Approach For Intrusion Detection System Research Articles

A new approach for intrusion detection system based on training multilayer perceptron by using enhanced Bat algorithm

The most pressing issue in network security is the establishment of an approach that is capable of detecting violations in computer systems and networks. There have been several efforts for improving it from various points of view. One example is the improvement of the classification of packets on the network, which is imperative in detecting abnormal traffic and hence any potential intrusion. Thus, this study proposes a new approach for intrusion detection that is implemented using an enhanced Bat algorithm (EBat) for training an artificial neural network. The goal of the current study is to increase the accuracy of the classification for malicious and un-malicious network traffic. The proposed study herein includes a comparison with nine other metaheuristic algorithms (conventional and new algorithms) that are used to evaluate the new approach alongside the related works. Firstly, the EBat algorithm was developed and used to select suitable weights and biases. Next, the neural network was employed using the found optimal weights and biases to realize the intrusion detection approach. Four types of intrusion detection evaluation datasets were used to compare the proposed approach against the other algorithms. The findings revealed that the proposed method outperformed the other nine classification algorithms and it is unparalleled for the network intrusion detection.

Artificial intelligence based ensemble approach for intrusion detection systems

Internet attacks pose a severe threat to most of the online resources and are a prime concern of security administrators these days. In spite of many efforts, the security techniques are unable to detect the intrusions accurately. Most of the methods suffer from the limitations of a high false positive rate, low detection rate and provide one solution which lacks the classification trade-offs. In this work, an effective two-stage method is proposed to produce a pool of non-dominating solutions or Pareto optimal solutions as base models and their ensembles for detecting the intrusions accurately. It generates Pareto optimal solutions to a chromosome structure in stage 1 formulating Pareto front. Whereas, another approximation to the Pareto front of optimal solutions is made to obtain non-dominating ensembles in the second stage. The final prediction ensemble solutions are computed from individual predictions using majority voting approach. Applicability of the suggested method is validated using benchmark dataset NSL-KDD dataset. The experimental results show that the recommended method provides better results than conventional ensemble techniques. The recommended method is also adequate to generate Pareto optimal solutions that address the issue of improving detection accuracy for minority as well as majority attack classes along with handling classification tradeoff problem. The proposed method resulted detection accuracy of 97% with FPR of 2% for KDD dataset respectively. The most attractive feature of the proposed method is that both generation of base classifier and their ensemble thereof are multi-objective in nature addressing the issue of low detection accuracy and classification tradeoffs.

Novel Pattern Matching based Alert Classification Approach For Intrusion Detection System

Novel Pattern Matching based Alert Classification Approach For Intrusion Detection System

Fuzzy Rule Interpolation and SNMP-MIB for Emerging Network Abnormality

It is difficult to implement an efficient detection approach for Intrusion Detection Systems (IDS) and many factors contribute to this challenge. One such challenge concerns establishing adequate boundaries and finding a proper data source. Typical IDS detection approaches deal with raw traffics. These traffics need to be studied in depth and thoroughly investigated in order to extract the required knowledge base. Another challenge involves implementing the binary decision. This is because there are no reasonable limits between normal and attack traffics patterns. In this paper, we introduce a novel idea capable of supporting the proper data source while avoiding the issues associated with the binary decision. This paper aims to introduce a detection approach for defining abnormality by using the Fuzzy Rule Interpolation (FRI) with Simple Network Management Protocol (SNMP) Management Information Base (MIB) parameters. The strength of the proposed detection approach is based on adapting the SNMP-MIB parameters with the FRI. This proposed method eliminates the raw traffic processing component which is time consuming and requires extensive computational measures. It also eliminates the need for a complete fuzzy rule based intrusion definition. The proposed approach was tested and evaluated using an open source SNMP-MIB dataset and obtained a 93% detection rate. Additionally, when compared to other literature in which the same test-bed environment was employed along with the same number of parameters, the proposed detection approach outperformed the support vector machine and neural network. Therefore, combining the SNMP-MIB parameters with the FRI based reasoning could be beneficial for detecting intrusions, even in the case if the fuzzy rule based intrusion definition is incomplete (not fully defined).

