortcomings and adequately presents a mechanism to handle sinkhole attacks. A formulation for assigning weights to network nodes based on their resources is proposed here. An IDS placement strategy is introduced to place IDS agents on particular resourceful nodes that extend network lifetime and enhance attack detection capability. We present a novel attack detection and mitigation strategy by ensuring network connectivity. The proposed mechanism achieves 95% attack detection accuracy and reduces false negative rates by 25% and energy consumption reasonably compared to the state‐of‐the‐art.

Secure routing with multi-watchdog construction using deep particle convolutional model for IoT based 5G wireless sensor networks

Fifth Generation (5G) security principles are widely expected with effective cryptography models, information security models, Machine Learning (ML) based Intrusion Detection systems (IDS) for Internet of Things (IoT) based Wireless Sensor Networks (WSN). However, the current security models are insufficient against the dynamic network nature of WSNs. On this scope, the proposed system develops Deep Convolutional Neural Network (DCNN) and Distributed Particle Filtering Evaluation Scheme (DPFES) for constructing a secure and cooperative multi-watchdog system. The proposed Deep Learning (DL) based dynamic multi-watchdog system protects each sensor node by monitoring the node transmission. In addition, the proposed work encompasses secure data-centric and node-centric evaluation procedures that are required for expanding the secure medium of 5G-based IoT-WSN networks. The DL-based network evaluation procedures drive the entire network to build a secure multi-watchdog system that enables on-demand active watchdog IDS agents among dense IoT-WSN. Notably, the proposed work contains a system dynamics model, cooperative watchdog model, Dual Line Minimum Connected Dominating Set (DL-MCDS), and DL-based event analysis procedures. Based on technical aspects, the proposed system is motivated to implement DPFES to analyze network events using particle filtering frameworks to build a secure 5G environment. The system is implemented and results are compared with related works. The performance of the proposed cooperative multi-watchdog system delivers 10% and 15% of better results than other techniques.

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

Deploying Intrusion Detection Systems (IDSs) is an essential way to enhance the security of Multi-hop Clustered Wireless Sensor Networks (MCWSNs). The conventional IDS deployment architectural designs show limitations in ensuring the security of MCWSNs due to the limited monitoring range of the nodes. This paper proposes an efficient IDS deployment architecture for MCWSNs. The architecture is a hybrid design, in which the cluster heads and the sink collaboratively act as IDS agents to monitor the entire network and perform intrusion detection. Based on the new architecture, this paper proposes a resource allocation model to optimally allocate resources among the IDS agents so that the network’s security metric can be maximized. A comprehensive analytical framework is proposed to analyze the optimality of the model’s solution, and an efficient computational approach is developed to obtain the optimal resource allocation strategy. Extensive numerical simulation and comparison studies are conducted to validate the proposed method.

Deep reinforcement learning for building honeypots against runtime DoS attack

Honeypot is a network environment utilized to protect proper network sources from attacks. Honeypot makes an environment that attracts the attacker to pay their operations to steal sources. Denial of Service (DoS) attacks are efficiently noticed using the proposed honeypot method. The issues of the previous technique are that the DoS attack is a malicious act with the goal of interrupting the access to a computer network. The result of the DoS attack can cause the computers on the network to squander their resources to serve illegitimate requests that result in a disruption of the network's services to legitimate users. To overcome these challenges this method is proposed. In this manuscript, the Deep Adaptive Reinforcement Learning for Honeypots (DARLH) is proposed. Here, honeypot environment, the proposed DARLHs system implements Deep Adaptive Reinforcement Learning (DARL) with Intrusion Detection System (IDS) agents and Deep Recurrent Neural Network (DRNN) with IDS agent for observing multiruntime DoS attack. In the next level, the system creates DRNN and DARL IDS agent integration modules for effective runtime attack detections. The Knowledge Data Discovery data set pattern, UNSW-NB20, and Bot-IoT data sets are used to the scenario of DoS attack. The method is executed in Python 3.7. The experimental outcomes are likened through different existing methods, such as Game and Naïve-Bayes Honeypot, Block Chain Honeypot, and Recurrent Neural Network-based Signature Generation and Detection. The proposed method is compared with External DoS Attack, Internal DoS attack, Brute-force attack, DoS attack, Web attack, and Botnet attacks with the existing methods. From the comparison, the proposed method offers 5%–10% better outcomes than another existing method. Lastly, the test results determine that the proposed method performance is most efficient with another existing system.

