Intrusion Detection System System Research Articles

Empirical Enhancement of Intrusion Detection Systems: A Comprehensive Approach with Genetic Algorithm-based Hyperparameter Tuning and Hybrid Feature Selection

AbstractMachine learning-based IDSs have demonstrated promising outcomes in identifying and mitigating security threats within IoT networks. However, the efficacy of such systems is contingent on various hyperparameters, necessitating optimization to elevate their performance. This paper introduces a comprehensive empirical and quantitative exploration aimed at enhancing intrusion detection systems (IDSs). The study capitalizes on a genetic algorithm-based hyperparameter tuning mechanism and a pioneering hybrid feature selection approach to systematically investigate incremental performance improvements in IDS. Specifically, our work proposes a machine learning-based IDS approach tailored for detecting attacks in IoT environments. To achieve this, we introduce a hybrid feature selection method designed to identify the most salient features for the task. Additionally, we employed the genetic algorithm (GA) to fine-tune hyperparameters of multiple machine learning models, ensuring their accuracy in detecting attacks. We commence by evaluating the default hyperparameters of these models on the CICIDS2017 dataset, followed by rigorous testing of the same algorithms post-optimization through GA. Through a series of experiments, we scrutinize the impact of combining feature selection methods with hyperparameter tuning approaches. The outcomes unequivocally demonstrate the potential of hyperparameter optimization in enhancing the accuracy and efficiency of machine learning-based IDS systems for IoT networks. The empirical nature of our research method provides a meticulous analysis of the efficacy of the proposed techniques through systematic experimentation and quantitative evaluation. Consolidated in a unified manner, the results underscore the step-by-step enhancement of IDS performance, especially in terms of detection time, substantiating the efficacy of our approach in real-world scenarios.

CFS-AE: Correlation-based Feature Selection and Autoencoder for Improved Intrusion Detection System Performance

The major problem computer network users face concerning data – whether in storage, in transit, or being processed - is unauthorized access. This unauthorized access typically leads to the loss of confidentiality, integrity, and availability of data. Consequently, it is essential to implement an accurate Intrusion Detection System (IDS) for every information system. Many researchers have proposed machine learning and deep learning models, such as autoencoders, to enhance existing IDS. However, the accuracy of these models remains a significant research challenge. This paper proposes a Correlation-Based Feature Selection and Autoencoder (CFS-AE) to enhance detection accuracy and reduce the false alarms associated with the current anomaly-based IDS. The first step involves feature selection for the NSL-KDD and CIC-IDS2017 datasets which are used to train and test our model. Subsequently, an autoencoder is employed as a classifier to categorize data traffic into attack and normal categories. The results from our experimental study revealed an accuracy of 94.32% and 97.71% for the NSL-KDD and CIC-IDS2017 datasets, respectively. These results demonstrate improved performance over existing IDS systems.

Enhanced Intrusion Detection Systems Performance with UNSW-NB15 Data Analysis

The rapid proliferation of new technologies such as Internet of Things (IoT), cloud computing, virtualization, and smart devices has led to a massive annual production of over 400 zettabytes of network traffic data. As a result, it is crucial for companies to implement robust cybersecurity measures to safeguard sensitive data from intrusion, which can lead to significant financial losses. Existing intrusion detection systems (IDS) require further enhancements to reduce false positives as well as enhance overall accuracy. To minimize security risks, data analytics and machine learning can be utilized to create data-driven recommendations and decisions based on the input data. This study focuses on developing machine learning models that can identify cyber-attacks and enhance IDS system performance. This paper employed logistic regression, support vector machine, decision tree, and random forest algorithms on the UNSW-NB15 network traffic dataset, utilizing in-depth exploratory data analysis, and feature selection using correlation analysis and random sampling to compare model accuracy and effectiveness. The performance and confusion matrix results indicate that the Random Forest model is the best option for identifying cyber-attacks, with a remarkable F1 score of 97.80%, accuracy of 98.63%, and low false alarm rate of 1.36%, and thus should be considered to improve IDS system security.