Mitigating Data Exfiltration in SaaS Clouds

Existing processes and methods for incident handling are geared towards infrastructures and operational models that will be increasingly outdated by cloud computing. Research has shown that to adapt incident handling to cloud computing environments, cloud customers must establish clarity about their requirements on Cloud Service Providers (CSPs) for successful handling of incidents and contract CSPs accordingly. Secondly, CSPs must strive to support these requirements and mirror them in their Service Level Agreements. Intrusion Detection Systems (IDS) have been used widely to detect malicious behaviors in network communication and hosts. Facing new application scenarios in Cloud Computing, the IDS approaches yield several problems since the operator of the IDS should be the user, not the administrator of the Cloud infrastructure. Cloud providers need to enable possibilities to deploy and configure IDS for the user - which poses its own challenges. Current research and commercial solutions primarily focus on protecting against Denial of Service attacks and attacks against the Cloud’s virtual infrastructure. To counter these challenges, we propose a capability that aims to both detect and prevent the potential of data exfiltration by using a novel deception-based methodology. We also introduce a method of increasing the data protection level based on various threat conditions.

A deep learning approach for proactive multi-cloud cooperative intrusion detection system

Abstract The last few years have witnessed the ability of cooperative cloud-based Intrusion Detection Systems (IDS) in detecting sophisticated and unknown attacks associated with the complex architecture of the Cloud. In a cooperative setting, an IDS can consult other IDSs about suspicious intrusions and make a decision using an aggregation algorithm. However, undesired delays arise from applying aggregation algorithms and also from waiting to receive feedback from consulted IDSs. These limitations render the decisions generated by existing cooperative IDS approaches ineffective in real-time, hence making them unsustainable. To face these challenges, we propose a machine learning-based cooperative IDS that efficiently exploits the historical feedback data to provide the ability of proactive decision making. Specifically, the proposed model is based on a Denoising Autoencoder (DA), which is used as a building block to construct a deep neural network. The power of DA lies in its ability to learn how to reconstruct IDSs’ feedback from partial feedback. This allows us to proactively make decisions about suspicious intrusions even in the absence of complete feedback from the IDSs. The proposed model was implemented in GPU-enabled TensorFlow and evaluated using a real-life dataset. Experimental results show that our model can achieve detection accuracy up to 95%.

Unsupervised learning approach for network intrusion detection system using autoencoders

Network intrusion detection systems are useful tools that support system administrators in detecting various types of intrusions and play an important role in monitoring and analyzing network traffic. In particular, anomaly detection-based network intrusion detection systems are widely used and are mainly implemented in two ways: (1) a supervised learning approach trained using labeled data and (2) an unsupervised learning approach trained using unlabeled data. Most studies related to intrusion detection systems focus on supervised learning. However, the process of acquiring labeled data is expensive, requiring manual labeling by network experts. Therefore, it is worthwhile investigating the development of unsupervised learning approaches for intrusion detection systems. In this study, we developed a network intrusion detection system using an unsupervised learning algorithm autoencoder and verified its performance. As our results show, our model achieved an accuracy of 91.70%, which outperforms previous studies that achieved 80% accuracy using cluster analysis algorithms. Our results provide a practical guideline for developing network intrusion detection systems based on autoencoders and significantly contribute to the exploration of unsupervised learning techniques for various network intrusion detection systems.

Efficient Working of Signature Based Intrusion Detection Technique in Computer Networks

The subject of Computer Network Intrusion Detection System (IDS) is a very interesting research topic actively pursued by many investigators. The goal of intrusion detection is to monitor network assets and to detect anomalous behaviour and misuse. This concept has been around for the past several years but only recently, it has seen a dramatic rise in interest of researchers and system developers for incorporation into the overall information security infrastructure. In today's world, the concept of information has been moved to the digital size from conventional size. Protection of the data stored in the digital archive and is easily accessibility at any time have become a quite important phenomenon. In this concept, intrusion detection and prevention systems as security tools are widely used today [1]. In this paper, a signature based intrusion detection system approach has been proposed for computer network security. This paper is based on the efficient working of the Signature based intrusion detection method and protects the computer network against the intrusion or the unspecified packets.