WITHDRAWN: Secure watchdog selection using intelligent key management in wireless sensor networks

Confirming security to all individual nodes present in wireless network is ensuring the overall network security. The secure wireless network is needed many real time field-oriented applications. In the geographical fields, the network contains one or more sensor nodes. This network is called as Wireless Sensor Network (WSN). Due to the vulnerable medium condition and resource limitation of WSN, the lightweight security or Intrusion Detection Systems (IDS) are required. The securely selected watchdogs act as IDS agents to monitor the network-level activities of each node in the network. To protect WSN, enough rate watchdogs are needed around the network. This proposed system identifies the issues in the selection mechanisms of watchdog-based IDS in WSN. This work proposes novel secure watchdog selection procedures in WSN to increase watchdog availability ratio against different types of attacks. In this proposed mechanism, use various lightweight multi-layer security providing procedures.

An architecture for resilient intrusion detection in ad-hoc networks

We study efficient and lightweight Intrusion Detection Systems (IDS) for ad-hoc networks via the prism of IPv6-enabled Wireless Sensor Actuator Networks. These networks consist of highly constrained devices able to communicate wirelessly in an ad-hoc fashion, thus following the architecture of ad-hoc networks. Current state-of-the-art (IDS) has been developed taking into consideration the architecture of conventional computer networks, and as such they do not efficiently address the paradigm of ad-hoc networks, that is highly relevant in emergent networks, such as the Internet of Things (IoT). In this context, the network properties of resilience and redundancy have not been studied yet. In this work, we firstly identify a trade-off between the communication overhead and energy consumption of an IDS (as captured by the number of active IDS agents in the network) and the performance of the system in terms of successfully identifying attacks. In order to fine tune this trade-off, we model such networks as Random Geometric Graphs; a rigorous approach that allows us to capture underlying structural properties of the network. We then introduce a novel IDS architectural approach that consists of a central IDS agent a set of distributed IDS agents deployed uniformly at random over the network area. These nodes are able to efficiently detect attacks at the networking layer in a collaborative manner by monitoring locally available network information provided by IoT routing protocols such as RPL. Our detailed experimental evaluation demonstrates significant performance gains in terms of communication overhead and energy consumption while maintaining high detection rates. We also show that the performance of our IDS in ad-hoc networks does not rely on the size of the network but on fundamental underling network properties, such as the network topology and the average degree of the nodes. Conducted experiments show that our proposed IDS architecture is resilient against frequent topology changs due to nodes failures.

Optimal Report Strategies for WBANs Using a Cloud-Assisted IDS

Applying an Intrusion Detection System (IDS) to Wireless Body Area Networks (WBANs) becomes a costly task for body sensors due to their limited resources. To solve this problem, a cloud-assisted IDS framework is proposed. We adopt a new distributed-centralized mode, where IDS agents residing in body sensors will be triggered to launch. All IDS agents are only responsible for reporting the monitored events, not intrusion decision that is processed in the cloud platform. We then employ the signaling game to construct an IDS Report Game (IDSRG) depicting interactions between a body sensor and its opponent. The pure- and mixed-strategy Bayesian Nash Equilibriums (BNEs) of the stage IDSRG are achieved, respectively. As two players interact continually, we develop the stage IDSRG into a dynamic multistage game in which the belief can be updated dynamically. Upon the current belief, the Perfect Bayesian Equilibrium (PBE) of the dynamic multistage IDSRG is attained, which helps the IDS-sensor select the optimal report strategy. We afterward design a PBE-based algorithm to make the IDS-sensor decide when to report the monitored events. Experiments show the effectiveness of the dynamic multistage IDSRG in predicting the type and optimal strategy of a malicious body sensor.

Quantal Response Equilibrium-Based Strategies for Intrusion Detection in WSNs

This paper is to solve the problem stating that applying Intrusion Detection System (IDS) to guarantee security of Wireless Sensor Networks (WSNs) is computationally costly for sensor nodes due to their limited resources. For this aim, we obtain optimal strategies to save IDS agents’ power, through Quantal Response Equilibrium (QRE) that is more realistic than Nash Equilibrium. A stage Intrusion Detection Game (IDG) is formulated to describe interactions between the Attacker and IDS agents. The preference structures of different strategy profiles are analyzed. Upon these structures, the payoff matrix is obtained. As the Attacker and IDS agents interact continually, the stage IDG is extended to a repeated IDG and its payoffs are correspondingly defined. The optimal strategies based on QRE are then obtained. These optimal strategies considering bounded rationality make IDS agents not always be inDefend. Sensor nodes’ power consumed in performing intrusion analyses can thus be saved. Experiment results show that the probabilities of the actions adopted by the Attacker can be predicted and thus the IDS can respond correspondingly to protect WSNs.