ANALYZING THE CAN PROTOCOL: VULNERABILITIES, PROTECTIVE MEASURES AND IMPROVEMENTS

The Controller Area Network (CAN) bus, originally designed for internal communication among a limited number of Electronic Control Units (ECUs) within vehicles, faces significant security challenges due to the rapid expansion of ECUs in modern automobiles. This expansion necessitates accessibility for diagnostic purposes, yet the CAN protocol lacks fundamental security features such as encryption, authentication, and integrity checks, rendering it vulnerable to various attacks including message injection, Denial of Service (DoS), and masquerading ECUs. This paper surveys existing literature and investigates potential intrusions on the CAN bus, highlighting attacks ranging from GPS spoofing to remote sensor tampering. Various solutions are discussed, including network subdivision, encryption, authentication techniques, and intrusion detection systems (IDS). Recent research proposes IDS solutions utilizing machine learning algorithms such as Random Forest, Support Vector Machine, and Deep Neural Networks (DNN), demonstrating effectiveness in detecting known attacks. However, challenges persist in identifying unknown attacks and enhancing overall system performance. Innovative approaches, such as event-triggered detection and bloom filtering techniques, show promise in mitigating specific attack vectors but may introduce overhead or limitations in real-time response. Deep learning-based IDS systems exhibit high performance but struggle with the detection of novel attacks. Furthermore, while some solutions address specific vulnerabilities, others propose more comprehensive security measures, such as preventing remote manipulation of critical vehicle functions like steering and braking. Overall, the research emphasizes the critical need for robust security measures in automotive systems to safeguard against evolving threats to vehicle safety and integrity.

Implementation of IDS Using Snort with Barnyard2 Visualization for Network Monitoring in The Informatics Engineering Computer Lab at Muhammadiyah University Surakarta

The recent surge in cyberattacks should not be taken lightly, especially by large enterprises with sensitive data. Intrusion Detection Systems (IDS) are becoming a critical component for detecting network anomalies. One such network anomaly detection tool is SNORT, with a BASE (Basic Analysis and Security Engine) frontend for efficient data processing. Acting as a bridge between SNORT and BASE, the author uses barnyard2 as a backend to store logs obtained from SNORT into the database. The implementation methodology used in this research is an experimental approach, where the authors conduct experiments through trial and error to achieve the desired results. This IDS system was tested using two types of attacks, namely DDoS and SQL-Injection. The DDoS attack trial uses tools found in Kali Linux, namely Hping3 with 6 scenarios namely FIN, ACK, RST, UDP, SYN, and ICMP with the results detected in the snort database. SQL-Injection attack test using the DVWA vulnerable website with the result detected in the snort database when the attack is carried out. This proves that the accuracy level of the system reaches close to 100% with the rules given and the penetration testing given.

Two-Stage Intrusion Detection System in Intelligent Transportation Systems Using Rule Extraction Methods From Deep Neural Networks

In recent years, intrusion detection systems (IDSs) are offering effective solutions to protect various types of cyber-attacks in different networks such as Internet of Vehicles (IoVs) network in Intelligent Transportation Systems (ITS). Deep learning models have largely been leveraged by these intrusion detection systems to achieve better effectiveness results. However, deep learning models are black boxes, which limits their acceptability in decision systems. Also, they require powerful processing capabilities such as GPU, which limit their deployments in resource-constrained devices in IoV environment. To deal with these issues, we propose a two-stage IDS in ITS to discover suspicious network activity of In-Vehicles Networks (IVN) and vehicles to everything (V2X) networks. Our proposed IDS system uses rule extraction methods from deep learning models, i.e., deep neural networks in two stages. In the first stage, we analyze network traffic to distinguish between normal and attack traffic. If the traffic is found malicious, the second stage is invoked to identify the type of attack. To this end, we propose three variants of rule extraction. The first and the second variants are homogeneous, and they apply <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$DeepRed$</tex-math> </inline-formula> and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$HypInv$</tex-math> </inline-formula> rule extraction methods in both stages respectively. The third variant is heterogeneous, and it applies <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$HypInv$</tex-math> </inline-formula> in the first stage to perform binary classification, and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$DeepRed$</tex-math> </inline-formula> in the second stage to perform attack classification. The key idea is to combine the advantages of rule extraction technique and two-stage IDS architecture to resource consumption and improve classification accuracy. The proposed IDS model was tested using four benchmark datasets, i.e. ISCXIDS2012, CIC-IDS2017, and CSE-CIC-IDS2018 datasets are used for external network communications and the car hacking dataset are used for in-vehicle communications. The evaluation results show that the homogeneous <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$DeepRed$</tex-math> </inline-formula> is the optimal one in all cases of IDS system with an accuracy scores ranging between 92.43%-98.32% under CIC-IDS2017 dataset, between 91.32%-99.46% under CSE-CIC-IDS2018 dataset, and between 96.05%-99.21% under Car-hacking dataset.