Certain Investigation on MANET Security with Routing and Blackhole Attacks Detection

Abstract Mobile Ad-hoc Network (MANET) is a self-configuring network depending upon infrastructure, also is a significant technology which supplies virtual hardware and software resources as per requirement of mobile ad hoc network. The Intrusion Detection System (IDS) has been established to protect Cross Interior (routing) at source to goal from different types of attack. Current IDS approaches can be classified as either anomaly or signature-based methods such as Rule-based expert systems, State transition analysis, Bayesian alarm networks aspects are various challenges with respect to the efficiency as well as performance. The major challenge is the compromise of performance because of unavailable resources with respect to the MANET. To increase the MANET environment’s performance, various techniques are employed for routing, security purpose. An efficient security module requires a routing in terms of packet loss. The Integrated Cross Interior (ICI) structure for Intrusion Detection System (IDS) namely ICIs for IDS are proposed for exactness of black hole attacks detection. The ICIs for IDS performs the task of routing of the mobile nodes. The proposed (ICIs for IDS) produces the enhancement of Intrusion Detection System (IDS) with routing algorithm named as Integrated Cross Interior algorithm that performs maps the security with the secure IDS communication and distributes the packets among different destination, based on priority. This paper proposes a novel Integrated Cross Interior structure for Intrusion Detection System (ICIS for IDS) to secure our network from black hole attacks. This algorithm is proposed for node routing and node security by considering maximum throughput 83.5% with minimum routing cost, response time with 6.3ms. The experimental results specify that ICIs for IDS based security policy effectively minimizes the response time as well as the mobile routing cost, response time of an application with respect to other existing approaches such as IDS with AODV. The proposed algorithm is experimented using Network Simulator-2 and the results demonstrated that the performance of the algorithm is better than other conventional algorithms like IDS with AODV.

A Novel Approach of Intrusion Detection System Through SADE in Data Mining

A Novel Approach of Intrusion Detection System Through SADE in Data Mining

Filters based Approach with Temporal and Combinational Constraints for Cybersecurity of Industrial Control Systems

Industrial Control Systems (ICS) are increasingly deployed in critical infrastructures. Originally designed to increase the productivity of ICS as well as safety and reliability, nowadays these systems are becoming the target of hackers. Several attacks highlighted vulnerabilities, the most relevant one, Stuxnet, stroke in 2010. Protection of ICS against cyberattacks has to be considered. Security of these systems is different from IT security solutions because exchanged data have physical consequences. For that, a new approach for Intrusion Detection System (IDS) in ICS was presented based on filters monitoring orders and reports. Methodology to obtain these filters and their locations in the ICS architecture were introduced. In this paper, we present major improvements in detection mechanisms of these filters. Distance concept, introduced in previous paper (Sicard et al., 2017), is developed and combined to trajectory concept that allows filters to detect deviations from expected behavior. Distance from optimal or forbidden states is essential to compute order sequence bringing back the system into safe states. Trajectory, which is the evolution of distance during state evolution, improves detection mechanism by analyzing sequences sent to the system and received by Programmable Logic Controller (PLC). This combinational security prevents damages against goods and people. Implementation of time based intrusion detection is a step forward for improving filters. Temporal windows indicate when actions have to be done and if received reports correspond to executed orders. Thus, our filter approach secures ICS against combinational and temporal attacks affecting security of goods and people or quality.