Intrusion Detection Algorithm for Mitigating Sinkhole Attack on LEACH Protocol in Wireless Sensor Networks

In wireless sensor network (WSN), the sensors are deployed and placed uniformly to transmit the sensed data to a centralized station periodically. So, the major threat of the WSN network layer is sinkhole attack and it is still being a challenging issue on the sensor networks, where the malicious node attracts the packets from the other normal sensor nodes and drops the packets. Thus, this paper proposes an Intrusion Detection System (IDS) mechanism to detect the intruder in the network which uses Low Energy Adaptive Clustering Hierarchy (LEACH) protocol for its routing operation. In the proposed algorithm, the detection metrics, such as number of packets transmitted and received, are used to compute the intrusion ratio (IR) by the IDS agent. The computed numeric or nonnumeric value represents the normal or malicious activity. As and when the sinkhole attack is captured, the IDS agent alerts the network to stop the data transmission. Thus, it can be a resilient to the vulnerable attack of sinkhole. Above all, the simulation result is shown for the proposed algorithm which is proven to be efficient compared with the existing work, namely, MS-LEACH, in terms of minimum computational complexity and low energy consumption. Moreover, the algorithm was numerically analyzed using TETCOS NETSIM.

Cluster-Based Intrusion Detection Model for Wireless Sensor Network

An intrusion detection system (IDS) using agent technology was designed for wireless sensor network of clustering structure. An IDS agent which includes two different agents was deployed in every node of network. One is local detection agent and another is global detection agent. They complete different tasks of detection. Based on Bluetooth communication technology, Bluetooth scattering network formation algorithm TPSF was employed to construct the cluster layer of sensor network and to finish task assignment of different agents. The TPSF algorithm was improved by limiting the role of nodes to lighten the complexity of nodes, so the IDS agents can work effectively and the safety coefficient of nodes is improved.

An efficient intrusion detection framework in cluster‐based wireless sensor networks

ABSTRACTIn the last few years, the technological evolution in the field of wireless sensor networks was impressive, which made them extremely useful in various applications (military, commercial, etc.). In such applications, it is essential to protect the network from malicious attacks. This presents a demand for providing security mechanisms in these vulnerable networks. In this paper, we design a new framework for intrusion detection in cluster‐based wireless sensor networks. Our detection framework is composed of different protocols that run at different levels. The first protocol is a specification‐based detection protocol that runs at intrusion detection system (IDS) agents (low level). The second one is a binary classification detection protocol that runs at cluster head (CH) node (medium level). In addition, a reputation protocol is used at each CH to evaluate the trustworthiness level of its IDSs agents. Each CH monitors its CH neighbors on the basis of a specification detection protocol with the help of a vote mechanism applied at the base station (high level). We evaluated the performances of our framework in the presence of four well‐known attacks: hello flood, selective forwarding, black hole, and wormhole attacks. We evaluated specifically the detection rate, false positive rate, energy consumption, and efficiency. Simulation results show that our detection framework exhibits high detection rate (almost 100%), low number of false positives, less time to detect the attack, and less energy consumption. Our intrusion detection framework outperforms other schemes proposed in the literature in terms of detection, false positive rate, and energy consumption. Copyright © 2013 John Wiley & Sons, Ltd.

Intrusion Detection for eliminating Security Issues in Wireless Mobile Ad Hoc Networks