Personalized federated learning-based intrusion detection system: Poisoning attack and defense

To deal with the increasing number of cyber-attacks, intrusion detection system (IDS) plays an important role in monitoring and ensuring the security of the computer network. With the power of machine learning and deep learning, intelligent IDS systems have gained increasing attention due to their efficiency and high classification accuracy. However, the premise of machine learning/deep learning is that the data must be in one central entity (e.g., server) to train the model. This causes additional concerns, such as data transmission costs and privacy leakage. Federated learning complements this shortcoming with a privacy-preserving decentralized learning technique. In federated learning, the data are not shared with the server, local model training is performed where the data reside and only the model parameters are exchanged with the server. This work investigates the federated learning-based IDS approach in the context of IoT data to study the main challenges imposed by federated learning. Two main issues, such as data heterogeneity and poisoning attacks launched by malicious clients, are the main focus of this study. As real-world IoT datasets are heterogeneous, we propose a personalized federated learning-based IDS approach to handle imbalanced data distributions. Moreover, a curious yet malicious client can poison the local data or model to corrupt the global intrusion detection model due to the distributed nature of federated learning, where the central server has no control over the client’s local training process. This study demonstrates that the existence of a malicious client can degrade the performance of the federated learning-based IDS model. Accordingly, we propose a robust approach called pFL-IDS to combat poisoning attacks against the federated learning-enabled IDS on heterogeneous IoT data. Our approach introduces mini-batch logit adjustment loss to local model training to obtain a personalized model tailored to each local data distribution. Moreover, we design a detection mechanism at the server to identify malicious agents by considering the cosine similarity of local models from the non-poisoned client’s centroid. The non-poisoned centroid is determined from the similarity between the pre-computed global model and the local models. If the poisoning attack is successful, poisoned clients will be closer to the pre-computed global model; any models further from the pre-computed model are taken as the non-poisoned clients. With this two-phase client similarity alignment, we identify poisoned clients and restrict their aggregation on the global intrusion detection model. In comparison with the baseline methods, we demonstrate that our pFL-IDS can detect poisoning attacks without compromising performance.

Robust genetic machine learning ensemble model for intrusion detection in network traffic

Network security has developed as a critical research subject as a result of the Rapid advancements in the development of Internet and communication technologies over the previous decades. The expansion of networks and data has caused cyber-attacks on the systems, making it difficult for network security to detect breaches effectively. Current Intrusion Detection Systems (IDS) have several flaws, including their inability to prevent attacks on their own, the requirement for a professional engineer to administer them, and the occurrence of false alerts. As a result, a plethora of new attacks are being created, making it harder for network security to properly detect breaches. Despite the best efforts, IDS continues to struggle with increasing detection accuracy while lowering false alarm rates and detecting new intrusions. Therefore, network intrusion detection enhancement by preprocessing and generation of highly reliable algorithms is the main focus nowadays. Machine learning (ML) based IDS systems have recently been implemented as viable solutions for quickly detecting intrusions across the network. In this study, we use a combined data analysis technique with four Robust Machine learning ensemble algorithms, including the Voting Classifier, Bagging Classifier, Gradient Boosting Classifier, and Random Forest-based Bagging algorithm along with the proposed Robust genetic ensemble classifier. For each algorithm, a model is created and tested using a Network Dataset. To assess the performance of both algorithms in terms of their ability to anticipate the anomaly occurrence, graphs of performance rates have been evaluated. The suggested algorithm outperformed other methods as it shows the lowest values of mean square error (MSE) and mean absolute error (MAE). The experiments were conducted on the Network traffic dataset available on Kaggle, on the Python platform, which has limited samples. The proposed method can be applied in the future with more machine learning ensemble classifiers and deep learning techniques.

Moth–Flame Optimization based ensemble classification for intrusion detection in intelligent transport system for smart cities

The number of vehicles travelling on the road has increased tremendously over the past few decades throughout the globe. The advent of Intelligent Transport System (ITS) enabled the vehicles to be managed intelligently. However, the ITS network can be intruded by malicious users to access the sensitive information. So a strong Intrusion Detection System (IDS) is required to safeguard the ITS network. Due to the huge volume of data generated by the sensors in the vehicles in ITS, there is a dire need to extract the most important features from the ITS data for classification phase in IDS. Even though, many researchers have worked on building an IDS system in ITS, not much work is done on addressing the aforementioned issue. To address this problem, we have utilized the Moth–Flame Optimization (MFO) in this work. In the proposed work, a MFO based ensemble machine learning model is proposed to classify the IDS dataset in ITS. Firstly the IDS dataset is normalized using the standard-scaler method. Then optimal features from the IDS dataset are chosen by MFO. These optimal features are trained by an ensemble classifier comprising of linear regression, random forest and XGBoost classification algorithms for intelligent decision making. The performance of the proposed model is compared against several state of the art meta-heuristic algorithms based on ensemble models which achieved a superior accuracy and recall of 100%, and precision of 99.5% on shellcode attacks.