A GA-LR wrapper approach for feature selection in network intrusion detection

Intrusions constitute one of the main issues in computer network security. Through malicious actions, hackers can have unauthorised access that compromises the integrity, the confidentiality, and the availability of resources or services. Intrusion detection systems (IDSs) have been developed to monitor and filter network activities by identifying attacks and alerting network administrators. Different IDS approaches have emerged using data mining, machine learning, statistical analysis, and artificial intelligence techniques such as genetic algorithms, artificial neural networks, fuzzy logic, swarm intelligence, etc. Due to the high dimensionality of the exchanged data, applying those techniques will be extremely time consuming. Feature selection is needed to select the optimal subset of features that represents the entire dataset to increase the accuracy and the classification performance of the IDS. In this work, we apply a wrapper approach based on a genetic algorithm as a search strategy and logistic regression as a learning algorithm for network intrusion detection systems to select the best subset of features. The experiment will be conducted on the KDD99 dataset and the UNSW-NB15 dataset. Three different decision tree classifiers are used to measure the performance of the selected subsets of features. The obtained results are compared with other feature selection approaches to verify the efficiency of our proposed approach.

A novel statistical technique for intrusion detection systems

This paper proposes a novel approach for intrusion detection system based on sampling with Least Square Support Vector Machine (LS-SVM). Decision making is performed in two stages. In the first stage, the whole dataset is divided into some predetermined arbitrary subgroups. The proposed algorithm selects representative samples from these subgroups such that the samples reflect the entire dataset. An optimum allocation scheme is developed based on the variability of the observations within the subgroups. In the second stage, least square support vector machine (LS-SVM) is applied to the extracted samples to detect intrusions. We call the proposed algorithm as optimum allocation-based least square support vector machine (OA-LS-SVM) for IDS. To demonstrate the effectiveness of the proposed method, the experiments are carried out on KDD 99 database which is considered a de facto benchmark for evaluating the performance of intrusions detection algorithm. All binary-classes and multiclass are tested and our proposed approach obtains a realistic performance in terms of accuracy and efficiency. Finally a way out is also shown the usability of the proposed algorithm for incremental datasets.

A New Unified Intrusion Anomaly Detection in Identifying Unseen Web Attacks

The global usage of more sophisticated web-based application systems is obviously growing very rapidly. Major usage includes the storing and transporting of sensitive data over the Internet. The growth has consequently opened up a serious need for more secured network and application security protection devices. Security experts normally equip their databases with a large number of signatures to help in the detection of known web-based threats. In reality, it is almost impossible to keep updating the database with the newly identified web vulnerabilities. As such, new attacks are invisible. This research presents a novel approach of Intrusion Detection System (IDS) in detecting unknown attacks on web servers using the Unified Intrusion Anomaly Detection (UIAD) approach. The unified approach consists of three components (preprocessing, statistical analysis, and classification). Initially, the process starts with the removal of irrelevant and redundant features using a novel hybrid feature selection method. Thereafter, the process continues with the application of a statistical approach to identifying traffic abnormality. We performed Relative Percentage Ratio (RPR) coupled with Euclidean Distance Analysis (EDA) and the Chebyshev Inequality Theorem (CIT) to calculate the normality score and generate a finest threshold. Finally, Logitboost (LB) is employed alongside Random Forest (RF) as a weak classifier, with the aim of minimising the final false alarm rate. The experiment has demonstrated that our approach has successfully identified unknown attacks with greater than a 95% detection rate and less than a 1% false alarm rate for both the DARPA 1999 and the ISCX 2012 datasets.

Rough Set-hypergraph-based Feature Selection Approach for Intrusion Detection Systems

Immense growth in network-based services had resulted in the upsurge of internet users, security threats and cyber-attacks. Intrusion detection systems (IDSs) have become an essential component of any network architecture, in order to secure an IT infrastructure from the malicious activities of the intruders. An efficient IDS should be able to detect, identify and track the malicious attempts made by the intruders. With many IDSs available in the literature, the most common challenge due to voluminous network traffic patterns is the curse of dimensionality. This scenario emphasizes the importance of feature selection algorithm, which can identify the relevant features and ignore the rest without any information loss. In this paper, a novel rough set κ-Helly property technique (RSKHT) feature selection algorithm had been proposed to identify the key features for network IDSs. Experiments carried using benchmark KDD cup 1999 dataset were found to be promising, when compared with the existing feature selection algorithms with respect to reduct size, classifier’s performance and time complexity. RSKHT was found to be computationally attractive and flexible for massive datasets.