In this paper, we discuss security issues and their current solutions in the mobile ad hoc network. Ad hoc networks are a new wireless network for mobile hosts. As the need for innovative and efficient means of information exchange, wireless networks are increasingly being used to address these demands with limited costs to infrastructure requirements. Unlike traditional mobile wireless networks, ad hoc networks do not rely on any fixed infrastructure. Instead, hosts rely on each other to keep the network connected. While the routing aspects of mobile ad hoc networks (MANETs) are already well understood, the research activities about security in MANETs are still at their beginning. The military aspects and other security-sensitive operations are still using ad hoc networks, although there is a trend to adopt ad hoc networks for commercial uses due to their unique properties. The strength of its infrastructure (wireless nature) also becomes the point of its greatest vulnerability. Thus decreasing the confidence level of the system as it pertains to availability, reliability, data integrity and privacy concerns. Wireless networks indeed are an effective means of communication for a variety of platforms. Also MANETs pose a number of new security problems in addition to the problems of regular networks. In addition to the classical security threats we identified additional ways how nodes may attack security in an Ad hoc network. Finally we outline a security architecture that provides substantial security services for Ad hoc networks. Due to the nature of the wireless media, ad-hoc wireless networks are vulnerable to various attacks. There are security protocols that prevent unauthorized nodes from accessing the network through authentication. Secrecy of information is provided through encryption. However these protocols cannot detect if any member of the network degrades the network performance due to misbehavior. Therefore an intrusion detection system (IDS) is required that monitors what is going on in the network, detects misbehavior or anomalies based on the monitored information and notifies other nodes in the network to take necessary steps such as to avoid or punish the misbehaving nodes. Keywords— MANET (Mobile Ad Hoc Network) SPREAD, Impersonation, Intrusion, IDS Agent, Ad Hoc, DSR

Signaling game based strategy of intrusion detection in wireless sensor networks

As Wireless Sensor Networks (WSNs) become increasingly popular, it is necessary to require Intrusion Detection System (IDS) available to detect internal malicious sensor nodes. Because sensor nodes have limited capabilities in terms of their computation, communication, and energy, selecting the profitable detection strategy for lowering resources consumption determines whether the IDS can be used practically. In this paper, we adopt the distributed-centralized network in which each sensor node has equipped an IDS agent, but only the IDS agent resided in the Cluster Head (CH) with sufficient energy will launch. Then, we apply the signaling game to construct an Intrusion Detection Game modeling the interactions between a malicious sensor node and a CH-IDS agent, and seek its equilibriums for the optimal detection strategy. We illustrate the stage Intrusion Detection Game at an individual time slot in aspects of its player’s utilities, pure-strategy Bayesian–Nash equilibrium (BNE) and mixed-strategy BNE. Under these BNEs the CH-IDS agent is not always on the Defend strategy, as a result, the power of CH can be saved. As the game evolves, we develop the stage Intrusion Detection Game into a multi-stage dynamic Intrusion Detection Game in which, based on Bayesian rules, the beliefs on the malicious sensor node can be updated. Upon the current belief and the Perfect Bayesian equilibrium (PBE), the best response strategy for the CH-IDS agent can be gained. Afterward, we propose an intrusion detection mechanism and corresponding algorithm. We also study the properties of the multi-stage dynamic Intrusion Detection Game by simulations. The simulation results have shown the effectiveness of the proposed game, thus, the CH-IDS agents are able to select their optimal strategies to defend the malicious sensor nodes’ Attack action.

A Software Fault Tree Approach to Requirements Analysis of an Intrusion Detection System

Requirements analysis for an intrusion detection system (IDS) involves deriving requirements for the IDS from analysis of the intrusion domain. When the IDS is, as here, a collection of mobile agents that detect, classify, and correlate system and network activities, the derived requirements include what activities the agent software should monitor, what intrusion characteristics the agents should correlate, where the IDS agents should be placed to feasibly detect the intrusions, and what countermeasures the software should initiate. This paper describes the use of software fault trees for requirements identification and analysis in an IDS. Intrusions are divided into seven stages (following Ruiu), and a fault subtree is developed to model each of the seven stages (reconnaissance, penetration, etc.). Two examples are provided. This approach was found to support requirements evolution (as new intrusions were identified), incremental development of the IDS, and prioritisation of countermeasures.

A large scale distributed intrusion detection framework based on attack strategy analysis

This paper describes a large-scale distributed intrusion detection (ID) architecture based on intrusion detection system (IDS) agents and collaborative attack strategy analysis. This architecture couples distributed IDS agents performing local event analysis with cooperative global ID. Other agent-based approaches have highlighted several advantages over monolithic architectures. This approach specifically focuses on cooperative IDS agents working together by analyzing the intruder’s attack strategy and separating local event processing from global analysis. We believe that focusing on the intruder's intent (attack strategy) provides a theme that will help distributed IDS to work together. Furthermore, strategy analysis creates an opportunity for IDS agents to pro-actively look ahead for data most pertinent to current case development. This look ahead adaptive auditing behavior focuses limited system resources on collecting and auditing those events which are most likely to reveal intrusions.