A Novel Feature-Selection Algorithm in IoT Networks for Intrusion Detection.

The Internet of Things (IoT) and network-enabled smart devices are crucial to the digitally interconnected society of the present day. However, the increased reliance on IoT devices increases their susceptibility to malicious activities within network traffic, posing significant challenges to cybersecurity. As a result, both system administrators and end users are negatively affected by these malevolent behaviours. Intrusion-detection systems (IDSs) are commonly deployed as a cyber attack defence mechanism to mitigate such risks. IDS plays a crucial role in identifying and preventing cyber hazards within IoT networks. However, the development of an efficient and rapid IDS system for the detection of cyber attacks remains a challenging area of research. Moreover, IDS datasets contain multiple features, so the implementation of feature selection (FS) is required to design an effective and timely IDS. The FS procedure seeks to eliminate irrelevant and redundant features from large IDS datasets, thereby improving the intrusion-detection system's overall performance. In this paper, we propose a hybrid wrapper-based feature-selection algorithm that is based on the concepts of the Cellular Automata (CA) engine and Tabu Search (TS)-based aspiration criteria. We used a Random Forest (RF) ensemble learning classifier to evaluate the fitness of the selected features. The proposed algorithm, CAT-S, was tested on the TON_IoT dataset. The simulation results demonstrate that the proposed algorithm, CAT-S, enhances classification accuracy while simultaneously reducing the number of features and the false positive rate.

Optimization of Deep Generative Intrusion Detection System for Cloud Computing: Challenges and Scope for Improvements

The large amount of data and its exponential increase result in security problems which subsequently cause damage to cloud computing and its environments. The Intrusion detection system (IDS) is among the systems that monitor and analyse data for malicious attacks in the cloud environment. High volume, high redundancy, and high dimensionality of network traffic in cloud computing make it difficult to detect attacks by contemporary techniques. To improve the performance of IDS features selection and data imbalance issues need to be resolved. This paper includes techniques and surveys of cloud-based IDS with ML techniques and IDS performance on the different types of cloud-based datasets. It also analyses the gaps and scope for enhancement of evaluation parameters of IDS. It provides a cloud-based IDS system which will produce a good performance result as compared to the other contemporary system. Moreover, this paper offers a current overview of cloud-based IDS, Data imbalance technique, Dataset and proposed cloud IDS system architecture.

Hybrid extreme learning machine-based approach for IDS in smart Ad Hoc networks

In recent years, intrusion detection systems (IDSs) have increasingly come to be regarded as a significant method due to their potential to develop into a key component that is necessary for the safety of computer networks. This work focuses on the usage of extreme learning machines, which are also known as ELMs, with the purpose of spotting prospective intrusions and assaults. The proposed method combines the self-adaptive differential evolution method for optimising network input weights and hidden node biases and multi-node probabilistic approach with the extreme learning machine for deriving network output weights. This body of work presents an innovative method of learning that can be put into practice in order to determine whether or not an incursion has taken place in the system that is the focus of the investigation that is being carried out by this body of work. A hybrid extreme learning machine is used in the execution of this strategy. When there is one thousand times more traffic on a network, the ability of regular IDS systems to detect malicious network intrusions is lowered by a factor of one hundred. This is because there are less opportunities to detect the intrusions. This is due to the fact that there are less probabilities to identify potential dangers. This paper lays the groundwork for a novel methodology for identifying malicious network breaches. The findings of the simulation demonstrated that putting into practice the approach that was proposed resulted in an improvement in the accuracy of the scenario's classification while it was being investigated. The implementation of the method seems to have produced the desired results.