A Survey of Pattern Matching Algorithem in Intrusion Detection System Tehran, Iran

The usual approach of Intrusion Detection System (IDS) systematic is according to model compatibility which determines the vandalism happening on the network using particular models and orders. To perform this algorithm, casual manner of the network are evaluated by modeling and in the next step it utilized as a draft model for specifying unusual manner. This paper, wants to determine and select the most efficient procedure for this performance by investigation, application and also gathering all kinds of model compatibility technique so that the most proper result is achieved over compatibility known attacks with original models. In this study, to gather all procedures associated with the subject, we surveyed the expressing of model adoption performance from various views. The other context of this study is to evaluate the items for setting the procedures whereas the algorithms are categorized according to significant items which has more influence on the operating of model adoption performance.

Fuzziness based semi-supervised learning approach for intrusion detection system

Countering cyber threats, especially attack detection, is a challenging area of research in the field of information assurance. Intruders use polymorphic mechanisms to masquerade the attack payload and evade the detection techniques. Many supervised and unsupervised learning approaches from the field of machine learning and pattern recognition have been used to increase the efficacy of intrusion detection systems (IDSs). Supervised learning approaches use only labeled samples to train a classifier, but obtaining sufficient labeled samples is cumbersome, and requires the efforts of domain experts. However, unlabeled samples can easily be obtained in many real world problems. Compared to supervised learning approaches, semi-supervised learning (SSL) addresses this issue by considering large amount of unlabeled samples together with the labeled samples to build a better classifier. This paper proposes a novel fuzziness based semi-supervised learning approach by utilizing unlabeled samples assisted with supervised learning algorithm to improve the classifier’s performance for the IDSs. A single hidden layer feed-forward neural network (SLFN) is trained to output a fuzzy membership vector, and the sample categorization (low, mid, and high fuzziness categories) on unlabeled samples is performed using the fuzzy quantity. The classifier is retrained after incorporating each category separately into the original training set. The experimental results using this technique of intrusion detection on the NSL-KDD dataset show that unlabeled samples belonging to low and high fuzziness groups make major contributions to improve the classifier’s performance compared to existing classifiers e.g., naive bayes, support vector machine, random forests, etc.

A Heuristic Approach for Efficient Detection of Intrusion

heuristic approach for efficient detection of intrusion is been proposed on this paper. The proposed framework uses new data preprocessing and filtration criteria which is data discretization to improve results of intrusion detection. It is more Accurate in comparison the existing methods. An overview of intrusion detection system is been presented. Also the present approaches for intrusion detection system are been described.

Survey on Intrusion Detection System using Machine Learning Techniques

In today’s world, almost everybody is affluent with computers and network based technology is growing by leaps and bounds. So, network security has become very important, rather an inevitable part of computer system. An Intrusion Detection System (IDS) is designed to detect system attacks and classify system activities into normal and abnormal form. Machine learning techniques have been applied to intrusion detection systems which have an important role in detecting Intrusions. This paper reviews different machine approaches for Intrusion detection system. This paper also presents the system design of an Intrusion detection system to reduce false alarm rate and improve accuracy to detect intrusion.

A Combined Two Step Approach for Detecting Input Validation Attacks Against Web Applications

Internet becomes a part of our daily life. Almost very service by the internet will be provided with the help of web applications with these we can say that without the web application we cannot do anything over the internet but at the same time web applications are mostly targeted by the hackers. In this paper we present an efficient intrusion detection system approach for detecting input validation attacks against web application. Web application attacks gives chance to the attacker to get unrestricted access to data base and web servers. In this approach we have proposed a two step approach to detect input validation attacks against web applications. By using our approach we can prevent input validation attacks against web applications very efficiently. In the first step we have used a honey pot system to find any malicious data is present or not. In the second step we have used efficient intrusion mechanism to identify the attacks that was not identified in the first step. In this we used an efficient Hirschberg algorithm this is a divide and conquer approach to find attacks against web applications. This system analyzes malicious code and immediately generates an alert to protect web applications from the attacker. By using this technique we can reduce the analysis time and false positive rate.