English

The latest wireless sensor network (WSN) developments in critical applications have introduced security risks, like jamming. Intrusion Detection System (IDS) in WSN is the method of recognizing malevolent or unauthorized activities in the network. The intruder's presence to launch different attacks within the network cannot be disregarded. Despite a great deal of effort by the researcher workers, IDS still experienced difficulties enhancing recognition performance while minimizing the false alarm rate and identifying novel intrusions. Recently, Deep Learning (DL) and Machine Learning (ML) based IDS system has been deployed as promising solution to effectively identify intrusion across the network. Therefore, the study presents a Moth Search Optimization with DL-based Intrusion Detection (MSODL-ID) method in the WSN. The MSODL-ID technique aims to effectually identify the occurrence of malicious activities or intrusions in the network. To accomplish this, the MSODL-ID technique undergoes two stages of preprocessing: data conversion and data scaling. In addition, the MSODL-ID technique employs Convolutional Recurrent Neural Network (CRNN) model with a Hopfield layer for intrusion detection purposes. For optimal hyperparameter selection of the CRNN model, the MSO algorithm is used and thereby enhances the classification performance of the CRNN model. The stimulation analysis of the MSODL-ID system is tested by means of Kaggle datasets, and the outcomes exhibit the promising performance of the MSODL-ID system over other current DL approaches.

LM-GA: A Novel IDS with AES and Machine Learning Architecture for Enhanced Cloud Storage Security

Cloud Computing (CC) is a relatively new technology that allows for widespread access and storage on the internet. Despite its low cost and numerous benefits, cloud technology still confronts several obstacles, including data loss, quality concerns, and data security like recurring hacking. The security of data stored in the cloud has become a major worry for both Cloud Service Providers (CSPs) and users. As a result, a powerful Intrusion Detection System (IDS) must be set up to detect and prevent possible cloud threats at an early stage. Intending to develop a novel IDS system, this paper introduces a new optimization concept named Lion Mutated-Genetic Algorithm (LM-GA) with the hybridization of Machine Learning (ML) algorithms such as Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM). Initially, the input text data is preprocessed and balanced to avoid redundancy and vague data. The preprocessed data is then subjected to the hybrid Deep Learning (DL) models namely the CNN-LSTM model to get the IDS output. Now, the intruded are discarded and non-intruded data are secured using Advanced Encryption Standard (AES) encryption model. Besides, the optimal key selection is done by the proposed LM-GA model and the cipher text is further secured via the steganography approach. NSL-KDD and UNSW-NB15 are the datasets used to verify the performance of the proposed LM-GA-based IDS in terms of average intrusion detection rate, accuracy, precision, recall, and F-Score.

An Intrusion Detection System for Drone Swarming Utilizing Timed Probabilistic Automata

Unmanned aerial vehicles (UAVs), commonly known as drones, have found extensive applications across diverse sectors, such as agriculture, delivery, surveillance, and military. In recent times, drone swarming has emerged as a novel field of research, which involves multiple drones working in collaboration towards a shared objective. This innovation holds immense potential in transforming the way we undertake tasks, including military operations, environmental monitoring, and search and rescue missions. However, the emergence of drone swarms also brings new security challenges, as they can be susceptible to hacking and intrusion. To address these concerns, we propose utilizing a timed probabilistic automata (TPA)-based intrusion detection system (IDS) to model the normal behavior of drone swarms and identify any deviations that may indicate an intrusion. This IDS system is particularly efficient and adaptable in detecting different types of attacks in drone swarming. Its ability to adapt to evolving attack patterns and identify zero-day attacks makes it an invaluable tool in protecting drone swarms from malicious attacks.

Hybrid Deep Learning-Based Intrusion Detection System for RPL IoT Networks

Internet of things (IoT) has become an emerging technology transforming everyday physical objects to be smarter by using underlying technologies such as sensor networks. The routing protocol for low-power and lossy networks (RPL) is considered one of the promising protocols designed for the IoT networks. However, due to the constrained nature of the IoT devices in terms of memory, processing power, and network capabilities, they are exposed to many security attacks. Unfortunately, the existing Intrusion Detection System (IDS) approaches using machine learning that have been proposed to detect and mitigate security attacks in internet networks are not suitable for analyzing IoT traffics. This paper proposed an IDS system using the hybridization of supervised and semi-supervised deep learning for network traffic classification for known and unknown abnormal behaviors in the IoT environment. In addition, we have developed a new IoT specialized dataset named IoTR-DS, using the RPL protocol. IoTR-DS is used as a use case to classify three known security attacks (DIS, Rank, and Wormhole). The proposed Hybrid DL-Based IDS is evaluated and compared to some existing ones, and the results are promising. The evaluation results show an accuracy detection rate of 98% and 92% in f1-score for multi-class attacks when using pre-trained attacks (known traffic) and an average accuracy of 95% and 87% in f1-score when predicting untrained attacks for two attack behaviors (unknown traffic).

Anomaly based network intrusion detection for IoT attacks using deep learning technique

Internet of Things (IoT) applications are growing in popularity for being widely used in many real-world services. In an IoT ecosystem, many devices are connected with each other via internet, making IoT networks more vulnerable to various types of cyber attacks, thus a major concern in its deployment is network security and user privacy. To protect IoT networks against various attacks, an efficient and practical Intrusion Detection System (IDS) could be an effective solution. In this paper, a novel anomaly-based IDS system for IoT networks is proposed using Deep Learning technique. Particularly, a filter-based feature selection Deep Neural Network (DNN) model where highly correlated features are dropped has been presented. Further, the model is tuned with various parameters and hyper parameters. The UNSW-NB15 dataset comprising of four attack classes is utilized for this purpose. The proposed model achieved an accuracy of 84%. Generative Adversarial Networks (GANs) were used to generate synthetic data of minority attacks to resolve class imbalance issues in the dataset and achieved 91% accuracy with balanced class dataset.

Empirical Analysis of Machine Learning Techniques for Intrusion Detection in Network System

Abstract—Increasing network resource usage creates security risks with it. Malwares and other sources may disrupt the system operations and inadequate security holes in systems. Intrusion Detection System(IDS) is invented to alert admins in case of such security breaches. In order to enhance IDS systems, artificial intelligence as well as . In this research, literature studies employing CSE-CIC IDS- 2018, UNSW-NB15, ISCX-2012, NSLKDD and CIDDS-001 data sets, frequently used to design IDS systems, updated in detail. In addition, max-min normalisation was done on these data sets and classed created utilising ,K NN algo, vector support machine (SVM), Decision Tree (DT) algorithms, which among the most ancient ML approaches. As a result, some genuinely good results have been analyzed. Index Terms—Intrusion, Machine Learning, Security

A Meta-Model to Predict and Detect Malicious Activities in 6G-Structured Wireless Communication Networks

The rapid leap in wireless communication systems incorporated a plethora of new features and challenges that accompany the era of 6G and beyond being investigated and developed. Recently, machine learning techniques were widely deployed in many fields, especially wireless communications. It was used to improve network traffic performance regarding resource management, frequency spectrum optimization, latency, and security. The studies of modern wireless communications and anticipated features of ultra-densified ubiquitous wireless networks exposed a risky vulnerability and showed a necessity for developing a trustworthy intrusion detection system (IDS) with certain efficiency/standards that have not yet been achieved by current systems. IDSs lack acceptable immunity against repetitive, updatable, and intelligent attacks on wireless communication networks, significantly concerning the modern infrastructure of 6G communications, resulting in low accuracies/detection rates and high false-alarm/false-negative rates. For this objective principle, IDS system complexity was reduced by applying a unique meta-machine learning model for anomaly detection networks was developed in this paper. The five main stages of the proposed meta-model are as follows: the accumulated datasets (NSL KDD, UNSW NB15, CIC IDS17, and SCE CIC IDS18) comprise the initial stage. The second stage is preprocessing and feature selection, where preprocessing involves replacing missing values and eliminating duplicate values, leading to dimensionality minimization. The best-affected subset feature from datasets is selected using feature selection (i.e., Chi-Square). The third step is represented by the meta-model. In the training dataset, many classifiers are utilized (i.e., random forest, AdaBoosting, GradientBoost, XGBoost, CATBoost, and LightGBM). All the classifiers undergo the meta-model classifier (i.e., decision tree as the voting technique classifier) to select the best-predicted result. Finally, the classification and evaluation stage involves the experimental results of testing the meta-model on different datasets using binary-class and multi-class forms for classification. The results proved the proposed work’s high efficiency and outperformance compared to existing IDSs.

Design and Implementation of Intrusion Detection System (IDS) for Wireless Local Area Network (WLAN) Security at SMKN 5 Bengkulu City

The network at SMK Negeri 5 Bengkulu City at this time often has complaints such as a decrease in internet network performance which in turn affects all computers connected to the network. Intrusion Detection System (IDS) whose job is to monitor networks and suspicious activities in a network system. The research method that the authors use is a linear sequential process model. The life cycle of implementing a network system is defined in a number of phases, namely: Problem Identification and Formulation, Literature Study, Testing, Implementation, System Design, System Requirements Analysis. The author uses Snort, Telegram Bot on Ubuntu based IDS sensor engine. The results of this thesis research conclude that the applied IDS system can function to detect intruders or intruders on the IDS sensor machine, which is displayed in the form of notifications to telegrams.